Wrong. And this counterintuitive truth may be one of the most important things your information governance program needs to confront right now.

Speed Undermines Governance

Here is the problem: a retention schedule is not just a legal reference document. It is a governance document. And governance requires deliberate, documented, authorized decision-making. When your schedule is updated reactively, outside of a formal approval cycle, you lose the paper trail that proves your retention decisions were intentional. You replace a defensible program with a moving target that nobody fully controls.

When the Audit Trail Matters

Think about what happens when it counts. A regulator conducts an audit and demands to know why your organization retained a certain category of records for five years instead of seven. Your team pulls up the schedule. The answer? “The system updated it automatically based on a legal citation change.”

That is not a defense. That is an admission that your program lacks governance.

Planned Updates Create Defensibility

The strongest retention programs aren’t the ones that change the most frequently. They are the ones that can demonstrate, at any moment, that every decision was made deliberately, reviewed by the right people, and documented through a formal approval process. Defensible records management typically supports regular, planned update cycles, such as annual, biennial, or multi-year reviews, because those cycles give organizations time to assess legal changes, evaluate business impact, engage the businesses and stakeholders, secure approvals, and communicate changes to affected teams. That is not a sign of a slow program. It is a sign of a disciplined one.

Frequent updates can also create practical compliance risks. If the schedule changes faster than the business can implement, train on, and apply those changes, the organization may be left with inconsistent practices across systems, teams, and jurisdictions. A schedule that is technically current but operationally impossible to follow does not reduce risk. It can increase it by creating gaps between what the policy says and what employees are actually able to do.

Inconsistency is the enemy of defensibility.

A More Disciplined Risk Management Approach

This is where Zasio’s consulting approach stands apart. Zasio helps organizations build retention schedules that reflect their governance structure and risk profile rather than follow an automated update cycle. Its in-house team of legal professionals conduct research, analyze, and review a curated database of comprehensive citations, focusing on regulatory changes with material impact, distinguishing updates that require a decision from incremental changes that do not. When a meaningful change is identified, Zasio helps document the rationale, route the change through the appropriate approval process, and create a clear record of why and when the schedule was updated.

That documented record is your protection. It is what turns a retention schedule from a spreadsheet into a defensible compliance instrument. If your organization cannot explain the reasoning behind every retention decision in your schedule, it is time to rethink how updates are being made and who is accountable for them.

The goal is not the fastest schedule. The goal is the most defensible.

Disclaimer: The purpose of this post is to provide general education on records management and information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Updating Your Retention Schedule Too Often Puts Your Organization at Risk appeared first on Zasio.

Key AI Records Litigation Takeaways

• Internal AI chat logs, prompts, and automated meeting transcripts are legally discoverable and subject to heavy scrutiny by courts.
• Attorney-Client Privilege generally does not protect conversations with AI tools, even if legal advice is being sought.
• Rulings on the Work Product Doctrine vary sharply by state, often depending on the state’s public privacy policies.
• To mitigate litigation risks, organizations must map AI usage and align outputs with corporate retention schedules.

Potentially Risky AI Records

Some AI-related records concerns are easily anticipated such as reliance on incorrect information and privacy vulnerabilities. Far fewer organizations scrutinize the records that AI usage produces.

Even using AI for routine tasks can cause concerns to crop up. AI-generated meeting transcripts and summaries can transform candid or offhand comments into lasting records.

The records produced by AI chat and conversation tools warrant particular attention. While employees might be using AI chat sessions as casual brainstorming tools, they may not realize that the prompts, outputs, and logs generated are often retained within these tools. Conversely, some tools apply auto-delete policies meaning that records can be erased regardless of their importance.

Whether unknowingly retained or deleted, these records increasingly factor into litigation.

Chat Log Case Study

In Fortis Advisors LLC v. Krafton, Inc., former stockholders of video game studio Unknown Worlds sought a payout dependent on post-acquisition revenue. The agreement with the acquirer Krafton allowed the studio’s founders and CEO to retain operational control and ensured they could only be dismissed in strictly defined circumstances.

Several months before the payout period concluded, Krafton terminated the founders and CEO claiming that their plans to release a new game would damage the company. Discovery later revealed a different version of the story: the Krafton CEO received projections that the game’s launch would likely trigger the payout. His next step was to consult AI for advice on how to avoid that outcome. The chatbot responded with a strategy, and the CEO took steps aligning with these recommendations, which led to terminating the founders.

Not only were the chat logs deemed discoverable, but the court relied on them extensively to find that the CEO’s reasons for the terminations were pretextual. AI logs are subject to scrutiny in litigation, and courts will not necessarily dismiss them as informal brainstorming. These records can become key evidence.

AI Records Litigation in Existing Legal Frameworks

This case is part of a growing wave testing how AI records fit into established evidentiary rules. Two doctrines are getting the most attention:

Attorney-Client Privilege: Generally Inapplicable

Multiple courts have held that AI tools are not attorneys, and AI conversations are not confidential. The privilege will not apply to conversations even if users seek legal advice from AI tools.

Work Product Doctrine: Murkier Waters

There is less consistency for the Work Product Doctrine:

• Delaware: AI records generated in the ordinary course of business were not protected regardless of forthcoming legislation.
• Michigan: Defendants attempted to compel a self-represented plaintiff to produce AI records related to the suit. The judge held that the doctrine applied, since the records were generated in anticipation of litigation and AI platforms are tools, not third parties, so using them is not a disclosure to outside persons.
• New York: Doctrine did not apply because the defendant’s use of a publicly available AI tool with privacy policies disclosing that prompts can be used to train models and shared with third parties negated any reasonable expectation of privacy.

As a final complication, the normally good hygiene practice of deleting records routinely can become evidence of inappropriate destruction of records in the face of litigation.

