Legal hold stack for AI-era data — prompts, chat, and linked files

Your legal hold system was built for a data estate that no longer exists. It notices custodians, tracks acknowledgements, and preserves mailboxes and file shares. Meanwhile the conversation that decides the case happens in a Teams thread, the document is a link rather than an attachment, and the analysis a manager relied on was produced by typing a prompt into ChatGPT and never saved anywhere.

Three of those four data classes have a deletion clock running independently of your hold. That is the problem this stack solves, and it is not solved by buying a better notice tool.

The shape: Exterro issues and defends the hold, Microsoft Purview does the in-place preservation across Microsoft 365 and the connected AI apps, ChatGPT Enterprise’s Compliance API is the only route to prompt data that lives outside Microsoft’s tenant, and Relativity is where the preserved data lands for review. Four systems, one preservation record.

How the pieces fit

• Exterro owns the notice and the defensibility artifact. Custodian identification, hold issuance, acknowledgement tracking, escalation, and release — with the audit record that answers “what did you preserve, when, and who confirmed” if the adequacy of the hold is later litigated. Exterro’s legal hold module is largely Zapproved, acquired in January 2023, so the queue entry’s “Exterro or Zapproved” is one vendor now, not two. The reason it beats a spreadsheet is the data map: 190-plus enterprise source connectors mean the notice and the preservation scope resolve against one inventory of where a custodian’s data actually sits.

• Microsoft Purview is the preservation layer, not a nice-to-have. Purview eDiscovery (Premium) places custodial holds on mailboxes and their data sources, plus noncustodial holds on mailboxes and OneDrive sites. Note the date: Microsoft retired every classic eDiscovery experience — classic Content Search, classic eDiscovery Standard and Premium — on August 31, 2025. If your preservation runbook still names those screens, it names screens that are gone.

• ChatGPT Enterprise’s Compliance API is the AI data source. It returns every user input, model output, and system-injected message, plus files, Memory, Canvas, and Automation objects, and it supports programmatic deletion for right-to-be-forgotten requests. Purview also ships a ChatGPT Enterprise connector: once the connector scan runs, eDiscovery, retention, communication compliance, and insider risk apply to those interactions. DLP and sensitivity labels do not — that is stated on the capability table, and it is a real ceiling.

• Relativity is where preserved data becomes reviewable. RelativityOne handles ingestion, processing, review, and production. Since the Relativity Fest announcement in October 2025, aiR for Review, aiR for Privilege, and aiR for Case Strategy are included in RelativityOne rather than sold as add-ons — but included is not unlimited. Consumption runs against aiR Units at one unit per document, and both the allowance and the overage rate are quote-only.

Named handoffs

1. Trigger event → scoped hold. Matter opened in Exterro → custodian list resolved against the data map → Purview holds applied to those custodians’ mailboxes, OneDrive sites, and Teams data. The hold is applied to a resolved list, not to “everyone in Sales.”
2. Hold applied → AI interactions captured. A Purview collection policy captures prompts and responses for enterprise AI apps; a retention policy scoped to the Enterprise AI apps location holds them. Without both, the hold covers the mailbox but not what the custodian asked the model.
3. Custodian outside the tenant → Compliance API pull. ChatGPT Enterprise conversations pushed as JSON into Purview, Relativity, or a data lake on a scheduled pull, so the record exists independently of OpenAI’s retention schedule.
4. Scope narrowed → collection. Purview search and review set → export → Relativity ingestion. Preservation stays in place; collection is a separate, later, narrower act.
5. Hold released → deletion resumes. Release in Exterro → Purview holds lifted → normal retention resumes on the next Managed Folder Assistant pass, which runs weekly and processes a given mailbox anywhere inside a 1-to-7-day window. Release is not instantaneous, and neither is it free of risk — an early release is a spoliation problem.

The 30-day clock nobody budgets for

Deleted ChatGPT conversations are removed from OpenAI’s systems within 30 days unless OpenAI is legally required to retain them. That sentence is the whole argument for this stack. A custodian who deletes a chat two weeks after your hold issues has destroyed responsive data, and no notice, acknowledgement, or reminder cadence stops it — the deletion happens on the vendor’s infrastructure, on the vendor’s schedule.

The guard is a scheduled Compliance API export running before the hold, not after. Treat prompt data the way you already treat voicemail: preserved by a system pull, never by a custodian’s cooperation.

Do not assume somebody else’s litigation covers you. OpenAI’s obligation to preserve consumer output logs under the New York Times preservation order ended on September 26, 2025, with the termination order entered October 9, 2025. The window closed. Data preserved only because of that order is data you do not control.

There is a second gap on the Microsoft side, and it is undocumented in most runbooks: Purview retention policies and eDiscovery holds do not apply to Copilot memory items. Memory persists until a user deletes it or an admin removes it via eDiscovery or the Graph API. Guard: write memory into the hold notice as an explicit custodian instruction, and audit it via Graph rather than assuming the hold caught it.

Hyperlinked files: what you actually owe

This is where in-house teams over-promise in the ESI protocol and then cannot perform. The case law does not say one thing.

