In 2025 a reporter filed public records requests with cities across Washington State, asking for records of officials using ChatGPT. The requests produced thousands of pages. Among the findings: half of a letter the mayor of Bellingham sent to state authorities had been copied verbatim from the chatbot.
No court has yet published a decision applying FOIA or a state public records act to a government employee’s conversation with an AI chatbot. That does not leave the question open. Prompts entered by public employees doing public business are records made in that connection, outputs received are records received, and several states have already said so.
Are AI Prompts Public Records?
In Washington, yes, explicitly. State Archives guidance updated in September 2026 treats an AI interaction, input and output, as a public record for retention purposes under RCW 40.14.010 when it relates to public business.
North Carolina gets to the same place by a different route. Guidance from the UNC School of Government puts both prompts and outputs inside the state public records law when an official uses an AI tool to do their job. Those records then fall under schedules set by the NC Department of Natural and Cultural Resources, which makes disposing of them outside an approved schedule a violation in its own right. 
California agencies have already produced ChatGPT logs in response to Public Records Act requests. The Army, meanwhile, issued a compliance memorandum requiring system owners to retain user interactions, prompts included, as official records and to keep them accessible for FOIA.
Four jurisdictions, four routes, one direction of travel.
What Are Agencies Arguing on the Other Side?
Not that AI records sit outside the law. The arguments are narrower than that, and more familiar.
HUD denied a FOIA request for AI prompts and responses used in developing policy, citing Exemption 5 and deliberative process privilege. A 2026 Pennsylvania Office of Open Records decision treated certain unshared ChatGPT conversations as exempt personal working papers, while holding that conversations shared or reviewed as part of an agency AI pilot could not all be withheld on that basis.
That second one matters because of how it reasoned. Ordinary record-specific and exemption-specific analysis, rather than putting AI conversations outside public records law altogether. Expect that pattern to hold.
Does a Personal Account Change Anything?
Generally no. Washington’s guidance says plainly that work-related AI interactions created on a personal device or account are still public records.
Which is settled ground, really. The same test has applied to personal email and texts for years: what function did the communication serve, not which account carried it. An employee using a personal ChatGPT login to draft an agency letter has not moved that work outside the records law. Only made it harder to find.
Where Should Agencies Start?
With retention, because that is where the exposure sits right now.
Most consumer AI tools do not integrate with records management or archiving systems. Capture therefore depends on manual workflows that nobody has designed, which means records that should be retained are quietly being destroyed by default. That is a separate violation from failing to disclose them, and arguably the worse one.
Retention also varies by what the prompt produced. Washington’s guidance indicates a prompt used purely as a sounding board can fall under a transitory schedule, while a prompt producing an output the agency then uses takes whatever period that output’s content requires. Our work on AI in modern records management and on data archival planning covers how that classification gets structured.
How Messaging Architects Can Help
We work with agencies, public universities and school districts on records obligations that arrive faster than policy does: AI use policy, retention schedule mapping, and the capture workflows that make a FOIA response possible. More sits on the Messaging Architects blog, and our parent company eMazzanti Technologies handles the platform side.
The request will arrive before the case law does. Preparing for it is the part you control.
