Expert Disclosure for Technical Experts: Rule 26(a)(2) in Practice

Disclosing a forensic or technical expert under Rule 26(a)(2)

Federal Rule of Civil Procedure 26(a)(2) governs how a forensic or technical expert is disclosed. Rule 26(a)(2)(A) requires a party to identify any witness it may use at trial to present evidence under Federal Rule of Evidence 702, 703, or 705. A witness retained or specially employed to provide expert testimony in the case — or an employee whose duties regularly involve giving expert testimony — must serve a signed written report containing six specified elements under Rule 26(a)(2)(B). Every other expert witness gets the shorter Rule 26(a)(2)(C) disclosure.

Classification decides everything downstream, and it is usually decided by accident

The report/no-report line is drawn by the text of Rule 26(a)(2)(B). "Unless otherwise stipulated or ordered by the court," a written report is required "if the witness is one retained or specially employed to provide expert testimony in the case or one whose duties as the party's employee regularly involve giving expert testimony."

Two things in that sentence do the work, and forensic engagements can get both wrong.

First, the employee prong is narrower than it looks. Being the party's employee is necessary — a contractor cannot fall inside this prong at all — but it is not sufficient. What the prong turns on is whether that employee's duties regularly involve giving expert testimony, not whether the witness is technical, or senior, or the person the company would naturally put on the stand. A company's in-house forensic examiner who images laptops for internal investigations and has never testified does not fall inside the employee prong merely because the opinions are expert opinions.

Second, the retention prong is anchored to "in the case." An examiner engaged by outside counsel after a complaint is filed, to analyze the evidence and testify, is squarely inside it. An examiner who was already on the incident under a pre-suit engagement — running the containment analysis during the first days of a departing-employee investigation, or supporting the incident response the company later asserts privilege over — was not originally employed to provide testimony. Whether a later designation to testify brings that earlier engagement inside (a)(2)(B) is not answered by the rule's text.

The Advisory Committee's 2010 note is unusually direct on the classification question itself: "An (a)(2)(B) report is required only from an expert described in (a)(2)(B)." The note added Rule 26(a)(2)(C) precisely to resolve "a tension that has sometimes prompted courts to require reports under Rule 26(a)(2)(B) even from witnesses exempted from the report requirement."

That said, the risk is asymmetric, and Rule 37(c)(1) is why. A party that fails to provide information or identify a witness as required by Rule 26(a) "is not allowed to use that information or witness to supply evidence on a motion, at a hearing, or at a trial, unless the failure was substantially justified or is harmless." In addition to or instead of that sanction, the court — on motion and after giving an opportunity to be heard — may order payment of the reasonable expenses, including attorney's fees, caused by the failure; may inform the jury of the failure; and may impose other appropriate sanctions, including the orders listed in Rule 37(b)(2)(A)(i)–(vi). The cost of a report that was not strictly required is a few weeks of expert time. The cost of a missing report can be the witness.

The six report elements, and where forensic reports are most exposed

Rule 26(a)(2)(B) requires a report "prepared and signed by the witness" containing:

1. A complete statement of all opinions the witness will express and the basis and reasons for them. This is where a good examination report and a good expert report diverge. An artifact narrative — this USB serial number appears in the registry, these files were accessed at these times — states findings, not opinions. If the intended testimony is that data was exfiltrated, or that a file was backdated, the opinion and its reasoning have to appear in the report, not be assembled at deposition. Our primer on how to read a forensic report walks the same gap from the reader's side.

2. The facts or data considered by the witness in forming them. The 2010 amendment narrowed this from "data or other information" to "facts or data" to exclude counsel's theories and mental impressions. It did not narrow it in the direction people assume. The Advisory Committee Note says "facts or data" is to be "interpreted broadly to require disclosure of any material considered by the expert, from whatever source, that contains factual ingredients," and that the obligation extends to any facts or data "considered" — "not only those relied upon by the expert." An examiner who was sent a hundred documents and used four still considered a hundred.

3. Any exhibits that will be used to summarize or support them. In technical cases these are timelines, artifact tables, screenshots, and extraction summaries. They are due with the report, not with the pretrial exhibit list.

4. The witness's qualifications, including a list of all publications authored in the previous 10 years. The rule asks for qualifications generally and itemizes one thing specifically: the 10-year publications list. Tool certifications are qualifications and belong in the CV, but a certification-heavy CV does not satisfy the element the rule names.

5. A list of all other cases in which, during the previous 4 years, the witness testified as an expert at trial or by deposition. The trigger is testimony at trial or by deposition, so the common gap is depositions in matters that later settled and never produced a trial record. This is a records problem with a records solution: the expert should maintain a running testimony log from the first engagement, not reconstruct four years of it under a report deadline.

6. A statement of the compensation to be paid for the study and testimony in the case. A rate card may not be the end of it. Rule 26(b)(4)(C)(i) makes attorney-expert communications about compensation discoverable, and the 2010 note says that discovery "may go beyond the disclosure requirement in Rule 26(a)(2)(B)(vi)," is "not limited to compensation for work forming the opinions to be expressed," extends to all compensation for the study and testimony provided in relation to the action, and includes "[a]ny communications about additional benefits to the expert, such as further work in the event of a successful result in the present case."