Next Steps for Businesses

As demand for AI records management increases, organizations should get ahead of the issue:

• Map current usage: Understand how employees are using AI – what types of inputs and outputs are being generated and managing the distinction between records and non-records
• Training: Educate employees on what AI captures and how to best leverage technology in areas such as auto-deletion to avoid manual processes
• Anticipate uncertainty: Prepare for unpredictable responses to AI records as the law catches up with technology
• Map records to retention schedules: Address AI records proactively rather than after litigation forces the question and base mapping on business processes
• Litigation holds: Understand the procedures for overriding in place retention and auto-delete policies when litigation is anticipated

 As Fortis makes clear, the question isn’t whether AI records will appear in litigation, but whether companies will be prepared when they do so.

AI Records Litigation FAQ

Are AI chat logs admissible in court?

Yes. As seen in Fortis Advisors LLC v. Krafton, Inc., courts treat retained AI chat logs, prompts, and system outputs as discoverable business records that can be used as primary evidence.

Does Attorney-Client Privilege cover AI legal tools?

No. Multiple court rulings indicate that AI platforms are not legal counsel, and sharing data with them lacks the required confidentiality to establish privilege.

Disclaimer: The purpose of this post is to provide general education on records management and information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post From Chatbot to Courtroom: AI Records in Litigation appeared first on Zasio.

But as AI usage increases, so does the challenge of keeping those living records accountable. For RIM professionals, interacting with AI records raises a new question: how do we know what changed, when, and why?

Key Records Management AI Data Traceability Takeaways

• Generative AI turns static data into dynamic outputs (chats, prompts, auto-generated metadata) that traditional record retention schedules (RRS) cannot adequately track.
• Effective compliance requires understanding data provenance (the total chain of custody and context) rather than simple point-to-point data lineage.
• Build data traceability by categorizing records based on the underlying business processes and data sources, not by the specific AI tools used.

Records are dynamic assets of your organization, impacted by employees, upper management, and now AI tools. These tools are supposed to increase efficiency, but often cause confusion when trying to track, manage, and audit records, especially ones impacted by AI. Data traceability offers a way to manage that chaos.

Why Traceability Matters Now More Than Ever

AI records can include the following:

• User-generated chats and prompts
• AI-edited documents, both drafted and finalized versions
• Internal policies and procedures governing AI-usage
• AI-generated images and infographics
• AI summaries from different meetings, including transcripts and notes

The word ‘Provenance’ is significant here. Provenance is the historical record that catalogs the origins, ownership, contexts and metadata of a record across its lifecycle. We often hear about lineage, what happens when data moves from point A to point B. Provenance is just as important, as it acts as the custody chain as data changes shape, ownership, and contexts in your organization.

AI records are unique in how they are often accompanied by multiple sources of data: metadata, source data, text data. Often AI records are built off other internal records, since generative models produce new content by drawing on the data they are trained on and the material they are given. Traditional record retention schedules are ill-equipped to manage these types of records. Compounding the problem, many AI records, such as chats, prompts, and auto-generated transcripts, are created outside official systems, leaving them ungoverned and easy to overlook. Long gone are the days where you can store physical records in file folders and destroy them at the end of a retention period.

AI-generated records ask us:

• What version is the record of truth?
• How do we prove it?

Ways Data Traceability can be integrated into your RRS

Data traceability also concerns handling requirements, or how records are stored and changed in their lifecycle.

Handling requirements ask:

• • Are signatures required?
  • What format should records be kept in?
  • Where should records be stored?
  • Are there language requirements?
  • Is anonymization required when handling personal data?

Handling requirements provide the audit trail that good data traceability relies on. But how do we implement these handling requirements when managing AI records? There are a few strategies to build data traceability into your records retention schedule (RRS).

Back to Basics

We have touched on how provenance plays a part in data traceability and that generative AI records are built off multiple chains of data. Good traceability then is about looking at the provenance behind what is generating records, which can include information like the system of origin, context, and the multiple types of metadata that exist (structural, administrative, and descriptive). Categorizing AI generated records based on what data is being used to create helps streamline the ability to audit and ensure compliance. Following the chain begins the audit trail that is the first step to good data traceability.

Categorizing by Process, Not by Tool

AI models are updated frequently, and with each update comes a new set of tools and features. It can be tempting to include every new upgrade into your RRS, but it’s important to keep from creating a new record type or category with each new feature. Stability and consistency should be the driving features of your RRS.

AI Data Traceability in Action

By implementing a process-driven mindset, data traceability becomes a streamlined methodology that isn’t distracted by the bells and whistles AI offers.

It can look like different record series created to distinguish AI-edited drafts from the final versions that are used. Or perhaps a record series is created to retain the metadata used when generating AI records, preserving a visible audit trail. Another example can include storing user-generated chats with AI in a specific digital folder or database or perhaps requiring a signature in a log whenever an AI record is changed.

AI records should be captured in their totality when their output and purpose serve a clear role in your organization. It would be excessive to capture every piece of metadata or the whole custody chain when working with non-records, so it’s important to be discerning when looking at what generative AI records need to be tracked or audited for compliance.

Together, these practices answer the two questions we started with: the version of record is the one the audit trail can identify, and the trail itself is how you prove it.

Data traceability also has roots in the decision-making processes of employees handling or creating AI records. If the individual components of traceability, which include version histories and change logs, are not integrated in the day-to-day record management of your organization, then all you have are fragmented routines. Good data traceability starts with people, not with the records.

It’s important to note that handling requirements are also built into the law and regulations governing recordkeeping. For this reason, it is essential to collaborate with counsel to ensure compliance.

AI-Overwhelm (and Inner Peace)

With AI-usage ever increasing, it can be easy to feel overwhelmed. On top of the different models available, there are so many ways to use AI, and with limitless options, it can be easy to get lost in the details.

Data traceability is one of the cornerstones of a defensible RRS in the digital age. It’s not about designing a system that is too complicated to implement, but about creating a methodology designed to modernize and simplify. What’s more modern than AI? Your organization should have the RRS to match. By categorizing AI records based on what data is used to generate them and then mapping each type to an existing retention category, you can begin building good traceability from the ground up.

Disclaimer: The purpose of this post is to provide general education on information governance software. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Data Traceability in the Age of AI appeared first on Zasio.

Key RIM Program Takeaways:

• A legal records retention schedule is the anchor of every successful RIM program.
• Clearly defined ownership and cross-functional buy-in are required to move from policy to action.
• Technology should support established, documented workflows, not replace them.
• Start with small, departmental wins to build momentum for organization-wide implementation.

