E-Discovery
What Is a Privilege Log? FRCP 26(b)(5) and AI Review
The rule doesn’t require a document-by-document log, and a thin one can waive the privilege it’s meant to protect. Here’s how the formats, the entries, and AI-assisted review actually work.
Founder & CEO, Hintyr
Legal technology researcher and data scientist specializing in AI governance for litigation teams. Expertise in NLP and AI-assisted document review.
- A privilege log is how you satisfy Fed. R. Civ. P. 26(b)(5)(A). You expressly claim the privilege and describe each withheld document well enough for the other side to assess the claim, without giving up the protected content.
- The rule doesn’t require a document-by-document log. You can build it three ways, traditional item-by-item, metadata-plus, or categorical, and the right choice turns on volume, proportionality, and your court.
- Waiver is the real risk. A thin or late log can forfeit the privilege, and an FRE 502(d) court order is the cheapest insurance you’ll buy against an inadvertent-production disaster.
- AI now drafts first-pass privilege calls and log descriptions, but it doesn’t transfer accountability. ABA Formal Opinion 512 keeps a human lawyer responsible for the final call, and you should never put privileged material into a tool that trains on its inputs.
What a Privilege Log Is, and What Rule 26(b)(5) Requires
You’re withholding four thousand emails because they’re privileged. You can’t just sit on them quietly. Rule 26(b)(5)(A) says that when you withhold otherwise discoverable material, you have to do two things: “ expressly make the claim,” and “describe the nature of the documents, communications, or tangible things not produced or disclosed, and do so in a manner that, without revealing information itself privileged or protected, will enable other parties to assess the claim.” That second clause is the entire job of a privilege log.
Notice what the rule does not say. It never uses the word “log.” It asks for a description good enough to let your opponent test the claim. The log is just the customary way lawyers deliver that description, and that distinction matters once you get to formats.
A log protects two different things, and you have to keep them straight. Attorney-client privilege covers confidential communications between a client and counsel made to get or give legal advice. It’s the oldest privilege the common law recognizes, per Upjohn Co. v. United States. Work-product protection is a separate doctrine. It covers materials prepared in anticipation of litigation, traces back to Hickman v. Taylor, and now lives in Rule 26(b)(3), with near-absolute protection for an attorney’s mental impressions. Every entry has to say which protection you’re claiming, because the elements aren’t the same. If you want the ground floor, our privilege review primer walks through both.
Here’s the myth worth killing early. The rule does not require a line-by-line log. The 1993 Advisory Committee Note says item-by-item detail “may be unduly burdensome when voluminous documents are claimed to be privileged or protected, particularly if the items can be described by categories.” A federal court said it flatly in In re Imperial Corp. of America: nowhere does Rule 26(b)(5) mandate a document-by-document log. Your district or your judge might still want one, so don’t assume you’re free yet.
One last piece of vocabulary. You’ll hear a privilege log called a “Vaughn index.” That name comes from Vaughn v. Rosen, a 1973 Freedom of Information Act case, not a discovery case. The duty to log comes from Rule 26(b)(5)(A). Vaughn lent the nickname and the principle that “conclusory and generalized allegations” won’t satisfy anyone.
Document-by-Document, Metadata-Plus, and Categorical Logs
Picture the same withheld set logged three different ways. The choice can swing your discovery budget by tens of thousands of dollars, so understand it before you start.
The traditional format is document-by-document, the Vaughn-style log. Every withheld item gets its own row: date, author, recipients, type, and a description tailored to the claim. It’s the most protective and the most expensive, and a judge can still order it. In First Horizon National Corp. v. Houston Casualty Co., the court used Rule 26(b)(1) proportionality to require exactly that.
The metadata-plus format exports objective metadata, author, recipient, date, subject, file type, and adds one short description field. The Sedona Conference’s 2024 Commentary on Privilege Logs calls a “metadata plus topic log” its preferred format, because it satisfies Rule 26(b)(5) while cutting the narrative burden. A description like “Memo made at direction of counsel and sent to counsel for purpose of seeking legal advice” was held sufficient in Spilker v. Medtronic.
The categorical format groups documents by subject or custodian and discloses how many you withheld per category. Courts accept it, but you have to qualify. SEC v. Thrasher allows category logs where document-by-document logging would be unduly burdensome and the added detail “would be of no material benefit to the discovering party.” Both conditions, not just the first. And the standard doesn’t drop: Rule 26 “applies with the same force to a categorical log as it does to a traditional log,” per Auto. Club of New York v. Port Authority. A court let a party log roughly 12,000 documents by category in F.D.I.C. v. Fidelity & Deposit Co., where individually logging them would have been unduly burdensome.
