Don’t Let Critical ECA Steps Slip Through the Cracks
Litigation Readiness: The Steps to Take After Your Company Is Sued
Your company was served. The next 90 days fix the scope, format, and cost of your entire discovery burden. Here are the federal deadlines that decide it, and what your team has to be ready to say.
A process server hands your receptionist an envelope. Inside is a summons and a complaint. Somewhere in your company, a mailbox is still set to purge messages older than 90 days, and it will run again tonight.
That is the real test of litigation readiness, and it arrives long before anyone argues the merits.
Most guides written for a company that has just been sued was actually written for an individual in small claims court. Stay calm. Do not call the plaintiff. Do not delete your emails. All of it is true. None of it is sufficient for an organization operating across email, Slack, Teams, cloud storage, and a dozen SaaS systems nobody has fully inventoried.
The Federal Rules of Civil Procedure impose a set of deadlines that begin the moment you are served, and they do not care whether IT has finished mapping your data. Within roughly 60 days, someone from your side will sit down with opposing counsel and speak, on the record.
They will talk about what data your company holds, where it lives, what you have done to protect it, and now, under rules that changed in December 2025, how you intend to handle privilege.
This guide maps that clock. It is written for in-house counsel, litigation directors, and eDiscovery managers at companies that have just been served in United States federal court.
What Happens When You Get Sued, in the Order It Actually Happens
A company sued in federal court inherits a sequence of obligations that starts before anyone has finished reading the complaint. Understanding that sequence is most of the work.
Ask most people to describe a lawsuit and you get the familiar list: pleadings, discovery, motions, trial, appeal. It is accurate, and it is misleading, because it implies the important part happens somewhere in the middle.
For a corporate defendant, the sequence that decides the outcome looks different:
- Trigger: Something makes litigation reasonably foreseeable. The duty to preserve attaches here, potentially months before anyone is served.
- Service: The complaint arrives and the federal clock starts.
- Preservation: Auto deletion stops. Custodians are notified. This either happened or it did not, and the record is permanent.
- Negotiation: The parties confer and agree the scope, format, and cost of the entire discovery burden.
- Production: You hand over what you agreed to hand over, in the format you agreed to.
- Merits: Everything a courtroom drama is about.
Notice where the leverage sits. Litigation readiness is tested at steps three and four, both of which land inside the first two months. By the time anyone argues the merits, the scope has been fixed for the better part of a year.
Companies rarely lose because a document was damaging. They lose because a document could not be found, could not be authenticated, or should have existed and did not.
Rule 37(e) Asks What You Did. This Is How You Prove It.
The Litigation Readiness Clock: A Working Federal Timeline
Here is the sequence most corporate defendants never see written down in one place.
Under Rule 12(a)(1)(A)(i), a defendant must serve an answer within 21 days after being served with the summons and complaint. Most teams know this one. It is the deadline everyone plans around, and it is not the deadline that governs your data.
The one that governs your data is Rule 16(b)(2). The judge must issue a scheduling order within the earlier of 90 days after any defendant has been served, or 60 days after any defendant has appeared.
Read that again. Sixty days after appearance. If outside counsel files an answer on day 21, that filing is an appearance, and the scheduling order becomes due around day 81.
Now work backwards. Rule 26(f)(1) requires the parties to confer at least 21 days before the scheduling order is due, which puts the conference at roughly day 60.
Day 60 is the moment your company's data becomes a matter of record.
These are default federal timings. Local rules, standing orders, and stipulations routinely change them, and waiving service under Rule 4(d) extends the answer deadline to 60 days, or 90 if the defendant is outside the United States. Confirm the operative dates for your matter.
The point is the shape of the curve, not the exact digits. You have roughly two months to be able to describe your own data infrastructure to a hostile audience.
How to Respond to a Lawsuit Without Making It Worse
Outside counsel will handle the answer. Your work in the first three weeks is quieter and, in the long run, more consequential.
Responding to a Complaint Starts With Verifying It
Before anything is calendared, confirm the basics. These sound clerical. They are the difference between a deadline you meet and a default judgment you have to move to vacate.