4 Pillars of Successfully Building a RIM Program

Whether you’re building from scratch or maturing an informal program, four pillars determine whether your RIM program holds up or falls apart: a records retention schedule, people, process, and technology. Nail these, and your organization gains a defensible, scalable foundation that protects against risk, supports compliance, and grows with your needs.

Pillar 1: Records Retention Schedule

A records retention schedule is the legal and operational blueprint that governs how long your organization keeps each record type, when to destroy it, and how to meet regulatory obligations without holding records longer than necessary. The records retention schedule (RRS) anchors your entire RIM program. It defines what records your organization creates, how long to keep them, and when to dispose of them. Without it, retention decisions vary from person to person, driving inconsistency and increasing compliance risk organization-wide.

Strong retention scheduling software starts with five key components: function, record series title, description, examples, and a global baseline retention period. Legal citations map to each record series, grounding retention periods in specific requirements. When jurisdictional differences arise, you can create country exceptions tied to those citations.

Watch for these common gaps when building or evaluating your RRS:

• Retention periods lack ties to legal or regulatory requirements, leaving your organization exposed.
• The RRS exists on paper but no one has communicated, trained on, or adopted it across the organization.
• Years have passed without a formal review or update, causing the schedule to fall out of step with current laws and business operations.

Pillar 2: People

People are the engine of any RIM program: the designated owners, cross-functional stakeholders, and trained employees whose daily habits determine whether your policies are ever truly followed. Without a clear owner, a RIM program doesn’t stall, it quietly fails. Assign a designated owner, whether that sits under Legal, Compliance, IT, or a dedicated RIM function, and make that accountability visible across the organization.

From there, build a cross-functional team. RIM touches every department, and stakeholders across the business hold critical knowledge about how teams create, use, and store records. Engage them early. Their input shapes a more accurate and practical program, and their involvement builds the buy-in needed to sustain it.

Training is not an afterthought; it is how accountability becomes action. Without it, even a well-designed program breaks down in execution. Develop a deliberate training strategy that reaches every level of the organization, and tailor materials to your audience: end users need different guidance than records coordinators or senior leadership.

Pillar 3: Process

Process refers to the standardized workflows and documented procedures that govern how your organization creates, classifies, stores, retains, and disposes of records. Without consistent, repeatable steps, even the best policies collapse under human variability. Inconsistent practices across departments create compliance gaps and retrieval challenges. Standardized workflows for classification, retention, and disposition reduce reliance on individual knowledge and eliminate the guesswork that leads to costly errors.

Start by mapping how records flow through your organization, from creation to disposition. Identify where records originate, where they live, and how they move between systems and teams. Use that map to shape workflows that fit how your organization truly operates.

Document everything. Standard operating procedures (SOPs) ensure your processes are repeatable and don’t depend on a single person’s institutional knowledge. Define who does what, when, and how for each key RIM activity.

Pillar 4: Technology

Technology encompasses the systems and tools, from document management platforms to AI-assisted classification, that enable your RIM program to operate at scale. The right tools make the difference between a program that works in theory and one that works in practice. Technology supports a RIM program; it doesn’t build one. Before evaluating tools, establish your policy, people, and process foundations. Organizations that implement a system before laying that groundwork often face poor adoption and wasted investment.

Modern tools, including AI-assisted classification, can accelerate and support this work. AI can help surface patterns, suggest classifications, and flag inconsistencies at a scale that manual review cannot match. But AI works best when you have already defined your underlying processes. It reinforces good process; it does not replace it.

Consider scalability. The tools you choose today should grow with your program, not constrain it. Also, pay close attention to integration. Siloed technology creates new records management challenges rather than solving existing ones. Assess how any new tool connects with your current business systems before committing.

From Pillars to Practice: Putting It All in Motion

The four pillars reinforce each other. A well-crafted RRS means little without people trained to follow it. Clear processes lose their value without technology to support them at scale. And technology investments fall flat without the policy and process foundation to guide them.

Building a RIM program is only half the work. Sustaining it requires ongoing governance. Schedule periodic program reviews to assess what works, what has shifted, and where gaps have emerged. Refresh your RRS on a regular cycle, typically annually or biennially, to reflect changes in regulation, business operations, and technology. Establish a rhythm of executive reporting as well. Leadership visibility into program health keeps RIM on the organizational agenda and secures the resources it needs to remain effective.

Start small and scale deliberately. Launch in one department, refine your approach, and expand from there. Set clear milestones so you can measure progress, recognize early wins, and maintain momentum across the organization.

A RIM Program Built to Last

Building a RIM program is not a one-time project; it’s an ongoing commitment. Organizations that lay the right foundation today position themselves to navigate regulatory changes, adopt new technologies, and manage records with confidence as they grow.

The path forward doesn’t require perfection. It requires a starting point. Choose your first pillar, take that first step, and build from there. The long-term value of a well-built RIM program far outweighs the effort it takes to get one off the ground.

Disclaimer: The purpose of this post is to provide general education on information governance software. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Building a RIM Program From the Ground Up appeared first on Zasio.

Given the long and storied history of the National Archives, its centrality to American heritage, and its tradition of historic preservation, the controversy sits at the crossroads between practice and posterity for the information governance industry. Although records that touch the apex of American executive power are far removed from the daily experience of most of us, the episode nonetheless yields a variety of pertinent lessons that organizations can apply to enhance a records and information management program’s rigor, defensibility, resilience, and culture.

Key Takeaways:

• Adhering to established rules is always less costly than downstream “damage control” or litigation.
• Compliance culture starts with leadership; visible executive buy-in is a primary defense against scrutiny.
• Build RIM programs that depend on operational depth and documented processes rather than specific individuals.

Presidential Records Act Context & Controversy

Since its original enactment in 1978 and effective from 1981, the Presidential Records Act has operated to manage and maintain the working papers, correspondence, and other records of the President of the United States, preserving the details about events and decisions at the highest levels of American government for historians and future generations.

