Can Your Employees’ AI Prompts Become Evidence?

Brazilian law already applies to these records

1. There is no need to await AI-specific legislation before prompts, outputs, and logs (records of user activity and access) may be treated as evidence. The Brazilian Code of Civil Procedure recognizes means of proof not expressly enumerated by statute and governs the use of electronic documents. As with any form of digital evidence, their evidentiary weight will depend on lawful collection, authenticity, integrity, and the context in which they were created.
2. In criminal matters, the collection and use of these records are also subject to specific rules governing the admissibility of evidence and the preservation of the chain of custody. Similarly, in investigations of various kinds, electronic records may be requested, preserved, collected, and examined by the competent authorities within the scope of their statutory powers. An interaction stored in a corporate account, on a company device, or through an internal integration should not be regarded as invisible or ephemeral merely because it occurred through an AI tool.
3. In addition to records maintained internally, the tool provider may itself hold information from which evidence can be obtained. Privacy policies and terms of use may indicate whether, and under what circumstances, interaction data may be disclosed to authorities, subject to the limitations imposed by applicable law.
4. Not every prompt – that is, the request or instruction submitted by the user – is self-explanatory or sufficient to establish wrongdoing. AI records may be incomplete, contain inaccurate responses, or reflect nothing more than the exploration of a hypothesis. Their evidentiary weight will depend on the chain of custody, attribution to a particular user, the version of the tool, the files submitted, and, above all, consistency and convergence with other evidence and information.
5. Although storage in a corporate account, device, or system may facilitate the preservation and attribution of these records, it does not, by itself, authorize unrestricted access or monitoring. The lawfulness of collection will depend, among other factors, on the policies communicated to users, the purpose and proportionality of the measure, applicable data protection, privacy, and confidentiality requirements, and, where appropriate, judicial authorization. The implementation of controls and monitoring mechanisms should be coordinated with privacy, human resources, and information security teams, particularly within corporate groups subject to multiple employment and data protection regimes.
   
   

The critical distinction: machine-generated content and user conduct

6. A recent decision by Brazil’s Superior Court of Justice (STJ), apparently the first to address generative AI as evidence, helps frame the issue. In HC No. 1,059,475/SP, the Fifth Panel ordered the exclusion of a report produced using generative AI tools, without adequate human validation, that purported to establish facts relevant to a criminal proceeding. The decision concerns the reliability of AI-generated output when offered as a substitute for technical or expert analysis.
7. A separate question is the evidentiary significance of the interaction history itself. An AI-generated answer may be unreliable as proof that a particular event occurred. A prompt drafted by the user, however, is a recorded human statement: it may indicate what information the user possessed, what questions the user sought to resolve, what hypotheses the user considered plausible, what objectives the user pursued, and what line of reasoning preceded a particular decision.
8. That evidentiary trail may extend well beyond a single question. The sequence of interactions may reveal the development of a strategy, the alternatives tested in succession, the responses rejected, the prompt revisions made to obtain a particular result, and the degree of direction exercised by the user. Documents and data uploaded or transcribed may also be relevant, as may references to specific individuals, competitors, customers, or transactions; instructions to alter tone or conceal particular information; and follow-up requests intended to convert the output into a communication, recommendation, or action plan.
9. Depending on the tool and its configuration, the interaction may also be associated with metadata such as the user’s identity, the account used, date and time, the device or corporate environment through which access occurred, files uploaded, outputs generated, and edit history. These elements will not necessarily be available in every case, and their significance will depend on the integrity, authenticity, and context of the records. When assessed together with emails, messages, internal documents, data, and subsequent conduct, however, they may help reconstruct the decision-making process, illuminate the knowledge and intent of those involved, and place the facts under investigation in context.
   
   

What the early foreign decisions suggest

10. In United States v. Heppner^[1], federal agents seized documents reflecting the defendant’s interactions with the Claude platform. The court rejected claims of attorney-client privilege and work-product protection over the platform output. The queries had been initiated by the user, without counsel’s direction, on a public platform whose terms did not support a reasonable expectation of confidentiality. Sending the material to counsel after the fact did not retroactively cloak with privilege a communication that was not privileged when created.
11. Heppner should not, however, be read to mean that every use of AI necessarily defeats all forms of legal protection. Subsequent U.S. decisions have taken a more flexible approach to materials prepared in anticipation of litigation, particularly where use of the tool did not materially increase the likelihood that an adversary could gain access. The analysis may turn on the nature of the protection asserted, the purpose of the interaction, the involvement or supervision of counsel, and the technical and contractual conditions governing the tool. The law remains emerging and unsettled.
12. In Fortis Advisors v. Krafton^[2], the Delaware Court of Chancery relied on queries submitted by Krafton’s chief executive to ChatGPT to reconstruct the strategy adopted in a dispute involving an earn-out obligation. The issue was not whether the tool’s legal guidance was correct. Rather, the interaction history helped explain the buyer’s rationale for removing the founder-executive, assuming operational control of the acquired company, and implementing the measures that later became the subject of litigation. As a remedy, the court ordered the executive’s reinstatement and equitably extended the earn-out period for the duration of the exclusion.
13. Although these decisions are not binding in Brazil and arise under distinct regimes of discovery, attorney-client privilege, and work-product protection, they foreshadow issues that may soon arise before Brazilian courts and authorities.
14. The tool selected also matters. Public accounts, enterprise environments, and internally deployed solutions may be subject to materially different terms concerning retention, model training, administrator access, and data sharing. Although there is no settled view that the use of an enterprise solution is, by itself, sufficient to preserve confidentiality or privilege, these features may bear on whether the user had a reasonable expectation of confidentiality and whether the interaction amounted to disclosure to a third party.