• The exact date of service, not the date somebody noticed the papers on a desk• The named entity. Corporate groups get sued in the wrong subsidiary constantly
• The court and case number, and whether the matter could be removed. Removal resets the response clock to 21 days from the notice of removal
• Whether a contract compels arbitration or a dispute escalation process that was skipped
• Whether the state deadline differs, if you were served with a summons out of state court
One thing that does not pause: a Rule 12 motion to dismiss buys time on the pleading. It buys no time at all on preservation. The duty runs regardless of whether you think the complaint survives.
The Cleanup Instinct Is the Most Expensive Mistake in This Guide
Many teams react to a lawsuit by tidying up. Archiving old threads or deleting drafts that read badly out of context. Tightening a retention policy that had been quietly ignored for years.
Every one of those instincts is understandable and every one of them looks, to a court, like something else.
In the Google Play Store antitrust litigation, evidence showed employees kept Google Chat history switched off, which meant relevant messages deleted themselves automatically. The court treated the practice as intentional destruction and issued an adverse inference instruction. No one had to shred anything. A default setting, left alone, was enough to sanction one of the largest companies in the world.
The steps above assume a reader with time to plan. If you need to brief IT, HR, and operations in the next hour, 9 things to do when your company gets sued sets out the same actions as a plain sequence, without the federal timeline.
Day 0 to 21: Document Preservation Is an Engineering Task
The obligation to preserve does not begin when you are served. It begins when litigation is reasonably anticipated, which is often months earlier and is decided, later, by someone else.
That decision is not made by you. It is made by a judge, looking at your demand letters, your internal emails, and your executive calendar.
So the first question in an active matter is not what we preserve now. It is what we know, and when did we know it. A cease and desist letter from eight months ago may have started this clock. If auto deletion has been running since then, you have a problem that no amount of diligence today will fully cure.
Suspend Deletion Before It Runs Again Tonight
Document preservation is an engineering task before it is a legal one. In the first days, the work is operational:
1. Suspend Retention and Auto-Deletion: Across email, chat, and file storage for custodians within the scope.
2. Freeze the Offboarding Pipeline: A departing employee’s mailbox is often wiped and the licence reassigned within days, making this one of the most common ways relevant data quietly disappears.
3. Cover All Relevant Systems: Including ticketing platforms, CRM notes, voicemail, shared drives, and any messaging apps your teams actually use, not just those officially supported by IT.
4. Timestamp Every Step: Reasonable steps are of limited value if you cannot demonstrate when they were taken and what actions were completed.
What “Reasonable Steps” Actually Means
Rule 37(e) is frequently described as imposing the duty to preserve. It does not. It is a remedial provision: it applies when electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it. The Advisory Committee notes are explicit that the rule rests on an existing common law duty rather than creating a new one, and that it does not apply to information lost before that duty arose.The standard is not perfection. The Committee acknowledged directly that perfect preservation across a modern data landscape is often impossible. The standard is reasonableness, evidenced.That distinction has teeth. Under Rule 37(e)(1), a court finding prejudice may order measures no greater than necessary to cure it. The severe remedies in Rule 37(e)(2), including adverse inference instructions and dismissal, require a finding that the party acted with intent to deprive another party of the information. The distance between "we tried" and "here is the timestamped audit trail" is often the distance between those two subsections.For the full mechanics of issuing, tracking, and releasing a hold, Venio's complete guide to legal hold best practices covers the lifecycle end to end. The rest of this guide assumes the hold is going out and focuses on everything that has to happen alongside it.
Rule 37(e) Asks What You Did. This Is How You Prove It.
Day 22 to 45: Know Your Data Before Anyone Asks
Most defendants treat the weeks after the answer as downtime. A well prepared plaintiff does not.
Document Requests Can Arrive on Day 22
Rule 26(d)(2)(A) lets the other side send you a document request from day 22, before the parties have conferred at all. It is not formally served until the first conference, so your 30-day response clock does not start yet. But the request is in your hands from day 22, and Venio's FRCP Rule 34 reference guide covers the response mechanics. The strategic effect is what matters here. A detailed, specific list of demanded data lands in your lap weeks before you sit down to negotiate scope. You then walk into that negotiation against a position that has already been staked out, while you are still working out how many SharePoint sites the company has.
