1. Why "Enterprise" Does Not Mean Zero Data Retention
Commercial AI agreements generally govern model training and operational retention in separate clauses. Under a typical training exclusion, the vendor agrees not to use prompts or outputs to improve its models. Unless ZDR is separately approved or configured, the same vendor commonly keeps prompt and output logs for up to 30 days, so that automated classifiers and authorized staff can investigate abuse (OpenAI, Data Controls). Hosted workspaces such as ChatGPT Enterprise and Claude for Work also store conversations and uploaded files on the vendor's infrastructure, under vendor-managed keys, for as long as the workspace retention setting allows.
A 30-day log is unremarkable in most corporate software. However, in merger negotiations, internal investigations, or trial preparation, any period in which a third party holds readable client material is a period in which that material can be swept into a litigation hold, demanded by subpoena, or exposed by a software defect.
2. Inside Commercial Terms of Service
On the OpenAI API, abuse-monitoring logs are kept for up to 30 days by default. Customers can apply for Zero Data Retention or a narrower Modified Abuse Monitoring control, both subject to OpenAI's prior approval, and eligibility varies by endpoint (OpenAI, Data Controls). Anthropic's API deletes inputs and outputs within 30 days by default, with ZDR available by agreement (Anthropic, Organization Data Retention). However, since June 9, 2026, Anthropic has required data retention for its most capable "covered" models (currently the Mythos and Fable families) on every platform where they are offered, including AWS Bedrock and Google Cloud. A workspace or cloud project configured for ZDR cannot use those models unless retention is turned on, apart from limited exceptions Anthropic grants by agreement, while all other Claude models keep their existing ZDR terms (Anthropic, Covered Models). ZDR status now has to be confirmed model by model.
Google Cloud's Gemini Enterprise Agent Platform (formerly Vertex AI) takes a different route. Its standard terms bar Google from training on customer data without a separate contract, and ZDR is achieved through configuration: disabling default data caching, avoiding features that store prompts, and requesting an exception from abuse-monitoring prompt logging. Google's documentation also notes that Grounding with Google Search stores logs and that ZDR may not be possible with some advanced AI features (Google Cloud, Zero Data Retention).
Legal-specific AI products add another layer. Even when their model calls run over ZDR, the application vendor may log prompts for debugging, cache responses, or keep document embeddings in a shared database, and the model provider's terms say nothing about what that vendor keeps.
3. Application Data vs. Model Inference
During inference, the model reads the prompt, computes a response in memory, and returns it. Under ZDR, the provider writes nothing to persistent storage. Lawyers, though, need saved threads, matter workspaces, and searchable research, so any useful legal AI tool keeps that data somewhere. The procurement question is where that data lives and who holds the keys.
In a commercial enterprise subscription, saved chats and uploaded files sit in the vendor's multi-tenant database, separated from other customers by logical identifiers and encrypted with keys the vendor controls. In a dedicated single-tenant enclave, the database, document storage, and search indexes run inside a cloud project and Virtual Private Cloud (VPC) provisioned for one firm, and only the model call leaves the environment, over a ZDR channel. Storage is encrypted with Customer-Managed Encryption Keys (CMEK) in the firm's own key management service, or with an External Key Manager (EKM) held outside the cloud provider. The AI software vendor never holds the stored records.
4. Litigation Holds and Subpoenas
The New York Times Preservation Order
In May 2025, in the consolidated copyright litigation against OpenAI (In re OpenAI, Inc. Copyright Infringement Litigation, No. 25-md-3143 (S.D.N.Y.)), Magistrate Judge Ona T. Wang ordered OpenAI to preserve ChatGPT output logs that would otherwise have been deleted, including conversations users had asked OpenAI to delete. The order reached consumer, Team, and standard API accounts. OpenAI stated that ChatGPT Enterprise and API customers under Zero Data Retention were not affected (OpenAI, How We're Responding to The New York Times' Data Demands). The ongoing obligation ended under an October 2025 stipulated order, but logs already preserved stayed preserved.
A court hearing a case against an AI vendor can suspend routine deletion across every non-ZDR account the vendor serves, including accounts belonging to law firms with no connection to the dispute. An endpoint that never retains logs leaves nothing to freeze.
Stored Communications Act Demands
Under 18 U.S.C. § 2703, federal authorities can compel a cloud or SaaS provider to produce stored customer records, and 18 U.S.C. § 2705(b) lets a court bar the provider from telling the customer. Department of Justice guidance directs prosecutors to seek enterprise data from the enterprise when practical, but permits going to the provider when notice could jeopardize an investigation (DOJ, 2017).
A SaaS vendor that stores workspace histories and holds the keys can decrypt and produce them. Moving storage into a firm-controlled project with a customer-managed encryption key (CMEK) removes the application vendor from that chain and logs every key use in the firm's audit trail. Standard CMEK keys still sit in the cloud provider's key service, so the provider could technically use an active key if compelled; keys held in an enterprise key management (EKM) system outside the provider leave it with encrypted text that it cannot read. The government can still serve the firm directly, but then the firm knows about the demand and can assert privilege.