So which format can you use? That depends on your forum, and the differences are real. New York’s Commercial Division makes categorical logging the default and can make a party who demands document-by-document logs pay for them (22 NYCRR 202.70(g), Rule 11-b). That’s a state rule, though, not a federal one. In federal court, the Southern and Eastern Districts of New York treat group logging as presumptively proper, while many districts say nothing at all. Categorical logging is available and increasingly accepted, but it isn’t a default you can elect on your own outside the places that allow it.
So here’s your Monday move. Before you log a single document, check three things: your district’s local rule on log format, the assigned judge’s standing order, and whether you’re in a forum where categorical is the default. Five minutes can save you a log you never owed.
What Goes in a Privilege Log Entry
A log entry is a small argument. In one row, you have to convince a skeptical opponent, and maybe a judge, that this document is genuinely off limits.
The standard fields are the date, the author or sender, the recipients, any cc or bcc, the document type, the specific protection you’re claiming, and the description. Every field exists for one reason: to “enable other parties to assess the claim,” in the rule’s words. The sample entry below shows what that looks like done right. It names the role, the act, and the subject, without quoting the advice itself.
Date
2024-03-14
Author
Jane Roe, General Counsel (Acme Corp.)
Recipient(s)
Outside counsel, Smith & Lee LLP; cc CFO John Doe
Doc type
Email with attached memorandum
Privilege claimed
Attorney-client privilege; work-product doctrine
Description
Email transmitting a memo prepared at the direction of counsel, seeking legal advice on a proposed product recall in anticipation of litigation.
The description field is where logs fail. Judge Grimm said it plainly in Victor Stanley, Inc. v. Creative Pipe, Inc.: lawyers “infrequently provide all the basic information called for in a privilege log, and if they do, it is usually so cryptic that the log falls far short of its intended goal.” An entry that reads “Email re: legal matter” is the kind that draws a motion to compel.
You’re threading a needle here. Describe too little, and you invite a challenge you’ll probably lose. Describe too much, and the description itself can reveal the protected content. Rule 26(b)(5)(A)(ii) asks for exactly that balance, which is why the description is the part of the log that actually takes judgment. Email families make it harder, since one privileged attachment can pull a whole thread onto the log; our guide to privileged email in productions gets into that.
And don’t skip the privilege-type field. An entry that doesn’t say whether you’re claiming attorney-client privilege, work product, or both is incomplete on its face, because the two doctrines have different elements. If you only need to hide part of an otherwise producible document rather than withhold it whole, that’s a different tool; see our guide to defensible redaction.
How a Thin or Late Log Costs You the Privilege
Here’s the part that turns a clerical chore into a malpractice-exposure problem. In Coker v. Goldberg & Associates, a party withheld a batch of WhatsApp audio files as privileged, produced no log, and a magistrate judge handed the privilege to the other side, with Rule 37 sanctions on top.
The privilege can die two ways. The first is a bad or missing log. The 1993 Advisory Committee Note warns that withholding without the required notice “may be viewed as a waiver of the privilege.” The second is an inadvertent production, when a privileged document slips into the other side’s hands.
The case law on lateness is sobering, but read it carefully, because the rule isn’t what people think. Burlington Northern & Santa Fe Railway v. U.S. District Court rejected the idea that missing a 30-day deadline automatically waives the privilege. It replaced that with a “holistic reasonableness analysis,” and admitted that logging within 30 days “may be exceedingly difficult, even for counsel who are sophisticated, experienced, well-funded, and acting in good faith.” Then it found waiver anyway, on the facts. So “no automatic 30-day waiver” does not mean you can take your time. It means lateness gets judged on the totality, and you can still lose.
For inadvertent production, the fix is FRE 502(d). A court “may order that the privilege or protection is not waived by disclosure connected with the litigation,” and that order reaches “any other federal or state proceeding.” Compare 502(b), the default otherwise: you prove you took reasonable steps after the fact. A bare clawback agreement is weaker still, because under 502(e) it binds only the parties unless a court enters it. The lesson is simple: an order beats a handshake. Move for a 502(d) order in every case with real volume, and if opposing counsel won’t join, move for it on your own.
Two honest caveats. A 502(d) order guards against inadvertent disclosure; it won’t save you if you simply fail to log, which is what sank the party in Coker. And courts split on whether a deficient log “waives” the privilege or just means you “failed to carry your burden.” The practical result often looks the same, but the framing matters: a failure-of-proof ruling is frequently curable with a better log, while a waiver finding can sweep in related documents and is harder to undo. Don’t assume a slip is fatal, and don’t bank on a second chance either.
How AI Is Changing Privilege Review
Privilege review has always been the part of discovery that eats associates alive. Thousands of documents, one call at a time. AI is the first thing that’s actually moved that number, so let’s be precise about what it does and what it doesn’t.