What Is Discovery in a Lawsuit, Seen From the Data Side
Discovery is usually described as the exchange of information between parties. For a corporate defendant that description is close to useless, because it makes discovery sound like a filing exercise.Operationally, discovery is a data problem. The question is not what documents do we have. It is which systems generated potentially relevant material, who controlled it, how much of it there is, what state it is in, and what it will cost to make it reviewable. Every strategic decision downstream, including whether to settle, is priced off those answers.
The Five Questions You Must Answer Without Hedging
By the time the parties confer, you need to be able to answer these cleanly. Not eventually. On day 60. 1. Which systems hold potentially relevant data, including the SaaS tools bought on a department credit card that IT does not formally support?2. Who the custodians are, including the ones who have left?3. What your retention and auto deletion settings were, and when they were last changed?4. Which sources you will argue are not reasonably accessible under Rule 26(b)(2)(B), and the cost basis for that contention?5. Roughly how much data you are talking about, because volume drives every proportionality argument you will make?That last point is where early case assessment stops being a software category and starts being leveraged. Profiling and culling data before review begins is what converts a vague objection into an argument a judge can actually act on.Compare these two positions. "This request is unduly burdensome" invites a fight you will probably lose. "This custodian's Slack history is 4.2 million messages, the relevant window is six weeks, and here is what the date restriction reduces it to" is a proportionality argument with a number attached. Venio ECA exists to produce the second sentence.
The Sources That Get Missed
Traditional preservation advice assumes the evidence is email. Increasingly it is not.
Collaboration platforms produce data that is conversational and threaded, where reactions, edits, and deletions carry meaning that a flat export destroys. Ephemeral messaging deletes itself by design. Mobile data lives on devices the company may not own. Hyperlinked cloud documents create a version problem, because the link in an email points at a file that may have changed a dozen times since.
Each of these is easy to miss and very hard to explain afterwards.
Day 46 to 60: The Meeting That Sets Your Discovery Budget
Treat the conference required by Rule 26(f) as a procedural formality and you will pay for it for the remainder of the case.
The parties are required to discuss the nature of their claims and defenses, arrange for initial disclosures, discuss issues about preserving discoverable information, and develop a proposed discovery plan. Venio's FRCP Rule 26 reference guide sets out what each subsection requires.
What that description understates is how technical the conversation is. Production format, metadata fields, deduplication, threading, search terms, and clawback protection under Federal Rule of Evidence 502 all get decided here. Once they land in the scheduling order they are extremely difficult to reopen.
New Since December 2025: Privilege Method Is Now on the Agenda
This is the change most online content has not caught up with, and it is the one most likely to catch a legal team off guard this year.Amendments to Rules 16 and 26 took effect on December 1, 2025. Rule 26(f)(3)(D) now specifies that the parties' discovery plan must include their views and proposals on the method and timing of complying with Rule 26(b)(5)(A), the provision requiring a party withholding privileged material to expressly make the claim and describe the nature of what is withheld. Relatedly, Rule 16(b)(3)(B)(iv) now directs the court to include the timing and method for complying with Rule 26(b)(5)(A) in the scheduling order.According to the Committee Notes, the change was made because it is advantageous to settle the mechanism for withholding privileged material early, before disputes arise, and the amendments were drafted to leave parties and courts flexibility to adopt whatever method suits the case.Read that operationally and it means something specific. Privilege logging used to be a problem you deferred until production was well underway. It is now an agenda item at a meeting that happens around day 60, and whatever you agree to gets written into an order.So you need a position, early, on questions that are half legal and half technical:
• Categorical Logging or Document by Document: Categorical logging can save enormous cost on a large privilege population, but only if you propose it before the order is entered
• What Metadata the Log Will Carry: Whether your platform can generate it without manual re-keying
• How Privileged Material Will Be Identified: Including whether you will use analytics or technology assisted review to surface likely privileged documents rather than relying on search terms alone
• Families, Redactions, and Clawbacks: Including how document families and redactions will be handled and how inadvertent disclosures and clawbacks will be addressed. A company that cannot answer these on day 60 tends to accept the other side's proposal, and then spends the next year executing someone else's privilege methodology at its own expense
.One related change worth noting: the same package added a new Rule 16.1, which provides a case management framework specific to multidistrict litigation. If your matter is likely to be consolidated into an MDL, that rule now governs the early management conference.