5. What Courts Now Expect From Your AI Contract
When pressed on confidentiality, vendors tend to point to their SLA, which measures uptime, and their liability cap, which typically limits recovery to twelve months of fees (OpenAI, Services Agreement; AWS, Customer Agreement). Neither helps once privileged material is disclosed, because no refund restores privilege. The terms that matter are the ones that courts have started to consider, and three of them belong on every procurement checklist.
- Retention, training, and disclosure rights. Privilege generally survives sharing with a third party only when that party is helping counsel, as the accountant was in United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). In United States v. Heppner, the court found no "reasonable expectation of confidentiality" because the platform's policy let the provider collect inputs, train on them, and share them with third parties.
- Contractual limits on storage and sharing, documented in writing. The protective order in Morgan v. V2X, Inc. bars putting confidential discovery into any AI tool unless the provider is "contractually prohibited from: (1) storing or using inputs to train or improve its model; and (2) disclosing inputs to any third party" beyond what the service requires, and must allow deletion on request. The party has to keep written proof of those terms, and the court required disclosure of which AI tool had been used.
- Closed environments and end-of-case deletion. In Jeffries v. Harcros Chemicals Inc., the court barred uploading any discovery materials to open AI tools and allowed closed tools only with notice, no training on the data, and deletion when the case ends.
Some courts have protected a litigant's AI-assisted drafts as work product, as in Warner v. Gilbarco, Inc., because using a tool does not hand the material to an adversary. That protection covers litigation preparation only. Transactional, regulatory, and advisory work depends on privilege and the duty of confidentiality, and both turn on the vendor's terms.
Under ABA Model Rule 1.6(c) and ABA Formal Opinion 512, a firm must make reasonable efforts to prevent unauthorized disclosure. ZDR terms, key-custody records, and deletion logs are the simplest way to show those efforts. They matter again under Federal Rule of Evidence 502(b) if a vendor defect ever exposes privileged material, because the firm avoids waiver only if it took reasonable steps to prevent the disclosure and moved promptly to correct it.
6. Side-by-Side Procurement Comparison Matrix
| Procurement Dimension | Consumer / Pro AI Plans | Commercial Enterprise SaaS | Commercial API with ZDR | Single-Tenant Enclave + ZDR |
|---|---|---|---|---|
| Model Training on Prompts | Often permitted unless the user opts out. | Excluded by contract. | Excluded by contract. | Excluded by contract. |
| Prompt Logs at Model Provider | Retained per consumer policy. | Often up to 30 days unless ZDR applies. | None, except model-specific carve-outs. | None, except model-specific carve-outs. |
| Where Saved Chats & Files Live | Vendor's multi-tenant cloud. | Vendor's multi-tenant cloud. | Wherever the firm builds its application. | Firm's dedicated cloud project and VPC. |
| Encryption Key Custody | Vendor. | Vendor (customer keys rarely cover full workspace). | Not applicable to stateless calls. | Firm, through CMEK or EKM. |
| Exposure to Vendor Litigation Holds | High. | Moderate; logs and workspaces can be frozen. | Low at the model layer. | Low; no vendor-held copies. |
| Record Available if Confidentiality Is Challenged | Weak (Heppner). | Vendor's contractual assurances. | Model call only. | Firm's own audit, key, and deletion logs. |
7. Why Standard SaaS Contract Review Falls Short
Our first article and our second article covered the baseline governance questions. At final negotiation, a generic software checklist tends to miss AI-specific exposure, because the obligations are split between legal documents and live cloud settings. An order form may promise confidentiality while incorporating online terms that allow 30-day logging or prompt caching unless specific settings are in place. A Data Processing Addendum may promise deletion at termination while carving out 90 to 180 days for backups, because purging one customer from shared backup archives is impractical. That carve-out fits poorly with protective orders like those in Jeffries and Morgan. When the firm holds the keys, disabling a matter's key cuts off access, and destroying it makes primary data and backups permanently unreadable once the scheduled-destruction period runs (30 days by default in Google Cloud KMS), with each step recorded in the firm's own audit logs.
The contract and the configuration have to be reviewed together. A lawyer may spot an independent-contractor clause that undercuts a Kovel argument without knowing whether ZDR is enforced at the project level or whether the chosen model is a covered exception. An administrator may confirm the settings without seeing that the retention terms are exactly what opposing counsel will examine once a Morgan-style order reveals which tool the firm used.
9. Conclusion
Commercial enterprise subscriptions solve the training problem and suit administrative work and general research. For privileged strategy, unannounced transactions, or regulated records, they leave retention, subprocessor routing, and key custody unresolved, and those are the points courts have started to examine.
A workable rule: use enterprise seats for non-confidential work, require Zero Data Retention, confirmed model by model, for any confidential prompt, and keep saved matter data in a dedicated single-tenant enclave where the firm holds the keys and can document deletion.