Reevaluating AI Governance: Insights from the 3M Case and the Necessity of Prompt Documentation

Recent developments surrounding the Watson Grinding explosion litigation involving 3M have prompted a reevaluation of AI governance, particularly regarding the use of generative AI in professional settings. A pivotal moment emerged when an engineering expert engaged by 3M used ChatGPT to inform his analysis, notably entering a prompt that directed the AI to articulate how 3M bore 0% responsibility. While it remains unclear whether 3M instructed this usage, the implications of the AI's role in the case are significant.

Plaintiff attorney Will Moye confronted the expert during his deposition after discovering materials he believed were generated by ChatGPT. After some tense exchanges, over 350 pages of AI-generated material were provided, revealing a wealth of conversation behind the formal report. This shift from a focus on the final document to the discussions underpinning it illustrates how AI can contribute to a deeper understanding of decision-making processes.

The Importance of Prompt Governance

Much of the conversation surrounding generative AI has revolved around input protection, with companies advising employees against sharing proprietary information or private data with AI systems. While these precautions are certainly necessary, they don't fully address the complexities presented by AI interactions. The dialogue surrounding AI could retain insights into decision-making processes, which traditional documents often lack.

Imagine an engineer using AI to evaluate different design strategies, repeatedly adjusting parameters until a preferred choice emerges. Similarly, a procurement professional might rely on AI to justify a vendor selection that has already been made. Such scenarios do not require the AI to produce erroneous outputs; they can capture trails of thought, chosen paths, and even considerations set aside—all of which provide critical context beyond the final decision.

Nonetheless, it's essential to clarify that prompts alone may not definitively reveal intent or reasoning. They often function as a tool for testing ideas or exploring various perspectives, so context matters significantly. Retaining interaction history allows organizations to build a narrative of how analyses developed, beyond the polished results.

Understanding the Entire Lifecycle

The Watson Grinding case has led me to pose a different set of questions regarding AI usage in enterprises. While it's crucial to understand what information is input into the model, it is equally important to recognize what evidence is generated during the interaction. This perspective expands the conversation from acceptable usage policies to a broader discourse on information lifecycle management.

An AI exchange does not conclude when an output is generated. Consideration must be given to how conversations are recorded, where they are stored, and how long they remain accessible. Often, organizations focus more on the start of that information lifecycle rather than its culmination.

Take shared conversations as an example, as OpenAI's guidance illustrates the risks present when shared links grant outside access to internal dialogues. This concern amplifies when different AI applications, each with distinct sharing and retention policies, are used across an organization. The challenge of effectively managing such information cannot be understated and extends far beyond basic compliance with AI usage protocols.

That said, simply retaining all AI interactions isn't the answer. In practice, accumulating excessive documentation can muddy the waters. An effective governance strategy should prioritize retaining only what is necessary to demonstrate accountability in high-stakes situations. For tasks with significant consequences—like safety analysis or audit evaluations—there should be enough recorded evidence to clarify AI's role.

Ownership and accountability emerge as critical themes in managing AI interactions. Responsibility for record-keeping should not fall solely on AI teams; legal and compliance perspectives should be integrated early on to prevent surprises during audits or investigations. Clear delineations between technology, records management, legal, security, and compliance domains are essential to ensure that organizations can manage AI-generated records appropriately.

Reconstructing Decisions: A Long-Term Perspective

A habit I've developed in operational contexts is to think backward from potential future inquiries. This perspective urges teams to contemplate whether they could reconstruct a decision months later. In cases where decisions come under scrutiny, organizations must be prepared to detail the available information, the role of AI, and the human oversight involved.

The evolving legal landscape around AI prompts still leaves uncertainty regarding discoverability. Factors such as privilege and relevance will determine what must be produced, as evidenced by a recent court case that blocked the disclosure of ChatGPT records due to protected legal research. This does not mean organizations should defer governance decisions; rather, they must act proactively to avoid issues when scrutiny arises.

The Watson Grinding case has reinforced my belief that not every AI prompt needs to be treated as a record. However, it highlights the necessity for organizations to assess when an AI interaction warrants that level of attention. The main takeaway from this situation is both straightforward and sobering: every organization employing AI in consequential roles should be able to address whether they could reconstruct the decision-making processes involved in a challenge years down the line.

As my colleague Josh Copeland aptly put it, "AI won’t testify for you; it won’t do jail time for you; it won’t pay your fines; but it will absolutely testify against you." This compelling statement drives home the fundamental question every organization should ask: If this decision was scrutinized a year from now, could we explicate how it was actually made?