Showing Up Unprepared Is Independently Sanctionable
Most teams understand that destroying evidence gets you sanctioned. Fewer know that arriving unprepared can too.
Under Rule 37(f), a party or attorney that fails to participate in good faith in developing and submitting a proposed discovery plan can be ordered to pay the other side's reasonable expenses, including attorney's fees, caused by the failure. Venio's FRCP Rule 37 reference guide covers the sanctions framework in full.
Good faith requires knowledge. This is the point where litigation readiness stops being an abstraction. A company that cannot describe its own data cannot bargain in good faith about it, and opposing counsel who senses that vacuum will fill it with an expansive proposal you will spend a year and a very large budget complying with.
Rule 37(e) Asks What You Did. This Is How You Prove It.
Day 61 to 90: What Gets Locked In
Three things now come due in quick succession.
1. Initial Disclosures: Under Rule 26(a)(1)(C), a party must make its initial disclosures at or within 14 days after the conference unless a different time is set by stipulation or court order. Note that a party is not excused from making its disclosures because it has not fully investigated the case. An incomplete investigation is not a defence to a late disclosure.
2.The Written Discovery Plan: The parties submit their report to the court within 14 days after the conference, now including the privilege method described above.
3. The Scheduling Order:The judge then issues the Rule 16(b) order fixing the deadlines to join parties, amend pleadings, complete discovery, and file motions. Rule 16(b)(4) permits modification only for good cause and with the judge's consent, and courts read good cause to turn on the diligence of the party asking. "We did not realise how much data we had" is not diligence.
Ninety days after a stranger handed your receptionist an envelope, the shape of your entire case is set.
Rule 37(e) Asks What You Did. This Is How You Prove It.
Where Litigation Readiness Actually Breaks
Most failures in the first 90 days are not failures of effort. They are failures of timing, sequence, or record keeping. Five patterns account for most of them.
1. The Trigger Was Recognised LateThe duty attached to the demand letter, not the complaint, and nobody logged the date. Everything downstream inherits that gap, and the company ends up litigating when it knew rather than what happened.
2. Over Collection Was Mistaken for SafetyCollecting from every conceivable custodian feels defensible. It is not safer, it is only more expensive, because every document collected enters processing, hosting, and eventually review. The cost multiplies at each stage, and an unnecessarily large collection weakens rather than strengthens a proportionality argument.
3. Modern Sources Were Treated as an AfterthoughtThe hold covered email. Collaboration platforms, mobile devices, ephemeral messaging, and hyperlinked cloud files were addressed weeks later, if at all, by which point the retention settings had already done their work.
4. The Record Was Reconstructed Instead of CapturedPreservation happened, but the account of it was assembled afterwards from memory and inbox archaeology. A log written after the fact is exactly what invites a challenge.
5. The Work Was Split Across Four Disconnected ToolsThis is the failure mode that gets named least and causes the most damage. Legal hold runs in one system, collection in another, processing in a third, review in a fourth. Each boundary is a place where the audit trail thins and custody has to be re-established by hand. When that account breaks, the argument stops being about the facts of the case and becomes about the handling of the data, which is the last place any defendant wants to be.
Rule 37(e) Asks What You Did. This Is How You Prove It.
How Venio Handles the First 90 Days
The fire drill has a specific technical cause. The work is fragmented, so the record is fragmented with it.Venio runs legal hold, early case assessment, processing, review, and production on a single platform. Venio Legal Hold issues notices and tracks custodian acknowledgments with a timestamped record of when the hold was triggered and who received it. Venio ECA profiles and culls the data before review, which is what lets you walk into the day 60 conference with volumes and a proportionality position rather than a shrug. Because it is one environment, custody is recorded as part of the workflow rather than reassembled afterwards, and the privilege decisions you agreed to in the discovery plan are executed in the same system that produced the log.That is the difference between arriving at day 60 with an answer and arriving with a project plan.
