Your Next Custodian May Not Be a Person

AI agents now hold directory identities, licenses and, in some configurations, their own mailboxes and email addresses.  Discovery practice still assumes a human on the other end.

The same question is asked in every civil litigation: Who has knowledge of the issues, and where might relevant information be stored?  The question survived the introduction of file shares, email, instant messaging, cloud and collaboration platforms.  Every one of those introductions expanded where information sits.

The question that always remained was “who.”

Discovery in the world of electronically stored information (ESI) was built on the custodian framework, meaning a person in possession or control of information relevant to a set of facts, or with knowledge of where that information resides.

AI has begun to test that framework.  AI agents can create information, move it, store it and act on it in ways that do not always align with the concept of a human custodian.

In early 2025, that concern sounded premature.  It is less so now.  The sections below describe examples of what has changed technically, where it may matter in litigation and what a measured response looks like.

One caution at the outset: we are still in the very early stages of how this issue may impact day-to-day litigation, and in many matters none of it will be relevant.  The purpose is to understand the technology well enough to make informed and proportionate decisions in cases where it does matter.

From Assistant to Colleague

Many organizations are still working out how to govern generative AI.  AI agents have arrived, often before the full governance framework is established.

Generative AI assistants, e.g., Copilot, were easier to understand for discovery purposes than AI agents.  A person opened one, asked it to draft an email or summarize a conversation thread, reviewed the answer and proposed what to do next.  That interaction fits the traditional human custodian discovery model.

The person was the actor.  The mailbox or workspace was the likely source.  The assistant’s output was usually just another record created during that person’s work.

AI agents are different, though most are built on the same generative models used by AI assistants, so the distinction is not the underlying technology.  The difference is operational.  An AI assistant responds when a person asks, while an AI agent can detect a trigger, decide what steps to take and act without waiting for a new human prompt.

An AI agent can be configured to complete a set of tasks rather than answer a single request.  Consider the simple example of a procurement AI agent that monitors incoming invoices, checks them against purchase orders and contract terms, opens a ticket when documentation is missing, updates the vendor record and notifies the appropriate team.

Each of those steps is routine on its own.  What differs is that the AI agent can carry the work across several systems without a person prompting each action.

For generative AI assistants, the usual questions still apply to the human custodian.  Who used it, what did they ask, what did they receive and where was the exchange stored?

In the narrower set of cases where the AI agent’s own activity is genuinely at issue, there may be more to ask, such as who configured it and when, what data sources it reached, what triggered it and where its output was stored.

Those answers may not sit completely with a traditional custodian — someone directly linked to the facts and circumstances at issue.  They may instead involve resources tied to the AI agent, such as an agent identity, a service account, a license or a downstream system.

Process-level artifacts such as audit logs and connector records exist as well, but their applicability is often limited. In most disputes, the relevant evidence is the output the agent produced rather than the sequence of steps it took, and that output is generally stored where any other work product would be.

Employees may not experience this as a significant change. To them, an AI agent may feel like an extension of themselves, no different from a rule, macro or workflow.  That describes how an AI agent feels to the user. It does not describe the full depth, however, of what the AI agent can do.

Once software can act without a fresh prompt, under its own identity, across systems and repositories, it becomes harder to treat as nothing more than an extension of a human custodian.  The clearest evidence of that shift comes from the platform vendors themselves.

AI Platforms Have Started Issuing Identities

AI agents are now being assigned identities and credentials once reserved for human users and conventional applications.  Software features are not ordinarily issued credentials. AI agents now are.

A primary example is Microsoft, which has built an identity category specifically for AI agents.  Under Microsoft Entra Agent ID, an AI agent receives its own directory object, distinct from both human users and ordinary applications.  The AI agent can be granted permissions, appear in sign-in logs and have a managed lifecycle.

Two things about that model should matter to legal teams.

First, every Microsoft AI agent identity must have a sponsor.  Microsoft describes this as the business representative accountable for what the AI agent is for and how long it exists.  In other words, a named person or group, already recorded in the Entra directory.

Second, some AI agents get their own accounts, which Microsoft calls an AI agent’s user account.  A person does not sign into that account.  Instead, the AI agent uses it to access services.

The account can have its own mailbox, its own file storage, an email address and a name colleagues can use to tag it in Teams.  Microsoft’s own description of the use case is “long-term digital employees” who work as team members.¹  In practical terms, the account gives the AI agent the same organizational footprint as an employee.²

Microsoft is not alone.  Amazon gives AI agents their own identity through Bedrock AgentCore.  Salesforce Agentforce service agents also operate with their own identity, not that of the human who designed them.

None of this was designed with discovery in mind.  But once AI agents have their own identities, it raises a practical question: where does their data live?

Where the Data Lives Is an Unresolved Question

Take Microsoft Copilot as an example.  When a person interacts with Copilot, the record goes into that person’s Exchange mailbox.  That has been Microsoft’s model since Copilot launched, and it works because there is a human directly linked to one side of the exchange.

AI agents break that in two ways where Microsoft 365 (M365) is concerned.

One uncertainty is where the activity of an AI agent with its own user account will be stored.  Because the account can have its own mailbox, some activity may sit there rather than in any human’s mailbox.  Microsoft’s architecture allows this, but the implementation details remain fluid, making it a possibility to monitor rather than one to plan around.³

The second limitation is clear and more significant.  Microsoft supports eDiscovery and retention only for agent-to-human and human-to-agent interactions.