The present controversy concerning presidential records arose following the investigation into the retention of presidential documents not transferred to the National Archives in accordance with the Presidential Records Act.  Although the case was ultimately inconclusive, people continue to question whether the Act is binding.

The new DOJ memorandum takes the position that due to separation-of-powers concerns surrounding the autonomy and independence of the Executive branch, the Act is not binding on presidential records.

Although the final outcome will take some time to crystallize, several immediate principles and lessons can be drawn from the episode for records management professionals.

A Robust program is the foundation of compliance. Even an imperfect program that makes a substantial good-faith effort appreciably reduces risk compared to one that visibly disregards recordkeeping standards and obligations. Meticulous documentation of decisions, policies, procedures, and actions demonstrate that effort. Reports of unsecured or improvised storage of sensitive records (for example, keeping classified materials in unsecured common areas) illustrate how visible departures from accepted handling practices can materially increase the chances of scrutiny.

Err on the side of caution and over-compliance. It should never be necessary to rely on a favorable legal interpretation to withstand scrutiny. Classification, sensitivity, and retention categories should be taken seriously at the point of record creation rather than at the moment an investigation becomes a concern.

Culture and tone at the top set the standard. Leaders’ words and actions signal to both internal stakeholders and external parties about the seriousness with which recordkeeping is regarded. Engagement by high-level executives can foster a culture of compliance that propagates across the organization.

Building a Defensible Records Program

Build programs that outlast leadership. Although leaders are important, no leader stays in a role indefinitely. A defensible records management program should be constructed to withstand changes in leadership so that the transitions proceed seamlessly. The greater the operational depth of the program, the more resilient it will be to change.

How you respond matters most. If regulators investigate recordkeeping practices, the response can matter more than the underlying issue. A posture of cooperation and transparency can lead to formal and informal relief from potential consequences of deficiencies.

Proactivity is preferable to damage control. Diligent compliance with established recordkeeping rules and regulations greatly diminishes the risk of audit or investigation and can significantly mitigate the consequences when they do occur. Regardless of how the current legal questions are ultimately resolved, the time spent responding to investigative inquiries, managing the operational disruption of the search, preparing a defense, and subsequently litigating could have been avoided had the procedures been meticulously adhered to in the first instance. The effort required to proactively adhere to laws and regulations is often far smaller than the downstream consequences of non-compliance, which can include fines, administrative sanctions, civil penalties, and in some cases criminal liability.

Presidential Records Act Suit Conclusion

Ultimately, the Presidential Records Act controversy shows how consistent, visible compliance with recordkeeping rules reduces the likelihood of scrutiny and softens its impact when it does occur. The costs of inadequate compliance far outweigh the effort required to do it right. Careful records management is not merely a good business practice, it is a protection against avoidable risk. By proactively working towards compliance, records management professionals can spend their time focused on business operations rather than in a courtroom.

Disclaimer: The purpose of this post is to provide general education on information governance software. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Lawsuit Challenges DOJ Presidential Records Act Memo: Perspectives and Practical Recordkeeping Lessons appeared first on Zasio.

What should have been a straightforward configuration quickly turned into weeks of workshops debating interpretation, translating subjective language into system logic, and discovering that many “standard” retention periods could not be automated at all. The schedule was not wrong. It simply was never written for a machine.

Building a system‑ready records retention schedule means shifting how we think about retention periods. In a digital environment, retention is no longer something people “apply” at the end of a record’s life. It is something systems execute continuously, at scale, and without stopping to ask questions. The challenge is not rewriting retention requirements, but expressing them in a way machines can reliably understand and enforce.

It is a common misconception that making a retention schedule system‑ready requires starting over or completely rewriting retention requirements. Rather, the retention schedule remains a policy document, with retention periods intentionally reflecting business lifecycles and legal recordkeeping obligations. System retention rules, by contrast, exist to support automation and system execution. Aligning retention periods with retention rules does not require a full redesign. In most cases, it requires thoughtful planning and targeted adjustments so retention periods translate more easily, reliably, and consistently into system logic.

The following are some top considerations to get you well-positioned when planning your retention schedule ahead for system retention rules later on:

Simplified Big Bucket Retention Schedule – For Systems, Less is More

The big bucket retention schedule shifts from detailed, departmental categories to broader, process-based groups with a single retention period. This streamlined approach is popular for a variety of reasons stemming from its simplicity. One reason is because it makes configuring systems easier: fewer categories mean fewer rules to manage, and organizing by processes aligns well with record lifecycles and system retention defaults. See more details on how process-driven retention in changing records management.

Retention Lives or Dies on the Event Trigger

When it comes down to it, executing the event trigger is more planning than the retention period. For a retention period of “Employee Separation + 10 Years” the difficulty lies in calculating the employee separation date portion of the retention period rather than the 10 years because the separation date is variable. Tying that event trigger calculation in the system to the correct date and correct employee are crucial for execution.

In a previous blog, I discussed best approaches for simplifying event triggers in your records retention schedule. Here is where those strategies for simplifying event triggers come in really handy.

If a Human Has to Interpret It, a System Cannot Execute It

If your retention schedule depends on someone stopping to interpret what a rule means, it’s going to break down. The goal is to create rules that are clear, objective, and easy for systems to execute without second-guessing. The best retention rules don’t require that element of human judgement or interpretation. For example, a retention period of Contract Expiration + 7 Years can be entered by entering the calculated expiration date of the set expiration date. Compare this to an event trigger of “No longer Useful + 3 Years” which requires subjective judgement in order to trigger the retention period.

Automated Record Management: Policy vs. System Logic

Meet Systems Where They Are – Or Somewhere in the Middle

When designing your retention schedule retention periods evaluate each to see if they can easily align to an event already available within your system(s). This will likely steer you away from those event triggers that are subjective in nature requiring human decision-making. For instance, common retention event triggers “Until Superseded” or “Active” likely won’t align with available system events, which might make you consider whether an alternate retention period should be considered for system readiness. You might find something that align similarly – for example your “Final Resolution” date aligns just fine with the system event  “Case Closure Date”. The closer the retention event aligns with available system events, the easier it when the time comes to implement in your system.

