What is the eDiscovery process?

The eDiscovery process is the sequence of steps legal teams follow to find, preserve, collect, review, and produce electronically stored information (ESI) for litigation, investigations, and regulatory requests.

The Electronic Discovery Reference Model (EDRM) is the map most of the industry uses to describe that sequence. The process is the route your team actually drives: who sends the hold, which systems get collected, when privilege gets logged. ESI covers far more than email now. Teams chats, Slack threads, shared drives, and even generative AI prompts all count.

For corporate legal departments, more of that route now runs in-house, on platforms like Logikcull's Corporate Suite that connect preservation, collection, review, and production. New to the vocabulary? Start with our introduction to eDiscovery basics.

What are the stages of the eDiscovery lifecycle in 2026?

EDRM 2.0, released September 1, 2026, now organizes the eDiscovery lifecycle into nine phases: Analysis, Identification, Preservation, Collection, Processing, Review, Production, Presentation, and Disposition. This model contains four major changes:

• Disposition joined the lifecycle. The model now ends with "a systematic, defensible process to retain, delete, transfer or return data after use."
• Analysis became a constant. It runs as a band across every phase instead of sitting in one box between processing and review.
• Four stages share an umbrella. Identification, preservation, collection, and processing now sit under Data Acquisition, because modern tools index and cull data in place rather than in strict sequence.
• Information governance went underground. It moved from a stage at the far left to the foundation beneath the whole lifecycle.

For what the redraw means for corporate teams, read EDRM 2.0: The Case for Connected eDiscovery.

What happens at each step of the eDiscovery process?

Every eDiscovery step works like a leg of a relay: something starts it, the team does the work, and it hands a baton to the next leg. Drop the baton and you pay for it later, in sanctions, rework, or a privilege fight.

When does eDiscovery preservation start?

Preservation starts the moment litigation is reasonably anticipated, which is often before a complaint is filed. A demand letter, a subpoena, or an internal complaint can trigger the duty, a standard courts have applied since the Zubulake decisions in the early 2000s.

The team identifies key custodians and data sources, issues a legal hold notice, tracks acknowledgments, and suspends any auto-deletion that could destroy relevant data. Under FRCP Rule 37(e), a party that fails to take reasonable steps to preserve ESI can face court-ordered measures, and intentional loss can lead to an adverse inference or dismissal.

The newest data source on the list is generative AI. Courts apply the same relevance and privilege rules to AI prompts and outputs as to any other ESI, and many AI tools delete logs on short default schedules, according to a 2026 Kilpatrick Townsend analysis.

Reveal Hold sends notices by email or through the Slack Legal Holds app, tracks custodian responses, and preserves data in place in Microsoft 365, Google Vault, Slack, and Box. The handoff: a defined list of custodians and sources, locked down.

How does data move from collection to processing?

Collection gathers the preserved data in a forensically sound way, scoped by custodian, date range, and source. Processing then turns that raw pile into something a reviewer can search: it extracts metadata, removes duplicates, runs optical character recognition (OCR) on scanned files, and culls by date, custodian, or keyword.

Logikcull connects directly to Microsoft 365, Outlook, Teams, Google Vault, Slack, Box, and Onna, or accepts files by drag-and-drop upload. OCR and deduplication run automatically on upload, and every document is indexed for search. The handoff: a searchable, deduplicated review set.

How do teams find what matters in review and analysis?

Review evaluates each document for relevance, responsiveness, privilege, confidentiality, and privacy. Analysis runs alongside it, surfacing the people, dates, and topics that shape case strategy, starting with early case assessment (ECA).

AI-assisted review helps reviewers move faster without taking the judgment out of their hands. In Logikcull, Auto Tags, Smart Responsive Tags, and Suggested Tags flag likely-responsive documents, the Potentially Privileged auto-tag surfaces attorney communications, and PII Detection finds personal data that needs protection. Attorneys still make every call. The handoff: a tagged set of responsive documents, with privilege calls made.

What changed about production and privilege logs?

Production delivers responsive documents to the other side in the agreed format, with Bates numbers stamped on every page and redactions applied. Privilege logs list what was withheld and why.

The timing of that last step changed on December 1, 2025. Amended FRCP Rule 26(f) now requires the parties' discovery plan to address how and when privilege claims will be made, and Rule 16(b) lets courts write those terms into the scheduling order, as Arnold & Porter explains. Privilege planning now begins at the meet-and-confer, before review starts. Many teams pair that plan with a Federal Rule of Evidence 502(d) order, which protects against waiver if privileged material slips through.

Logikcull stamps Bates numbers on productions, supports text, audio, global, and regex redactions, and exports privilege logs as reports built from your search results. The handoff: a production set and privilege log delivered on schedule.

What happens after production?

Presentation puts selected evidence in front of an audience at a deposition, hearing, or trial. Disposition closes the loop: the team releases legal holds, then returns, retains, or deletes data under its retention schedule. A defensible disposition record shows exactly what happened to the data and when. Reveal Hold lets teams release individual custodians as their part of a matter ends.

Is the eDiscovery process linear?

No. The eDiscovery process loops. A reviewer spots a new custodian in an email thread, and the team circles back to preservation and collection. A narrowed request sends a production back to review. EDRM has long described its model as iterative, and the continuous Analysis band in EDRM 2.0 makes that explicit.

Who owns the eDiscovery process inside a company?

In a corporate legal department, in-house counsel or legal operations usually owns the eDiscovery process from hold to production. IT supports access to source systems, records and information governance teams own retention and disposition, and privacy and compliance leaders weigh in wherever personal data is involved. Outside counsel typically leads case strategy, negotiation with the other side, and presentation.

Teams that document repeatable eDiscovery processes, with a named owner for each handoff, spend less time chasing data and more time on the facts of the case. See how corporate legal teams use Logikcull to run that work themselves.

eDiscovery process FAQ

What is the first step in the eDiscovery process?

The first step is identification: recognizing that litigation is reasonably anticipated and pinpointing the custodians and data sources involved. Preservation follows immediately, usually with a legal hold notice.

How long does the eDiscovery process take?

It depends on data volume, the number of custodians, and the court's schedule. A small matter can move from hold to production in weeks, while complex litigation can run for many months.

What is the difference between the EDRM and the eDiscovery process?

The EDRM is a conceptual model that names and organizes the phases of eDiscovery. The eDiscovery process is how a specific team carries out those phases on a real matter.

When does the duty to preserve begin?

The duty to preserve begins when litigation is reasonably anticipated, which can come before any lawsuit is filed. A demand letter, subpoena, or credible internal complaint can trigger it.

Are generative AI prompts discoverable?

Yes. Courts apply the same relevance, privilege, and work-product rules to AI prompts and outputs as to other ESI, so they belong in legal hold scoping.

What changed with privilege logs in 2025?

Amendments to FRCP Rules 26(f) and 16(b), effective December 1, 2025, require parties to address the timing and method of privilege claims in their discovery plan. Courts can then build those terms into the scheduling order.