Everything You Ever Typed, on a Regulator's Desk in Thirty Days

Most mid-sized companies learn about the true breadth of a government document demand the way they learn about most legal problems: too late, and in writing. The inquiry arrives on a Tuesday. The response deadline is thirty days out. And somewhere in the fine print is a phrase that should stop every executive cold: all documents and communications relating to.

Not all documents you kept. All documents relating to. That distinction is where companies drown.

The Scope You Didn't Budget For

Consider a realistic scenario. A state attorney general's office opens an inquiry into your consumer disclosures. The demand covers a three-year period and reaches any communication concerning the product at issue. Your compliance team immediately thinks of the policy manuals. The regulator is thinking about the sales rep's text message to a colleague that read, "we usually just let that slide."

Government demands routinely sweep in:

• Email and messaging platforms, including Slack channels nobody considers official
• Texts from company-issued and, depending on policy, personal devices
• Drafts, edits, and tracked changes in shared drives
• Voicemails, meeting recordings, and calendar attachments
• Communications with outside vendors and contractors who touched the issue

The volume is not the hard part. The hard part is completeness. Federal rules and most state analogs require production of relevant materials in your possession, custody, or control — and regulators have grown increasingly skeptical of companies that cannot account for where their own records live.

The 'We Didn't Know We Had That' Problem

The disasters in this space rarely involve destroyed evidence. They involve discovered evidence.

A distributor search uncovers a three-year-old shared drive folder where a regional manager kept informal pricing notes. A legacy chat export from a departed employee's laptop contains the candid assessment that never made it into any formal record. A marketing agency's server — which you control contractually — holds the campaign drafts that contradict the compliance-approved version.

Each of these becomes exponentially more painful when produced mid-inquiry rather than surfaced, assessed, and contextualized by counsel beforehand. The document itself may be defensible. The narrative of a company that didn't know its own records is not.

Architecture Before Urgency

The answer is not to delete more. Aggressive purging after a dispute is foreseeable can itself constitute spoliation, with sanctions that often exceed the underlying exposure. The answer is a retention and governance program built in calm weather:

1. Map the data estate. You cannot preserve or produce what you cannot find. Inventory every system where business communications live — email, chat, shared drives, CRM notes, ticketing platforms, vendor-held records — and assign each an owner.

2. Adopt a written retention schedule. Different record classes carry different clocks. Tax records, employment files, and ordinary business correspondence should not live under the same rule. A schedule adopted and followed in ordinary course is your best defense when questions arise about why something no longer exists.

3. Test your search capability. Once a year, run a mock exercise: pull every communication on a fictional topic across a six-month window. If that takes your team six weeks and three vendors, you have learned something valuable for the cost of a workshop rather than a subpoena.

4. Bring messaging into the tent. If Slack and texts are where decisions actually get made, they belong inside your retention and legal hold framework — not in an ungoverned gray zone.

5. Brief the bench. The first hours after a demand arrives matter. Whoever opens the envelope should know to call counsel, suspend routine deletion, and issue a preservation notice before anyone touches a keyboard.

The Strategic Payoff

Companies with disciplined records governance respond to inquiries faster, cheaper, and with a cleaner story. Their productions are complete. Their custodians are identifiable. Their outside counsel spends budget on strategy rather than forensic archaeology.

A regulator's demand is, in one sense, a forced audit of how your company communicates. The organizations that pass it are the ones that ran the audit on themselves first — while the outcome was still theirs to shape.