Separate Legal Requirements from Reality & Simplify

Legal retention rules are often written to demonstrate compliance, not to be executed by systems. As a result, they can introduce complexity when the complex legal language are carried over directly into your schedule’s retention periods.

Take I-9 records which are subject to a complex legal recordkeeping requirement detailed at 8 C.F.R. § 274a.2: they must be retained for three years after hire or one year after termination, whichever is later.

Why this hybrid retention is difficult to implement in systems:

“Whichever is later” requires:

• Tracking two dates
• Comparing them
• Waiting until termination to know the outcome

This makes the rule difficult to apply consistently and easy to get wrong.

Instead, consider simplifying this further to a singular retention period of termination + 3 years, which meets the minimum legal recordkeeping requirement and is much easier for a system to understand and apply. There is the possibility the simplified retention would result in the I-9’s being retained longer than legally required. Simplifying retention periods in this manner requires a risk assessment balancing potential over-retention against easier administration and likely improved compliance.

Writing a Retention Schedule with Translation in Mind

Designing a system‑ready retention schedule does not mean turning policy into code or rewriting retention requirements from scratch. It means expressing retention periods with greater clarity, consistency, and awareness of how they will eventually be executed by systems. By simplifying structure, prioritizing explicit and system‑available event triggers, and separating legal intent from execution reality, organizations can significantly improve success of retention automation. The most effective retention schedules are not the most complex. They are the ones written with translation in mind, bridging governance and technology without compromising compliance.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Seamlessly Automated Record Management: Smart Strategies for System-Ready Retention Schedules appeared first on Zasio.

But this one lingered.

Legal started pulling threads. And the deeper they dug, the worse it got. Emails missing. Documents had gone cold. Files vanished without a trace, and no one could say when, why, or who pulled the trigger.

What should have been routine turned into something else entirely: a credibility problem with teeth.

Defensible Disposition Key Takeaways:

• Defensibility is proven through consistent execution and documentation, not just a written policy.
• Addressing redundant, obsolete, and trivial (ROT) data is critical to reducing discovery costs and legal risk.
• Effective retention schedules require specific, trackable trigger events to ensure records aren’t kept indefinitely.
• Regular internal audits and documented destruction certificates are the primary evidence used to defend disposition actions.

Most organizations have a retention policy. On paper, at least. But when you look closer, the story changes. Fewer have developed a comprehensive defensible disposition framework, and that gap is where the trouble starts. Deleting records without a consistent process, proper authorization, and clear documentation might feel like routine cleanup, but it can look very different under the harsh light of legal scrutiny. Defensible disposition is the framework that ensures your organization lawfully and consistently destroys eligible records and non-records with a paper trail that holds up when the questions come.

What is Defensible Disposition?

Defensible disposition isn’t a single event. It’s a framework. One that either holds together under pressure… or doesn’t. It is the output of interlocking processes that must work together including a legally sound retention schedule, policies that cover everything you create (not just official records), consistent implementation across your systems and paper, regular auditing to catch drift, a solid litigation hold process, and a plan for when something goes wrong.

6 Step Defensible Disposition Framework

Step 1: Build a Retention Schedule You Can Actually Implement

Every disposition decision traces back to your retention schedule. If it’s incomplete, outdated, or impractical to apply, everything built on top of it becomes shaky.

First, it needs to reflect your organization, not a one-size-fits-all approach. Templates won’t capture the specifics of how you operate. If you manufacture regulated products, manage assets, or operate in a specialized or licensed environment, your schedule should reflect that. Just as important, it has to be written in a way your employees can navigate quickly. If people can’t find what they’re looking for, they won’t use it, and unclassified records quickly become unmanaged ones.

Second, it must account for the jurisdictions you operate in. Retention requirements vary widely, and organizations often underestimate how those differences stack up. In many cases, you’ll need to apply the most stringent requirement across jurisdictions or explicitly define exceptions. And this isn’t a “set it and forget it” exercise, laws and guidance change. A schedule that was accurate a year ago may already be outdated. Build regular review into your governance process and rely on current legal research, not static references.

Finally, every retention rule needs to be workable. That means clearly defining both the retention period and the trigger event that starts the clock. “Seven years for contracts” isn’t enough. Seven years from when? Execution? Expiration? Last activity? If the trigger isn’t clear, people fill in the gaps. And they don’t all fill them in the same way. And if the trigger can’t be tracked reliably, records tend to be kept indefinitely. A good test is simple: can your systems consistently identify the trigger date without requiring judgment calls?

Step 2: Beyond Records: Controlling ROT and Non-Record Content

Not everything your organization creates qualifies as a record. But that doesn’t mean it’s harmless. Left unmanaged, non-record content becomes its own kind of risk. Your Records and Information Management policy or your Retention Schedule needs to address this explicitly.

A major category here is ROT: redundant, obsolete, and trivial content. Think of duplicate files, outdated drafts, and low-value communications. Left unchecked, ROT increases discovery costs, slows systems, and makes it harder to find what matters. For many organizations, the biggest contributor is everyday communication. Emails, chats, and messages that serve a short-term purpose and then linger indefinitely. Your policy should define transitory, redundant, obsolete, and trivial content, explain when it is not treated as a record, and specify how routine deletion is authorized and carried out.

Not all information exists as documents, either. Data in systems like CRMs, ERPs, and databases don’t fit neatly into traditional retention categories. This is where process-driven retention comes into play. Instead of focusing on document types, you look at the business process behind the data and determine retention based on that. Your policy should map key systems to the processes they support, assign ownership, and define how disposition decisions are made and documented. If you don’t address this, large portions of your data environment remain effectively unmanaged.

Step 3: From Policy to Practice: Driving Adoption

A policy doesn’t matter if no one follows it. Defensibility isn’t about what’s written down. It’s about what actually happens day to day. That means embedding it in the systems where records live and supporting it with a repeatable process.

Start with individual-access systems like email, OneDrive, and local machines. These are often the least controlled environments, and they’re where both over-retention and accidental loss happen most frequently. You need clarity. What’s automated. What’s the user’s responsibility. And how you verify both. Because telling people what to do isn’t the same as making sure they do it.