Agent-to-tool and agent-to-agent activity is tracked through audit processes.  When an AI agent calls a connector, changes a record or passes work to another agent, that activity is recorded in logs, and those logs are retained according to IT retention settings rather than any litigation-driven schedule.

What Changes Inside a Legal Matter

These changes in where data is stored challenge something eDiscovery has always taken for granted.  The person who took an action was also the person who held the record of it, or at least knew where it was kept.  Custodian-based discovery has relied on that assumption from the start.

AI agents complicate that assumption because they can act and create information without a person initiating or observing each step.  In the rare case where an AI agent’s activity is genuinely at issue, discovery may need to account for the systems in which that activity is recorded.  Whether it does is not a new obligation; it is a question of relevance and proportionality in the particular case.

The practical effects are easiest to see by discovery phase.

Preservation

Preservation is where the departure from traditional practice is clearest.  A legal hold notice cannot be sent to an AI agent.  There is no one to acknowledge it and no conduct for the AI agent to modify.

Any preservation obligation therefore falls to a person, which assumes someone has already determined who owns or controls a given AI agent.  In many organizations that determination has not been made, so a notice may reach someone who does not realize an AI agent is within their control.

Microsoft’s identity model offers a partial answer.  As described above, the sponsor field identifies an accountable person or group.

Most organizations have not integrated this into legal hold processes, as the issue is just beginning to emerge.  It is simply worth knowing the link exists.  It also exists in one platform; other platforms handle this differently, or not at all.

Collection

Collection should begin with the relevant output. In most matters, that will be enough.

If the AI agent’s operation is disputed or necessary to understand the output, counsel can then consider whether additional sources, such as an agent account or an audit record, are relevant and proportional.  The fact that those sources exist does not make them presumptively relevant and, in the vast majority of cases, audit records or logs will be both irrelevant and too burdensome to include in the discovery process.

Configuration data

In the rare case where an AI agent’s own behavior is disputed, its configuration can be informative.  An AI agent’s configuration records what it was instructed to do, what data it could reach and how it was triggered.  If relevant, counsel should be aware that configuration changes over time and platforms may not retain prior versions, so historical versions should not be assumed to be available.

A Familiar Governance Problem

None of this requires a new discipline.  The profession has worked through comparable transitions before.

Microsoft SharePoint Online arrived and needed an inventory, an ownership model, a retention decision and a disposition rule.  Email needed the same.  Teams arrived and needed the same, and in many organizations that work is still not finished.

Each time, someone had to establish the platform’s governance.

AI agents may need the same treatment in certain cases. Know what exists, know who owns it and understand what happens to its output, including when the agent is switched off.

Many comparisons to other technologies break down when an AI agent is retired. When an employee leaves, you do not immediately lose their email. The mailbox persists, and if a platform like Microsoft Purview is involved, a legal hold can survive the account being closed.

An AI agent may have no equivalent. If it is switched off, the record of what it did may go with it. AI agents are created and retired frequently, often by both IT and business users.

Whether that risk warrants a control depends on the organization and on how likely it is that agent activity will ever be at issue.

Where the Law Is, and Is Not

As with any new development, the law here is unsettled and is likely to remain so in the near term. There is little reason to expect amendments to the civil rules, or decisions, treating AI agents as the equivalent of human custodians.

Guidance is in progress, but none has been published. The Sedona Conference circulated a member comment draft in April 2026 on using generative AI in the discovery process, which is a different question from the one in this article.

On the question that matters here, The Sedona Conference solicited volunteers in June 2026 for two Working Group 1 commentaries, one on the discoverability of generative AI information and one on generative AI and privilege. Outlines are slated for discussion at the Sedona Conference WG1’s October 2026 Annual Meeting, with full drafts targeted for December 2026.

A third “brainstorming” group in Sedona’s WG1 is examining admissibility of AI-related data, though its charge is narrower: produce a discussion outline and decide whether a paper is warranted. Published guidance is a 2027 event at the earliest.

Courts have begun to address AI use in litigation, but those decisions have involved people using AI tools rather than agents operating on their own.

Starting Points

The practical question is what, if anything, to do before the issue of AI agents shows up in a matter. The answer will vary considerably by organization, and any step should be weighed against how likely it is that AI agent activity will ever be at issue and what the effort would cost. In a large enterprise, a complete and current inventory of AI agents may not be realistic.

A more achievable goal is a general understanding of which AI platforms are in use, whether AI agents on those platforms act under a person’s identity or their own, and leveraging the fact that platforms such as Microsoft Entra and Agent 365 maintain agent registries that can be queried if the need arises.

That understanding will not stay current on its own. AI agent capabilities and the way platforms record and retain agent activity can change quickly, and what is true of a platform today may not be true a few months from now. For that reason, an ongoing working relationship with IT is important to understand what is being deployed and assess how deployment may affect eDiscovery workflows.

Looking Ahead

The custodian will remain a person. What is changing is that a person is no longer the only one doing the work, and the record of that work may not always sit where custodian-based discovery workflows reach.

Organizations are still working out where agent activity is stored and how long it is kept, and neither published guidance nor case law has weighed in. Even when that happens, questions about agent activity are likely to be resolved under familiar principles of relevance and proportionality, one matter at a time.

Organizations that keep track of how AI agents are being deployed in their environment and treat the issue as ordinary information governance scaled to the actual risk will be in a better position to respond when AI agent activity does become relevant.