The cheapest time to prepare for a legal hold is before you need one.
When litigation is reasonably anticipated, an organization generally has to preserve the information that could be relevant. Over-collecting is expensive. Missing something can bring sanctions. Both are easier to avoid when you already know where your data lives and who owns it.
This is general information, not legal advice. Talk to counsel about your obligations.
1. Keep a data map and inventory
- List the systems that hold business information: file shares, SharePoint, email, line-of-business apps, and backups.
- Include modern channels: Slack, Teams, WhatsApp, Signal, and text messages used for work.
- Add AI tools. Prompts, outputs, and transcripts are now artifacts that opposing counsel and regulators ask about.
- Record who owns each system and each process, such as a chat channel or an AI tool. Ownership gaps are where policies fail.
2. Scope each hold deliberately
- Replace open-ended holds with defined date ranges and topics. Unbounded holds pile up unnecessary data.
- Document why each scope decision was made. Proportionality works better with a written reason than with an abundance of caution.
- Review holds on a schedule and release them when the matter ends.
3. Notify system owners, not only custodians
A hold sent to individual employees can miss the systems they use. The owner of a chat platform or a file archive may be running a migration or an automatic deletion that wipes the evidence. Make sure the people who run the system are told, and have a way to pause deletion.
4. Preserve in place when you can
- Keeping data where it already lives is often the most efficient approach.
- It still needs coordination with system owners so retirement, upgrades, and migrations do not destroy it.
- Full forensic imaging of every device is not always needed. Match the method to the case and the device.
5. Plan for ongoing matters
Some matters, such as anti-corruption investigations, involve conduct that continues. Those holds need a defined cadence for refreshing collections so newly created information is captured.
6. Resolve retention conflicts in advance
- Decide how legal holds interact with data-minimization and deletion requests, with counsel's input, before a request arrives.
- If a retention rule cannot be applied automatically, assign a manual period based on risk instead of leaving the data to live forever.
- Write down who decides when rules conflict.
7. Decide what to do with paper originals
After scanning, some records still have to be kept as paper for a period. Others do not. Decide record type by record type, and track where the boxes are, including remote warehouses. The same applies to records you may need to produce under public-records laws.
8. Check that AI does not undo your preservation
If an AI tool indexes your documents, deleting the originals does not always remove the indexed copies. Make sure disposal and holds are reflected in whatever the AI can search. Our guide to retention schedules and AI accuracy explains why.
A one-page readiness test
- Could you list every system holding business records in a day?
- Does each system have a named owner who would be told about a hold?
- Are your holds scoped by date and topic?
- Do you know where AI prompts and outputs are stored and for how long?
- Could you show why you kept or deleted something six months from now?
If you answered no to two or more, start with the data map. We help organizations organize and classify documents as part of document processing projects, and Is your data ready for AI? covers the same groundwork for AI. See also how AI exposes data nobody labeled.
Illustrations in this guide are drawn from talks at an industry information-governance conference and from general practice. They are anonymized and are not Horus client results.
Part of our guide: Information governance for AI