Structured environments like SharePoint, document management systems, shared drives should be easier to control. In theory. In practice, they often aren’t. Sites multiply, structures drift, and retention controls aren’t applied consistently. Effective implementation means applying classification and retention rules at the point of creation or ingestion, not trying to clean things up later at scale. Periodic reviews help confirm that content is landing where it should and that outdated material is being removed as expected. And don’t forget paper records.

Paper records shouldn’t be overlooked. They carry the same legal weight as digital records, and they need to be included in your processes for storage, retrieval, and destruction. Otherwise, you’ve got a blind spot.

When records reach the end of the line, disposition follows a process. No guesswork. No shortcuts.

• Identify what’s eligible.
• Confirm the details.
• Get the right approval.
• Carry out destruction.
• Document everything.

That documentation, often in the form of a destruction certificate, is critical evidence that the process was followed properly.

Effective records management isn’t just about compliance, it directly benefits users when they understand its value. With strong training and ongoing communication, organizations can move beyond “check-the-box” habits and show how good practices save time, reduce risk, and make information easier to find. When users see how records management supports their daily work, they’re more likely to adopt it. The goal is to make it not just a requirement, but a clear advantage.

Step 4: Audit Before Someone Else Starts Asking Questions

A program that looks good on paper isn’t enough. You need to know it’s actually working. Regular audits are what turn policy into something defensible.

Formal audits should review how the retention schedule is being applied, whether records are stored appropriately, whether disposition workflows are followed, and whether documentation is consistently maintained. Findings should be tracked and resolved, and the audit trail itself becomes part of your compliance record.

Between formal audits, targeted spot checks can be just as valuable. Instead of trying to review everything, focus on specific systems, teams, or record types. For example, you might verify that retention labels in Microsoft 365 haven’t been altered, or that a newly onboarded group is correctly classifying records. These smaller checks help catch issues early, often before they become larger problems.

It also makes sense to trigger reviews based on events, not just schedules. System migrations, acquisitions, or major staffing changes are all points where governance can slip.

Step 5: Don’t Forget Litigation Holds

When litigation is reasonably anticipated, the clock starts ticking, whether anything’s been filed or not. At that point, routine deletion isn’t routine anymore. It stops. Routine disposition must be suspended for information within the hold’s scope until the hold is released.

Hold notices need to:

• Go out quickly;
• Be clear enough to act on;
• Be tracked so you know they were received and understood.

For ongoing matters, periodic reminders are standard.

Scope is a common weakness. A proper hold covers not just official records, but drafts, communications, and anything else that could be relevant. It also needs to be implemented at the system level. Automated deletions and lifecycle policies won’t stop on their own. They have to be explicitly suspended.

When the matter ends, the hold should be formally lifted and normal processes restored, with that transition documented just as carefully as the hold itself.

Step 6: When Things Go Wrong (Because Sometimes They Do)

Even well-designed programs run into issues. Missed holds, premature deletions, or system errors. What matters is how those situations are handled.

• The first step is to stop any related destruction and secure what remains.
• Then bring in the right stakeholders, often including legal, before taking action. Trying to fix things too quickly without proper guidance can make the situation worse.
• From there, conduct a documented investigation to understand what happened, when, and why.
• Determining whether the issue was inadvertent or intentional is critical, as that distinction carries different consequences. In some cases, the question of whether to self-report will arise. That decision typically sits with legal counsel, but in general, organizations that identify and address issues proactively tend to be viewed more favorably than those where problems emerge later through external discovery.
• Once resolved, address the root cause and document the fix.

That record becomes part of your overall compliance story.

Defensible Disposition Framework: Bringing It All Together

At its core, defensible disposition is about accountability. Knowing what you kept. What you destroyed. When it happened. And why. Because sooner or later, someone’s going to ask. And when they do, it won’t be about policy. It’ll be about proof. Being able to explain what you kept, what you destroyed, when it happened, and why. That doesn’t come from a single policy or tool, it comes from consistent execution over time.

The challenge isn’t just building the defensible disposition framework. It’s maintaining it through system changes, staff turnover, and competing priorities. And that’s exactly the point. You’re both building this for routine operations and for the moment when someone comes knocking, asking you to explain a record that no longer exists. When that happens, your documentation, your processes, and your consistency are what determine whether it’s a routine matter or something much more serious.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post What It Takes to Make Record Deletion Truly Defensible appeared first on Zasio.

In organizations today, paper records can be as absent as Dictaphones and fax machines. In their place lie complex digital ecosystems, constantly churning and being updated. These ecosystems often cross continents. Within this transformed landscape, records and information management professionals must also adapt. Retention schedules built around documents, even digital ones, are no longer enough to keep organizations compliant with retention and disposition laws. If a digital system can generate a regulated record on demand—or even if it merely contains regulated data—then the system itself must be part of the retention equation. In other words, retention decisions that ignore digital systems create false confidence in your RIM compliance.

The job of RIM professionals now requires data management.

Key Takeaways:

• Traditional RIM focused on static objects; modern RIM focuses on dynamic digital ecosystems.
• Process-driven retention manages the systems and data flows that generate records, not just the records themselves.
• Keeping underlying transactional data while deleting a record creates a “false confidence” in compliance.
• Success requires RIM professionals to master data mapping, system architecture, and cross-departmental collaboration.

The Future of Retention is Process-Driven

It’s helpful to think of computing systems as factories and records as the products being manufactured. It doesn’t matter if you’ve disposed of the end product when the raw material is still on the factory floor and can be used to create another same or a similar record. Under a process-driven retention approach, RIM professionals must focus on how data flows through systems and business processes, recognizing that records are often generated, regenerated, or reconstructed from underlying data long after a record is deleted. Process-driven retention shifts from managing documents to managing the processes and systems that process regulated content.

If an organization determines it must delete a financial report or a customer statement, but it keeps the underlying transactional database, the risk driving the disposition decision has merely been taped over.  In other words, you cannot claim compliance at the record level if the underlying data ecosystem still exists to recreate, substantially reconstruct, or functionally reissue the record.