Start with the warning that can hurt you most. Before you put a single privileged document into any AI tool, confirm in writing that the tool does not train on your inputs and that your data is access-controlled. Most enterprise e-discovery platforms contract for that. Most consumer chatbot tiers do not. Feeding client-confidential material into a tool that trains on it can breach Model Rule 1.6, and it can arguably waive the very privilege you’re logging by disclosing protected content to a third party. ABA Formal Opinion 512 says client informed consent may be required first. So don’t paste a privileged memo into a general-purpose consumer chatbot; the privilege risk of consumer AI is its own subject.
With that settled, here’s the real distinction. TAR, or predictive coding, is a classifier you train on attorney-coded examples; it prioritizes and flags the documents most likely to be privileged, and you validate it statistically. That’s the same engine behind technology-assisted review for responsiveness. Generative AI works differently. You write the criteria in plain language, the model classifies against them with minimal task-specific training, and, the genuinely new part, it can draft the narrative description that goes in the log. The first-pass call and the first draft both move off your plate.
What doesn’t move is the judgment. No court, trial or appellate, has squarely held that an AI-drafted privilege log is defensible on its own. The legal cover is indirect: it borrows from cases approving technology-assisted review for a different task, from the general reasonableness standard of Victor Stanley, and from advisory ABA guidance. Defensibility rests on your documented human review, not on the brand of the tool.
ABA Opinion 512 draws the line cleanly. Using AI to brainstorm a memo is one thing; using it to decide what you withhold from opposing counsel calls for more independent review. The opinion is advisory until your state adopts it, so check your own bar.
This is the narrow space agentic review is built for. Hintyr, an Agentic Document Review platform for small and mid-size firms, takes the first pass at each privilege call and drafts the log description, then puts every entry back in front of an attorney with a citation to the document it came from. It’s built to be always intuitive, always accurate, always cited. It doesn’t make the privilege call for you. It does the mechanical first pass so your time goes to the close calls, where the QC habits that prevent AI redaction failures still matter.
Building a Privilege Log That Holds Up
Defensibility isn’t a format. It’s a paper trail that shows you were reasonable, and you build it in three stages.
At the Rule 26(f) conference, negotiate two things: the log format, categorical or metadata-plus where the volume justifies it, and a list of categories nobody has to log, like communications with trial counsel after the complaint. Rule 26(f)(3)(D) literally tells you to raise whether to ask the court for an FRE 502 order. Do it there.
Then get it entered. A categorical-log stipulation and your 502(d) order both belong in the Rule 16(b) scheduling order, because a private agreement binds only the parties (FRE 502(e)) while a court order reaches other proceedings.
During review, keep a human accountable and document the workflow. If you use AI, preserve the evidence that satisfies Victor Stanley’s reasonableness standard: your prompts, your validation samples, recall and precision numbers, reviewer credentials. No rule sets an exact QC ratio, but a defensible default is to have an attorney review every document the AI flagged as privileged, plus a valid sample of the rest, before production. Tools that keep a citation on each entry make that record easier to keep.
Then produce on time, and make every entry name its protection with a description that supports it. The responding party carries the burden of proving each claim, and that burden never shifts to the other side. Lighter formats and AI cut the effort. They don’t cut the obligation.
Frequently Asked Questions
Does Rule 26(b)(5) require a document-by-document privilege log?
No. The rule and its 1993 Advisory Committee Note allow description “by categories,” and In re Imperial Corp. holds nothing in Rule 26(b)(5) mandates item-by-item logging. Check your local rules and your judge, though, because some require it anyway.
What is a categorical privilege log?
It groups withheld documents by subject or custodian and states how many you withheld per category, instead of listing each one. Courts allow it where document-by-document logging would be unduly burdensome and the extra detail adds no material benefit (SEC v. Thrasher). In New York’s Commercial Division, it’s the default.
What is a Vaughn index?
It’s another name for a privilege log, taken from Vaughn v. Rosen, a 1973 FOIA case that made an agency itemize and justify what it withheld. The civil-discovery duty itself comes from Rule 26(b)(5)(A), not from Vaughn.
What happens if your privilege log is late or inadequate?
You can lose the privilege. Burlington Northern rejected an automatic 30-day waiver but applies a holistic reasonableness test, and Coker found waiver where a party produced no log at all. Timeliness is part of defensibility, so don’t treat the deadline as soft.
Can AI write a privilege log?
It can draft first-pass calls and descriptions, but ABA Formal Opinion 512 keeps a human lawyer responsible for the final determination, competence, and confidentiality. Document your QC, and never feed privileged material to a tool that trains on its inputs.
This article is for general information, not legal advice, and it doesn’t create an attorney-client relationship. Privilege rules vary by jurisdiction and judge, and the decisions here bind only their own courts. Confirm your local rules and the assigned court’s standing orders, and consult qualified counsel, before you act.
Spend less time logging, more time lawyering.
If your next production has a privilege log attached, and most do, see how agentic review handles the first pass so your time goes to the close calls instead of the formatting. You sign off on every entry. Hintyr just gets you to a defensible draft faster.