Designing a Privilege Gate So Privileged ESI Never Reaches Review

Privileged files held at intake never reach review, still the largest single cost of eDiscovery.

What Is a Privilege Gate, and Why Does It Belong at Ingestion?

A privilege gate is a checkpoint that holds each document out of review until a screen clears it. At ingestion, it keeps privileged ESI from reviewers and models alike.

Think about the collection as it lands. Thousands of files, still sealed in their containers. Somewhere in the stack, a note to outside counsel is waiting. No one has opened it. Not a reviewer. Not a model.

That silent stretch is where I would put the gate. Federal Rule of Evidence 502 has governed waiver since September 19, 2008, and its last amendment took effect on December 1, 2011, years before generative AI review entered the picture. By 2024, nearly a quarter of legal industry professionals expected generative AI to transform eDiscovery. The rule held still. The first reader changed.

Most teams lean on a clawback instead. One recorded eDiscovery explainer notes that court orders containing clawback agreements are binding on other parties and proceedings. That reach is real. Yet on a 2026 episode of the AI and the Future of Law podcast, Bridget McCormack restated the older rule a gate is built around: once a third party is privy to an attorney-client conversation, it is no longer privileged.

So the design question moves upstream, to the quiet hour before anyone looks.

Why Is Privilege Won or Lost Before Anything Is Produced?

Under Federal Rule of Evidence 502(b), an accidental disclosure keeps its privilege only if reasonable steps came first, so the decisive proof is built at intake, not in the log.

The rule sets three conditions. The disclosure must be inadvertent. The holder must have taken reasonable steps to prevent it, and then moved promptly to fix the error. Two of those three conditions look backward, to the quiet hours before anything left your hands.

Before any file moves toward a reviewer, I would ask three questions in order:

1. Has every item been screened for privilege, or are some still unknown?
2. Will an unknown item stay held back until an attorney clears it?
3. Could you show a judge what happened to each file before the first disclosure?

A no to any of them is a gap opposing counsel will find.

The Judicial Conference Advisory Committee's note to Rule 502 lists what courts weigh: the reasonableness of precautions, the time taken to rectify, the scope of discovery, the extent of disclosure, and overriding fairness. The same note says a party that uses advanced analytical software and linguistic tools to screen for privilege may be found to have taken reasonable steps. A 2023 American Bar Association litigation newsletter adds the hard part. Under 502(b), the producing party carries the burden, and meeting it "can require substantial effort and documentation."

The common assumption is that privilege dies when opposing counsel opens the production. A recent AI ruling points to an earlier moment. In United States v. Heppner, a federal court in the Southern District of New York held that a defendant's exchanges with a publicly available AI platform were not protected by attorney-client privilege or the work product doctrine. The platform had warned that it collected inputs for training. Nothing said there was confidential.

Practitioners now warn that feeding privileged text into a tool whose design shares data with outside parties could be read as a voluntary disclosure. Bridget McCormack's test for an AI tool is whether you have "the right version of the product and the right settings in place," and it has to be run before ingestion, because afterward the disclosure has already happened. The third party has already heard it.

In practice, the log proves what you withheld. It cannot prove what you prevented.

A review of 5 sources behind this section points the same way: the question a court asks is about the moment before the first reader, human or machine. That is why our processing at Relevant e-Discovery runs single-tenant, or inside the client's own AWS account under the client's own keys, with no vendor retention and no model training. I trace that sequencing risk further in whether privileged ESI gets embedded before the screen, because the order of operations decides what a model has already read.

So the work moves to the front door. The files arrive there sealed, unread, still silent, and every decision that follows depends on what the gate does next.

Does a Rule 502(d) Order or Clawback Agreement Make an Upfront Gate Unnecessary?

No. A 502(d) order or clawback limits the damage after privileged files leak, but neither stops the leak or makes the other side forget what it read.

Both backstops are worth having. Neither is a gate.

A 2026 client alert published on fredlaw.com shows how strong the best version can be. In FTC v. Amazon.com, Inc., decided in the Western District of Washington on Sept. 16, 2025, the parties' agreed ESI order covered production "whether inadvertent or otherwise" and stated that "The provisions of Fed. R. Evid. 502(b) do not apply." Amazon ran a privilege re-review and sought to claw back certain categories of documents it had already produced. The court sided with Amazon. It rejected the plaintiffs' objection, noting they did not contend Amazon had used the documents, for example by citing them in a filing.

Read that holding slowly. Amazon won the fight. It still had to have the fight, after the documents had already crossed the table.

Conventional wisdom treats a clawback as cheap insurance. The mechanics say otherwise. A notice under Rule 26(b)(5)(B) only preserves the issue: the receiving party must stop using the material and then return it, destroy it, or bring the dispute to the court. Court orders that contain clawback terms do bind other parties and other proceedings. A clawback also says nothing about the next file from the same sender, still waiting unread in the queue.