Process-driven retention builds around the fact that data doesn’t stay in a static state. It’s instead constantly changing. Process-driven retention also appreciates that datasets are often dependent on other datasets to be meaningful. Accordingly, the process-driven RIM professional must recognize that retention outcomes must be determined by system behavior, not just by deleting isolated datapoints. A modern RIM program must be as much about how data systems behave as it is about how long records are kept.

Process-Driven Retention Requires RIM Professionals to be Curious

To adopt a process-driven retention mindset, RIM professionals must elevate their understanding of computing systems and technologies. They must learn new skills and domains. These include data mapping, IT system architecture, and data lifecycles. RIM professionals must begin thinking in terms of the retention implications of computing system event logs, audit trails, system metadata, data pipelines, and even “machine memory” in AI systems.

Process-driven retention also requires creating closer partnerships with privacy, IT, product and engineering teams, and cybersecurity professionals. In a process-driven retention world, these are the RIM professionals’ new cross-collaborators. RIM professionals must be the glue that binds these diverse fields to help their organizations achieve retention and disposition compliance.

New Questions for a New Era of Retention Management

The distinction between “Data,” “information,” and “record” was long an object of worship in the RIM field. Unless the object was a record, RIM professionals need not have been concerned. Such thinking is outmoded. In the process-driven retention age, RIM professionals must think fluidly, thinking through the retention implications of data in all of its forms.

RIM professionals must also shift their focus from classification to system comprehension. Instead of merely asking, “Is this a record?” the RIM professional’s most important question must now be “Show me how this works?”

Additional Resources

To learn more about Zasio’s approach to records retention management, check out our February 2026 Virtual Coffee Webinar with Jennifer Chadband, Warren Bean, and Rick Surber, as well as this written compendium.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post How Process-Driven Retention is Changing Records and Information Management appeared first on Zasio.

In litigation, records are not background material. They are evidence. And evidence carries consequences.

When a lawsuit begins, one of the first formal steps is discovery. Discovery requires organizations to produce relevant emails, messages, drafts, reports, and metadata. Opposing counsel does not begin by reading your retention policy. They begin by examining what exists, what is missing, and whether the organization followed its own rules.

As a former trial attorney, I learned quickly that documentation practices often determine outcomes more than dramatic testimony does. An offhand message, a missing file, or irregular deletion can shape credibility long before opening statements begin.

That experience clarified something essential. The purpose of a records and information management solution is not administrative efficiency. It is defensibility. The issue is rarely whether an organization had a policy. The issue is whether it followed that policy when it mattered.

Key Takeaways:

• Shift to Records Management Defensibility: In litigation, your records are evidence, not just administrative files. A judge evaluates your systems based on whether you followed a consistent, repeatable process.
• The Liability of “Keep Everything”: Over-retention expands your discovery footprint, increases legal costs, and creates unnecessary risks during a data breach.
• Consistency is Your Best Defense: Courts don’t penalize organizations for following a reasonable, pre-established retention schedule. They do scrutinize selective or irregular cleanup performed under the shadow of litigation.

How Discovery Tests Your Records Management System

Discovery does more than gather documents. It tests systems. Regulators and opposing counsel approach it with three key questions:

1. Did the organization preserve relevant information once it reasonably anticipated litigation?
2. Did it follow routine practices before that point?
3. Do any gaps suggest unmanaged systems or selective deletion?

In practice, those questions appear in everyday situations:

• A leadership team discusses a major decision in a messaging app, but no one preserves those conversations when a dispute arises.
• An employee deletes text messages, unaware that the issue has already escalated.
• Multiple versions of a contract circulate by email, but no one can identify the final draft.
• A company thinks it has a written policy, yet no one can locate a record of its approval.

None of these situations seem extraordinary until someone asks about them under oath.

How does a judge view missing business records?

Judges do not expect perfection. They expect reasonableness and good faith. Organizations demonstrate that standard through repeatable processes, not polished policy language. When execution lacks consistency, even innocent gaps raise questions. Those questions increase cost, scrutiny, and risk.

Why “Keep Everything” is a Liability

Many organizations assume that keeping all information indefinitely reduces exposure. Leaders believe it is safer to keep everything than to risk deleting something that might later be requested.

In practice, unlimited retention expands risk.

What is the risk of keeping records too long?

When organizations keep more data, they broaden discovery. Broader discovery increases review time, legal costs, and the chance that someone isolates statements from their original context. Redundant drafts and informal communications multiply the material teams must review and explain.

Over-retention also creates operational drag. When everything is saved, nothing is prioritized:

• Employees spend more time searching for the right version of a document.
• Critical information gets buried in outdated files.
• Systems slow.

Storage may be inexpensive. The consequences of excess are not.

The risks extend beyond litigation. The more information an organization keeps, the more it must secure. Sensitive contracts, employee records, personal data, and confidential communications can remain accessible long after they serve a purpose. If a breach occurs, exposure expands with the volume stored.

Defensible deletion strengthens position. Disciplined governance does not destroy evidence—it enforces policy. Courts do not penalize organizations for following a reasonable retention schedule. They do scrutinize selective or irregular cleanup.

The distinction matters. Every retained document can become a witness.

Common Pitfalls in Corporate Information Governance

Risk rarely comes from dramatic misconduct. It grows from small, ordinary gaps that no one thought would matter.

Many organizations manage records responsibly. At the same time, new technologies and decentralized communication add complexity.

Teams make business decisions in messaging and collaboration tools, but those conversations are not always preserved in a searchable way. Managers send texts or use personal devices for convenience. Employees forward work to personal email accounts. Business records are created outside official systems.

Disposition presents another challenge. Organizations often keep records that should be deleted because someone believes they might prove useful someday. Old drafts and unnecessary files build up. Over time, temporary exceptions become permanent practice.

AI adds another layer of complexity. AI tools generate drafts and analyses quickly, and the records questions are not yet settled. Consider a scenario where a team uses an AI tool to draft a legal summary, then revises it through several iterations—if a dispute arises, the organization may struggle to explain which version governed a decision, who reviewed it, and where the prompts and outputs are stored. Governance continues to evolve, but disputes already involve AI-assisted content.