• Nichols v. Noom (S.D.N.Y., March 2021) held that hyperlinked documents are not attachments — an attachment is a necessary part of the email, a link is not — and declined to order wholesale production of linked files.
• In re StubHub Refund Litigation (N.D. Cal.) went the other way in April 2023, ordering production of linked documents because the ESI protocol said so. Then in May 2024, after 30(b)(6) testimony on what was technically possible, the same judge relieved StubHub of that term for good cause.
• In re Uber Technologies (N.D. Cal., April 2024) ordered production of the contemporaneous version of Google Drive documents sent by link, to the extent feasible on an automated, scalable basis. A March 2025 ruling found no obligation where doing so at scale was technologically infeasible for non-Drive links.

Now put that next to the tool behavior: Purview’s cloud attachment collection adds the most current version of a linked file to the review set, which can differ from the version the custodian actually shared. An ESI protocol promising contemporaneous versions is a promise your collection tool does not keep by default.

Guard: negotiate the protocol against what you can demonstrate, and get the sites on hold early — version history is retained under hold in the preservation hold library, so an early hold is what makes a contemporaneous version recoverable at all. Late holds turn a drafting problem into a spoliation problem.

Cost reality

Purview. The Purview Suite is $12 per user per month paid yearly on top of Microsoft 365 E3 or Office 365 E3 with EMS E3. Microsoft 365 E5 is $60 per user per month and includes the same eDiscovery capability. The number that surprises buyers is who gets licensed: you license the people whose data you hold, not the four people on the legal team. At 2,000 employees that is roughly $288K/year as an E3 add-on, and $0 incremental if the company already sits on E5.

The AI connector bills separately. Managing ChatGPT Enterprise interactions in Purview requires pay-as-you-go billing enabled against an Azure subscription — Azure consumption metering, quoted through the Azure pricing surface rather than the per-seat price list. Model it before you switch the connector on.

Exterro. Nothing published, no rate card. Third-party buyer data puts the eDiscovery suite entry point near $50,000/year on a ten-user scenario, with the real invoice moving on data volume rather than seats. Buy legal hold as a separate line item from eDiscovery, privacy, and forensics.

Relativity. Custom-quoted. Third-party ranges put hosting at $15-30 per GB per month and processing at $25-75 per GB.

For a 2,000-employee company already on E5, running 10-20 concurrent holds and 500GB under active review, the incremental annual cost lands at roughly $140K-$300K/year — Exterro plus Relativity hosting, before per-matter processing and before contract-attorney review time. Add roughly $288K/year if Purview has to be bought rather than inherited.

Common variations

• Swap Relativity for Everlaw. Take it when review speed and reviewer experience are the complaint, and when metered AI is the budget objection — Everlaw made generative review free in 2026 rather than pricing it per document, which is the opposite of Relativity’s aiR Unit model. What you give up is the outside-counsel default: if your firms run on Relativity, the data ends up there anyway.

• Drop Exterro; run Purview holds alone. Take it when litigation is episodic, custodian counts stay under 50, and every byte of responsive data is inside Microsoft 365. What you lose is the custodian-facing record — notices, acknowledgements, escalation, release — which is exactly the artifact a spoliation motion attacks. Purview preserves data; it does not prove you ran a process.

• Add a forensic collection step for departing custodians. Take it when the custodian is the adverse party — a departing executive under investigation. In-place preservation assumes cooperative infrastructure; an imaged endpoint does not.

What this stack does NOT replace

• The decision about when the duty attaches. Software issues a hold; counsel decides that litigation is reasonably anticipated. See legal hold process for the trigger analysis these tools execute against.
• A retention policy. Holds are exceptions to a retention schedule. A company with no schedule has no baseline to suspend, and every matter becomes a full-tenant preservation argument.
• The ESI protocol negotiation. The StubHub and Uber lines show the protocol governs the outcome more than the technology does. Negotiate against what you can demonstrate.
• Custodian interviews. No connector tells you the custodian ran the analysis in a personal ChatGPT account on a home laptop. The custodian questionnaire is still how you find shadow data sources.
• Shadow AI governance. Preserving ChatGPT Enterprise says nothing about the 12 other AI tools employees expensed. That is an AI policy problem, upstream of preservation.
• Privilege review. Prompt-and-response pairs containing legal analysis are a new privilege surface, and no tool codes them for you. See privilege review.

Match rules

Use this stack when:

• Microsoft 365 is the tenant and enterprise AI is deployed with admin controls. Both halves matter — a ChatGPT deployment with no Enterprise workspace has no Compliance API to pull from.
• You have standing litigation or regulatory exposure, not an occasional dispute. Preservation programs justify their cost through repetition.
• Someone owns the connector configuration. A retention policy scoped to the wrong location silently preserves nothing, and no dashboard flags it.
• Your ESI protocols already contain hyperlink terms. If opposing counsel is asking for linked documents, the technical gap is already live.

Do not use this stack when:

• Litigation is rare enough that outside counsel runs preservation. Under two or three matters a year, the money buys counsel time instead.
• The AI estate is unmanaged. Buying preservation before you know which AI tools employees use produces a defensible record of the wrong data set.
• Google Workspace is the tenant. Purview is the load-bearing layer here, and Google Vault is a different architecture with different limits — the Noom facts turned on Vault behavior specifically.
• Nobody will run the release step. Holds that never lift accumulate until every custodian is under permanent preservation, review costs compound, and the program loses credibility with the business.