Building Litigation Readiness Before the Next Complaint Arrives
Litigation readiness is not something a company can acquire in 90 days. It is something you either had or did not have on the day you were served.The organisations that handle service calmly have done four things in advance:
• A Live Data Map: A current inventory of systems, owners, retention settings, and approximate volumes. Not a document from 2019
• A Written Trigger Policy: Who decides that litigation is reasonably anticipated, and what happens in the following 24 hours
• A Hold Mechanism That Is Not a Spreadsheet: Notices, acknowledgments, reminders, and escalations that generate their own audit trail as a byproduct of the work
• A Rehearsed Data Position: Someone who can describe the company's infrastructure, and now its privilege methodology, without needing to checkNone of that is glamorous. All of it is cheaper than a sanctions motion.
Building Litigation Readiness Before the Next Complaint Arrives
• The Rule 16(b)(2) scheduling order is due the earlier of 90 days after service or 60 days after appearance, and the 60 day trigger is the one most teams miss
• The parties confer at roughly day 60, and by then your data must be describable, not merely preserved
• Since December 1, 2025, the discovery plan and the scheduling order must address the method and timing of privilege compliance under Rule 26(b)(5)(A)
• The duty to preserve attaches when litigation is reasonably anticipated, often well before service
• Rule 37(e) asks for reasonable steps, evidenced. Steps you cannot prove barely count
• Rule 37(f) makes arriving unprepared to the discovery plan independently sanctionable
• Modern spoliation is usually a configuration rather than a decision
Rule 37(e) Asks What You Did. This Is How You Prove It.
Frequently Asked Questions
How long does a company have to respond after being sued in federal court?
Under Rule 12(a)(1)(A)(i), a defendant must serve an answer within 21 days after being served with the summons and complaint. Timely waiving service under Rule 4(d) extends that to 60 days, or 90 days for a defendant outside the United States. Filing an answer or a Rule 12 motion constitutes an appearance, which starts the 60 day scheduling clock under Rule 16(b)(2). State court deadlines vary and should be confirmed separately.
When does the duty to preserve evidence actually begin?
When litigation is reasonably anticipated, not when the company is served. Rule 37(e) operates on an existing common law duty rather than creating one, and courts have found that duty triggered by demand letters, cease and desist notices, government inquiries, and internal executive discussion of a likely dispute. A court may later have to decide when the duty arose, based on your own records.
What changed in the federal rules on December 1, 2025?
Rules 16 and 26 were amended and a new Rule 16.1 was added. The amendments to Rules 16 and 26 are interrelated and concern compliance with Rule 26(b)(5)(A), which governs how a party asserts privilege over withheld material. The discovery plan must now include the parties' views on the method and timing of that compliance, and the court includes the same in its scheduling order. Rule 16.1 provides a case management framework for multidistrict litigation. Note that Rule 37 was not amended in this package, despite claims to the contrary circulating online.
Can a company be sanctioned for something other than deleting evidence?
Yes. Under Rule 37(f), a court may require a party or attorney who fails to participate in good faith in developing the proposed discovery plan to pay the other side's reasonable expenses, including attorney's fees. Preservation failures under Rule 37(e) attract more attention, but they are not the only exposure.
What if we deleted something before we knew about the lawsuit?
Rule 37(e) does not apply to information lost before a duty to preserve arises, so the first question is always when that duty is attached. If data was lost after it was attached, the rule directs the court to consider first whether the information can be restored or replaced through additional discovery. Tell counsel immediately, document what was lost and when, and do not attempt to paper over the gap. Courts respond considerably worse to concealment than to disclosure.
Does a small business need to do all of this?
Proportionally, yes. A business sued in a modest dispute does not need an enterprise preservation programme. It does need to stop automatic deletion, identify who holds relevant material, and keep a record of both. The obligations scale with the matter. The principle does not.
Does any of this apply in state court?
Many states have adopted rules modelled on the Federal Rules of Civil Procedure, but timing and terminology vary and some states diverge significantly on electronically stored information. Everything in this guide describes federal practice. Confirm the operative rules and any local standing orders for your jurisdiction.
Who inside the company should own the first 90 days?
In practice it works best as a named triad: a lawyer who owns the legal position, an eDiscovery or legal operations lead who owns the data position and the timeline, and an IT contact with the authority to change retention settings the same day. The most common failure is not that nobody acts. It is that three people each assume one of the others is acting.
Discover the Power of Venio Cloud
Ready for enterprise speed without the infrastructure overhead? Launch your Venio Cloud environment today.