These patterns often go unnoticed until litigation begins. At that point, organizations must explain why certain information was kept indefinitely while other records cannot be located. They must show when preservation began and demonstrate that deletion followed established timelines rather than reacting to scrutiny.

Uncertainty weakens position. Consistency strengthens it.

Litigation-Ready Governance in Practice

Preparing for litigation does not mean assuming it will happen. It means building systems that hold up if it does.

Organizations strengthen defensibility when they tie retention periods to clear drivers such as legal requirements, contractual obligations, or operational need. If asked why a category is kept for a specific period, leaders should have a clear answer. Not a guess.

They must also define preservation triggers clearly. When a dispute arises, employees need to understand what changes and what they must preserve. Consistent disposition remains essential. A defensible program includes regular deletion that follows established timelines. Irregular cleanup creates far more exposure than disciplined retention.

Organizations must govern high-impact communication channels intentionally. If leaders make critical decisions in chat or collaboration tools, the organization must apply the same rigor it applies to email and shared drives. Executives should understand how isolated messages may be interpreted years later, outside their original context.

These measures are not abstract ideals. They are safeguards that influence litigation outcomes.

Credibility Is the Real Asset

In litigation, credibility carries weight.

An organization that can demonstrate a clear retention rationale, consistent execution, and a functioning preservation process begins from a position of strength. An organization that cannot explain its practices begins at a disadvantage. Records governance is not administrative overhead. It is litigation posture.

Where Experience Matters

Designing a litigation-ready records program requires understanding how others examine policies under pressure. It requires anticipating the questions they will ask and the inconsistencies they may challenge.

At Zasio, we help organizations evaluate retention frameworks, assess preparedness, and align policy with operational reality. We focus not only on compliance but on defensibility.

Once litigation begins, records no longer function solely as internal tools. They become evidence that speaks for the organization. The only question is whether your organization’s records management software can withstand scrutiny when ordinary emails are elevated to courtroom exhibits.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post What a Trial Lawyer Knows About Defensible Records Management appeared first on Zasio.

As organizations grapple with exploding data volumes, evolving privacy laws, and increasingly complex systems, one thing is clear. Old methods can’t keep up. Process‑driven retention offers a path forward.

What is Process-Driven Retention?

Process-driven retention is a strategic information governance framework that determines data lifecycles based on business processes and data dependencies rather than static, document-centric records.

Why Traditional Retention No Longer Works

For decades, retention programs were built around one deceptively simple question: Can I destroy this record? It was a world of self‑contained documents, straightforward classifications, and predictable lifecycles.

But that world is gone.

Modern organizations operate in an environment where:

• Data is no longer self‑contained.
• Information is generated continuously across systems.
• Records are often reconstructed, not stored as static objects.
• Retention schedules rarely cover all the data an organization touches.

This disconnect has opened a gap between what retention schedules say and what actual business processes require.

The Data Explosion Changed the Rules

Data today is not merely an output, it’s the raw material that organizations process, refine, and reuse. The line between “data,” “information,” and “record” is now fluid:

• Data: raw, unstructured bits.
• Information: data given meaning.
• Records: documented evidence of activities.

Traditional schedules were built to manage records, not the sprawling ecosystems of structured and unstructured data that now feed them. So, organizations are increasingly forced to ask: What do we keep? What counts as a record?

These questions aren’t academic. They shape compliance, risk, and efficiency.

Then Privacy Changed the Rules Again

As privacy mandates gained strength, they introduced obligations that frequently conflict with retention requirements. Among the new challenges:

• Right to be forgotten obligations
• Mandatory deletion maximums
• Conflicts with statutory retention minimums
• Data dependencies across systems
• Requirements not covered by most retention schedules

In other words: it’s no longer enough to know when you can delete something. You have to know when you must.

Enter Process‑Driven Retention

Process‑driven retention reframes the conversation around context. Rather than evaluating a piece of information as a standalone object, it looks at how that information flows, transforms, and supports business operations.

It asks not just what the data is, but:

• Who generates it
• Who processes it
• Where it is stored
• What activities rely on it
• What privacy, security, and legal obligations affect it
• What upstream and downstream dependencies bind it

This approach breaks down silos and reveals the true lifecycle of data—not just the record‑keeping lifecycle.

What Makes This Approach Different

Process‑driven retention is:

• Purpose‑driven rather than content‑driven
• Holistic and fabric-oriented, not siloed
• Metadata aware, using context as an asset
• Structured around dependencies, not isolated artifacts
• Supportive of both privacy and operational requirements

It connects the dots across teams such as legal, IT, records management, operations, privacy and creating shared visibility into the data landscape.

Real‑World Examples in Action

The webinar walked through scenarios that highlight the value of process‑driven thinking:

1. Energy Consumption Data in Utilities

Hourly energy logs feed billing, outage reports, efficiency analyses, and forecasting. They also intersect with marketing, customer success, and project management processes. Deleting logs isn’t just a retention question, it’s an operational one.

2. Time Clock Logs in HR

Clock‑in/out data drives timesheets, pay slips, benefits eligibility, PTO management, and performance reviews. The decision to delete this data has far‑reaching implications.

Implementing Process‑Driven Retention

Transitioning to this modern model requires organizational commitment. The webinar outlined key steps:

• Form a cross‑functional steering committee
• Conduct risk and dependency analyses
• Revisit policies and retention schedules
• Map systems and data flows
• Aggregate data where possible
• Align onboarding and offboarding processes across systems

It’s a foundational shift, but one with significant payoffs. Greater compliance clarity, reduced risk, and more resilient information governance overall.

Looking Ahead

As data complexity grows, retention programs must evolve to match. Process‑driven retention equips organizations to manage information with nuance, context, and foresight. It’s not simply a new technique. It’s a modern mindset for a modern data world.

If you’d like guidance on adopting a process‑driven approach, our team is here to help.

Disclaimer: The purpose of this post is to provide general education on information governance consulting. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Beyond Records: Why the Future of Retention Is Process Driven appeared first on Zasio.