Written by: Wiktor Stefański, Head of People & Operations, Digital Colliers
The Seattle Times and Newsday filed suit against OpenAI and Microsoft in late January, alleging their journalism trained the models without permission or compensation. The complaints join a growing stack from publishers, from The New York Times to smaller regional outlets. If you represent a publisher, a content platform, or any client whose IP lives inside someone else's training corpus, the question is not whether this wave reaches your docket. The question is whether you can actually produce the evidence when it does.
What discovery actually needs
You need four categories of data on file before opposing counsel asks for it. First, sample-usage evidence. That means screenshots, API logs, or test queries showing your client's content appearing in model outputs. You want dates, prompts, and responses. If you wait until the motion to compel, you are building the case in reverse.
Second, robots.txt logs and crawl records. Your client's site administrator can pull these. They show which bots visited, when, and what they accessed. If a scraper identified itself as GPTBot or CCBot, you want that line-item history. If it masked as a generic user agent, you want the IP range and request pattern that proves it.
Third, licensing correspondence. Every email, every term sheet, every declined proposal. If your client said no to a data licensing deal, that refusal is evidence. If they never said yes, the absence of a signed agreement is evidence. Either way, you need the thread.
Fourth, vendor disclosure history. If your client uses any AI tooling internally, you need the vendor's data-processing addendum and their training-data disclosures. Court cases involving AI-fabricated citations rose from 87 to over 1,300 in eleven months during 2024. That velocity is not slowing. The ABA issued Formal Opinion 512 in 2024, clarifying that lawyers cannot bill hours AI actually saved. The regulatory lens is tightening. Your vendor disclosures become your timeline of what you knew and when you acted.
Turning it into a discoverable dataset
Most firms treat this material like a filing cabinet. Emails in Outlook, logs on an FTP server, screenshots in a Slack thread. That works until you face a 30-day production window. You need a single dataset with timestamps, sources, and tags. Start with a spreadsheet. Four tabs: usage evidence, crawl logs, correspondence, vendor files. Each row gets a date, a description, a file path, and a relevance tag.
If your client runs their own infrastructure, loop in the devops lead. They can export server logs in CSV or JSON. If they use a CMS, most platforms expose an activity log through the admin panel. You want six to twelve months of history as a baseline. If the lawsuit alleges training data from 2022 or earlier, extend the window.
For correspondence, do not limit the search to the term "training data." Search for "license," "scraping," "API access," "partnership," and the names of the AI vendors your client discussed deals with. Export those threads to PDF with headers intact. Metadata matters more than the body text in half of these threads.
Vendor disclosure files live in procurement folders or legal intake forms. If your client signed a data-processing agreement with an AI vendor, fetch the exhibits. EU AI Act Article 50 transparency obligations apply from 2 August 2026. That deadline is not theoretical. If your client operates in the EU or serves EU customers, disclosure gaps turn into compliance gaps fast.
What the winning operators are doing
The firms that stay ahead on this are not waiting for litigation to start the audit. They run quarterly data inventories. Sample 20 queries per AI tool their team uses. Document where the output came from. If the model cites a source, verify it. If it does not, flag it as synthetic. That cadence builds the evidentiary record in real time.
They also version-control their robots.txt files. Every change gets committed with a timestamp and a note. If they block a new bot, the commit message explains why. If they allow one, same. That history is admissible. A robots.txt file with no changelog is a document. A version-controlled robots.txt file is a policy record.
They keep a running log of every AI vendor conversation, even the ones that go nowhere. Date, attendees, topic, outcome. If the vendor pitches a training-data license and your client declines, that decision goes in the log. If the vendor does not disclose how they source their training data, that omission goes in the log. This is not paranoia. This is discoverable fact-building.
The cost of not having it
If you cannot produce usage evidence, the court assumes your claim is speculative. If you cannot produce crawl logs, opposing counsel argues you invited the scraping. If you cannot produce correspondence, you lose the refusal narrative. If you cannot produce vendor files, you lose the timeline of what your client knew. Every gap is a liability.
The publishers who filed early in this wave had the advantage of clean documentation. They could show systematic copying, repeated access, and clear refusals. The ones who file next need the same proof. The ones who defend their own AI implementations need it even more. Either way, the map is not optional.