TAR, privilege, and closed deployments in discovery

A single litigation can dump 2 million documents into your lap. A team of associates reading at a steady clip would need years. The court gives you weeks. This is the everyday reality of modern discovery, and it is why machine learning quietly became a core legal skill.

But speed is only half the problem. Buried in those 2 million documents are emails between your client and their lawyers. If even one slips to the other side, you may have waived attorney-client privilege (the legal protection that keeps confidential legal advice secret). So the model that reads fast enough to save you also has to run somewhere safe enough to protect you.

This lesson is about that tension.

What TAR actually is

TAR stands for Technology-Assisted Review. It means using machine learning to prioritize or classify documents in discovery instead of having humans read every page.

Discovery is the pretrial phase where each side must hand over relevant documents to the other. "Responsive" documents are the ones that match the other side's requests. TAR's job is to find them fast.

The core workflow is simple:

1. A senior lawyer reviews a small "seed set" of documents and tags each one responsive or not.
2. The model learns from those tags.
3. The model scores the remaining millions by likelihood of being responsive.
4. Humans review the high-scoring documents; low-scoring ones get sampled to check the model did not miss anything.

There are two common flavors. TAR 1.0 trains once on a fixed seed set. TAR 2.0, also called continuous active learning (CAL), keeps retraining as reviewers tag more documents, so the model gets sharper throughout the project. Most modern review platforms use CAL.

Why courts allow it

Judges have blessed TAR for over a decade. The landmark U.S. opinion is *Da Silva Moore v. Publicis Groupe* (2012), where the court approved predictive coding for the first time. The key legal principle is reasonableness, not perfection. You do not have to find every responsive document. You have to run a defensible, proportionate process.

That word "defensible" is everything. It shapes how you document your methodology, your seed set, and your quality-control sampling. If you cannot explain what the model did, you cannot defend it.

For a plain-language primer, The Sedona Conference publishes widely cited guidance on eDiscovery practice: The Sedona Conference publications.

The privilege problem

Now the hard part. Some of those documents are privileged, and privilege changes the risk profile completely.

Attorney-client privilege protects confidential communications made to get legal advice. Work-product doctrine protects materials prepared for litigation. Both can be waived if you disclose the protected material, sometimes even by accident.

So privilege review runs alongside responsiveness review. You are asking two questions of every document:

• Is this responsive (does the other side get it)?
• Is this privileged (must we hold it back and log it)?

A privilege log is the list you produce describing each withheld document without revealing its contents. Getting this wrong is expensive. Miss a privileged email in your production, and you may have waived privilege over that document, and possibly the entire subject matter.

Why this makes the AI question sharper

Here is the collision. To do TAR well, the model must read the most sensitive documents your client owns: legal strategy, settlement thinking, internal admissions.

If you send those documents to a public AI service over the internet, you have arguably disclosed confidential client material to a third party. Depending on the terms, that could:

• Undermine confidentiality obligations under professional conduct rules.
• Risk a privilege waiver argument from opposing counsel.
• Violate the terms of a protective order or client engagement agreement.

This is why the deployment model is not an IT footnote. It is a legal decision.

Closed deployments: the walled garden

A closed deployment means the AI model runs inside an environment your firm controls, where client data never leaves a defined boundary and is never used to train anyone else's model.

Contrast the two extremes:

Public API. You send text to a vendor's servers over the internet. Fast to set up. But you are trusting their data-handling terms, and the data leaves your walls.

Closed deployment. The model is hosted in a private cloud tenant or on-premises hardware dedicated to your firm or matter. Inputs and outputs stay inside. No data is retained for training. Access is logged.

Most serious eDiscovery platforms now offer closed configurations precisely because law firms cannot use tools that leak client data.

What "closed" should mean in a contract

Do not accept marketing language. When evaluating a deployment, insist the vendor answer these in writing:

• Data residency. Where physically is the data stored and processed?
• Training use. Is any client data used to train or fine-tune shared models? The answer must be no.
• Retention and deletion. How long is data kept, and can you certify deletion at matter close?
• Tenant isolation. Is your data logically or physically separated from other clients?
• Access logging. Who touched what, and can you produce an audit trail?

