Somewhere in California right now, a litigator is staring at a discovery request that asks opposing counsel to hand over the prompts and outputs from a generative AI tool. A year ago that request might have drawn a smirk and a boilerplate objection. Today it lands differently, because the state has started putting real legal weight behind the question of how artificial intelligence gets used in the practice of law.
The specifics matter less than the direction of travel. California’s new AI legislation, as firms like Arnold & Porter have been parsing in client advisories, pushes lawyers and the discovery teams who support them toward clearer disclosure, more documented supervision, and a defensible record of what a machine did versus what a human reviewed. The law does not turn every deposition into a referendum on large language models. But it does remove the comfortable ambiguity that has surrounded AI-assisted legal work for the past few years.
For eDiscovery teams, that ambiguity was doing a lot of quiet labor. Review platforms have been leaning on machine learning for years, and most practitioners will tell you the technology has been a genuine improvement over keyword searches and brute-force human review. The trouble is that “the algorithm found it” has never been a satisfying answer in a courtroom, and now the paperwork around that answer is getting thicker. If a model classifies millions of documents and a small human team signs off on the results, regulators and opposing counsel increasingly want to see how that sign-off was actually earned.
The disclosure question cuts in two directions, which is what makes it interesting. On one side, clients want to know whether their outside counsel is using AI on their matters, and what happens to privileged material once it enters a third-party tool. On the other, parties in litigation want to probe whether an adversary’s AI-assisted review missed responsive documents. Neither demand is unreasonable, and both create work for firms that have been treating AI as an invisible efficiency layer.
There’s a practical wrinkle that doesn’t get enough attention. A lot of the AI now in legal workflows isn’t a specialized review platform at all. It’s a general-purpose chatbot that a junior associate pasted a contract into at eleven at night. That kind of shadow usage is exactly what new disclosure and supervision requirements are designed to surface, and it’s why firms are suddenly rewriting internal policies that previously amounted to “be careful.” The law doesn’t need to name every tool; it just needs to make the consequences of undisclosed use concrete enough that general counsel start asking questions.
Sanctions are the quiet threat here. Courts have already been experimenting with penalties when AI-generated filings contain fabricated citations, and the new California framework gives that trend more structure. The message to practitioners is less about punishment and more about process: if you can show a documented review, a clear chain of human oversight, and honest disclosure, you’re probably fine. If your defense is that nobody told you the tool could hallucinate, the conversation gets shorter and less pleasant.
The broader context is worth keeping in view. California is not operating in a vacuum. Other states and the federal government are moving on AI governance at different speeds, and the legal profession is watching all of them at once. What makes California distinctive is the size of the legal market it governs and the fact that so much AI development happens within its borders. When the state writes rules, the compliance departments of every major firm in the country read them closely, even if their own jurisdictions haven’t acted yet.
None of this means the sky is falling for eDiscovery vendors or the lawyers who rely on them. The industry has absorbed encryption mandates, data privacy regimes, and proportionality standards without collapsing, and AI governance will likely follow the same pattern: initial grumbling, a scramble for documentation, and eventually a set of standard practices that everyone treats as obvious. The firms that move early will spend the next year building audit trails and vendor questionnaires. The ones that wait will spend it improvising.
The more interesting question is whether disclosure requirements will change how AI is actually used, not just how it’s described. There’s a real chance that firms start favoring narrower, more explainable models over flashy general-purpose ones, precisely because they can be defended in a filing. That would be a quieter outcome than the headlines suggest, but it might be the most consequential one. The law rarely tells technologists what to build. It tells everyone else what they’ll need to prove, and the proving has just begun.