One practitioner describes a scene that will sound familiar. Partway into discovery, the team learns that someone at the client worked in or for its legal department. By then, 20 to 30 documents that person wrote have already gone out. The clawback clause, typically a couple of sentences inside the ESI agreement, gets invoked. Opposing counsel can still argue.

The worse failures skip review entirely. In a 2022 r/ediscovery thread, a commenter at a trial technology and court reporting firm said clients routinely sent raw PST files with nothing de-duplicated and no privileged items removed. The usual reply, in that commenter's telling: "we'll deal with that later. Just convert everything to pdf, upload and send a link to all counsel." In the incident under discussion, the files reportedly landed in a Dropbox folder that plaintiffs' counsel could already open.

Scale makes the odds worse. Another commenter in the clawback discussion notes that when tens of thousands or millions of documents change hands, a reviewer, an attorney or an algorithm will inevitably miscode some. Size alone does not set the length of a review, as I argue in whether a bigger document set always means a longer review, but every added file is one more chance for a wrong tag.

An order decides who wins the argument. So put one question to any review platform before you commit: does its privilege check run only at production, or at the moment a file is first read?

An order does not make the privilege call either, and in a 2022 r/ediscovery thread one commenter put privilege review at the top of the work that needs a lawyer ("pretty darn lawyery"), so that lawyer's call belongs at the gate.

Building it is less exotic than it sounds. It starts with knowing, before ingestion begins, whose names should make the gate slam shut.

How Do You Build a Fail-Closed Privilege Gate That Survives a Challenge?

Clear AI use, define privilege in writing, hold unscreened files by default, test the released set, and tie every call to a verifiable exhibit.

Fail-closed means one thing. When the gate is unsure, the file stays behind it. A fail-open gate does the reverse: everything flows toward review unless something flags it, and the unscreened files drift through in the dark, unheard.

Before: a file with no privilege hit moves straight to the review queue. After: a file reaches the queue only once it has been screened and cleared, and a file nobody screened waits.

Here is the design I recommend, in five steps:

1. Clear AI use before any data moves. eDiscovery practitioners describe a three-part check: company policy, client policy, and any agreement or court order that bars AI in the case. One project manager never pastes real ESI into a general AI tool, only error messages and fake examples.
2. Write privilege down. Put definitions and concrete examples of privileged material in the coding manual, so every reviewer and every model prompt applies one standard.
3. Segregate at ingestion and hold by default. Screen each file as it is processed. Anything that hits a privilege marker, and anything not yet screened, goes to a separate privilege set that no reviewer or model reads until an attorney releases it.
4. Test what the gate released. Sample the cleared set and look for privileged files that slipped past. Repeat until the result holds.
5. Record every decision as it happens. Keep the decisions made, protocol changes, issues encountered and test results in one running record.

Daniel Bonner of Level Legal, writing for ACEDS in 2024, grounds steps two, four and five. He calls for coding manuals with definitions and examples of privileged information, for elusion testing of the null set, and for documentation he describes as key to a defensible process before opposing counsel or the court. His warning is blunt: "Garbage in is garbage out, regardless of the technology." The same sampling logic that finds missed responsive documents fits a privilege screen.

Why must step three come before the model? In a 2025 r/ediscovery thread, one practitioner said Relativity no longer promotes linear review, TAR or RAR, only its generative AI tool, aiR. Another cautioned that aiR "isn't capable of handling all review scenarios and/or document types." Contrary to the pitch that you can load a discovery request and let AI find every privileged document, a third commenter filed that promise under hype and marketing.

When a model is the first reader, the gate must stand in front of it. Human judgment still closes the loop.

At Relevant e-Discovery, a fail-closed privilege gate sits on production, behind immutable originals with content hashing and an append-only audit trail, and every output links back to the exact exhibit it came from so an attorney can verify it in one click before filing. That is our answer when opposing counsel challenges the process: the record already shows each step. I map the usual lines of attack in seven ways opposing counsel attacks an ESI collection.

When the challenge comes, you do not argue from memory. You hand over the record, file by file, hash by hash, and let the silence do the rest.

What Should You Build Before the Next Collection Arrives?

Put the privilege screen at ingestion, hold anything unscreened by default, and record each call. That record is the proof Rule 502(b) asks for once a file slips.

The fredlaw.com alert breaks the waiver test into three parts. The disclosure was inadvertent. The holder "took reasonable steps to prevent disclosure." The holder then moved promptly to correct the error. Only the middle condition can be built before anything leaves the building, and a gate builds it as a matter of course, one held file at a time.

Here is where I think this goes. Opposing counsel will stop asking what you logged. They will ask what your model read before any lawyer did. A privilege log, written afterward about documents already gone, has no answer for that. A fail-closed gate does, because its record was made at the moment each file was held back, and the lawyer stays fully accountable for the work product however a machine helped make it.

So start with the next collection. Decide where the gate stands. Then decide what it does when it hears nothing at all.