These mapmapEinsatz von Software, um wiederkehrende Marketingaufgaben und Kampagnen zu automatisieren und Personalisierung in großem Maßstab über Kanäle wie E-Mail, Web und Social zu ermöglichen.Vollständige Definition ansehen → directly to your ethical duty of confidentiality and to any protective order in the case.

🎬 [VIDEO: "How Predictive Coding Works in E-Discovery" — youtube.com — a clear walkthrough of TAR workflows and defensibility for non-technical legal professionals]

A concrete scenario

Picture a 2 million document antitrust matter. Here is how the pieces fit together.

Week 1. Data is ingested into a closed review platform hosted in a private cloud tenant. Nothing goes to a public APIAPIApplication Programming Interface: eine standardisierte Schnittstelle, über die Anwendungen kommunizieren und Daten austauschen, ohne die interne Funktionsweise der jeweils anderen zu kennen.Vollständige Definition ansehen →. Deduplication and email threading cut the volume by roughly a third (a typical range, not a guarantee).

Week 2. A senior associate tags a seed set. Continuous active learning starts scoring documents for responsiveness.

Weeks 3 to 6. Reviewers work the ranked queue, tagging responsiveness and privilege. The model retrains nightly. A separate classifier flags likely privileged documents (for example, anything mentioning the general counsel or outside counsel domains) for closer human review.

Week 7. Quality control. The team samples the "not responsive" pile to estimate how many responsive documents were missed. This recall estimate (the share of truly responsive documents the process caught) is what you cite if challenged.

Week 8. Production, with a privilege log for withheld documents and a clawback agreement under Federal Rule of Evidence 502(d), which lets parties agree that an accidental privilege disclosure does not waive privilege.

The AI never sees a public server. The process is documented at every step. That is defensibility.

A note on how privilege scoring can go wrong

Models learn patterns, not law. A privilege classifier trained mostly on emails to law firm domains may miss a privileged conversation that happens to involve a non-lawyer relaying legal advice. That is why the model flags for human review rather than deciding. The lawyer makes the privilege call. Always.

Here is a simplified sketch of a privilege triage rule layered on top of a model score:

def route_document(doc, model_score, privilege_terms):
    # model_score: 0 to 1 likelihood of privilege
    high_risk = model_score > 0.5
    mentions_counsel = any(t in doc.text.lower() for t in privilege_terms)

    if high_risk or mentions_counsel:
        return "PRIVILEGE_REVIEW_QUEUE"  # human decides
    return "STANDARD_REVIEW_QUEUE"

The point is not the code. It is that automation narrows the pile; humans make the legal judgment.

Generative AI enters the mix

Classic TAR uses classification. Newer tools add generative AI (large language models that produce text) for tasks like summarizing documents, drafting privilege log entries, or answering questions across a document set.

This raises the stakes on closed deployment even further, because generative models can be prompted to reveal or reconstruct sensitive text. A summary of a privileged memo is still privileged.

Two practical cautions:

Hallucination. Generative models can produce confident, wrong summaries. Never let an auto-generated privilege log entry go out unreviewed.

Prompt and output retention. Prompts often contain the very document you are protecting. Confirm prompts and outputs are handled inside the closed boundary just like the source documents.

The good news: a generative summary can make human privilege review faster, letting a lawyer triage 50 documents in the time it once took to read 5. Speed and protection can coexist, but only inside the walls.

Key Takeaways

• TAR is defensible, not perfect. Courts require a reasonable, documented process, so invest in seed sets, methodology notes, and recall sampling you can defend if challenged.
• Privilege is where AI risk concentrates. The model must read your most sensitive documents, so deployment location is a legal decision, not an IT one.
• Demand a real closed deployment. Get written answers on data residency, training use, retention, tenant isolation, and audit logging before any client data moves.
• Automation narrows, humans decide. Use models to rank and flag, but keep every privilege call with a lawyer, and never ship an unreviewed generative summary.
• Protect a 502(d) clawback. Even a strong process can miss a privileged document, so secure an agreement that an accidental disclosure does not waive privilege.