What a Rule 26(a)(2)(C) disclosure must contain

For a witness not required to provide a report, and again unless the parties stipulate or the court orders otherwise, the disclosure must state "(i) the subject matter on which the witness is expected to present evidence under Federal Rule of Evidence 702, 703, or 705; and (ii) a summary of the facts and opinions to which the witness is expected to testify."

Two elements, and the second is the one that gets shortchanged. A disclosure reading "Subject matter: computer forensics" satisfies clause (i) and nothing else. The rule requires a summary of the opinions, not a topic heading.

The counterweight is real, and it is in the note: the (C) disclosure "is considerably less extensive than the report required by Rule 26(a)(2)(B)," and "[c]ourts must take care against requiring undue detail, keeping in mind that these witnesses have not been specially retained and may not be as responsive to counsel as those who have." The note also confirms the obligation "does not include facts unrelated to the expert opinions the witness will present."

The note expressly contemplates the hybrid posture that describes many in-house technical witnesses: a witness not required to provide a report "may both testify as a fact witness and also provide expert testimony under Evidence Rule 702, 703, or 705," and the note gives "employees of a party who do not regularly provide expert testimony" as a frequent example. The security engineer who describes what the SIEM showed is a fact witness; the same engineer who opines on attribution is giving Rule 702 evidence and must be identified under (a)(2)(A) and — assuming his duties do not regularly involve giving expert testimony, which would put him back inside (a)(2)(B) — disclosed under (a)(2)(C).

The 2010 protections, scoped precisely

Draft reports and disclosures. Rule 26(b)(4)(B) applies Rules 26(b)(3)(A) and (B) to "drafts of any report or disclosure required under Rule 26(a)(2), regardless of the form in which the draft is recorded." Per the note, this protection "applies to all witnesses identified under Rule 26(a)(2)(A), whether they are required to provide reports under Rule 26(a)(2)(B) or are the subject of disclosure under Rule 26(a)(2)(C)," in any form — "written, electronic, or otherwise" — and to drafts of any Rule 26(e) supplementation.

Attorney-expert communications. Rule 26(b)(4)(C) protects communications between the party's attorney "and any witness required to provide a report under Rule 26(a)(2)(B)," regardless of form, subject to three exceptions.

Here is the asymmetry that engagement decisions tend to ignore. The draft protection covers both categories of witness. The communications protection covers only (a)(2)(B) report witnesses. The note is explicit: "The rule does not itself protect communications between counsel and other expert witnesses, such as those for whom disclosure is required under Rule 26(a)(2)(C)." Choosing the (C) route to avoid the burden of a report also gives up the Rule 26(b)(4)(C) shield over every email counsel sends that examiner. The note preserves other grounds — "[t]he rule does not exclude protection under other doctrines, such as privilege or independent development of the work-product doctrine" — but those must be established, not assumed.

Two useful expansions in the note: protected communications include "those between the party's attorney and assistants of the expert witness," and "the party's attorney" is to be applied "in a realistic manner," often not limited to "a single lawyer or a single law firm" — reaching attorneys representing the party in related suits, and communications with in-house counsel "even if the in-house attorney is not counsel of record in the action."

The protection is qualified, not absolute. Under the note, discovery of protected drafts or of attorney-expert communications outside the three exceptions "is permitted only in limited circumstances and by court order," on the Rule 26(b)(3)(A)(ii) showing of substantial need and inability to obtain the substantial equivalent without undue hardship — a showing the note says "[i]t will be rare for a party to be able to make." A party's own failure to provide required disclosure does not establish that need; Rule 37 is the remedy. And if a court does order the discovery, Rule 26(b)(3)(B) protects the attorney's mental impressions — but the note adds that "this protection does not extend to the expert's own development of the opinions to be presented."

What remains discoverable

The three exceptions in Rule 26(b)(4)(C) reach communications that: "(i) relate to compensation for the expert's study or testimony; (ii) identify facts or data that the party's attorney provided and that the expert considered in forming the opinions to be expressed; or (iii) identify assumptions that the party's attorney provided and that the expert relied on in forming the opinions to be expressed."

The note then draws boundaries that are worth quoting into a meet-and-confer letter:

• The exceptions do not swallow the communication. "[E]ven when the excepted topics are included among those involved in a given communication, the protection applies to all other aspects of the communication beyond the excepted topics."
• Exception (ii) "applies only to communications 'identifying' the facts or data provided by counsel; further communications about the potential relevance of the facts or data are protected."
• Exception (iii) is limited to assumptions "the expert actually did rely on." "More general attorney-expert discussions about hypotheticals, or exploring possibilities based on hypothetical facts, are outside this exception."

Separately, and most consequentially for forensic work, three categories sit outside the protections entirely. Rules 26(b)(4)(B) and (C) "do not impede discovery about the opinions to be offered by the expert or the development, foundation, or basis of those opinions." The note's own example is squarely on point: "the expert's testing of material involved in litigation, and notes of any such testing, would not be exempted from discovery by this rule." Second, "inquiry about communications the expert had with anyone other than the party's counsel about the opinions expressed is unaffected." Third, counsel may question the expert "about alternative analyses, testing methods, or approaches to the issues on which they are testifying, whether or not the expert considered them."

The note closes that passage by confirming the discovery changes "do not affect the gatekeeping functions called for by Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993), and related cases" — and Rule 702 now requires the proponent to demonstrate each of its four conditions to the court on a more-likely-than-not standard, including that "the expert's opinion reflects a reliable application of the principles and methods to the facts of the case."

How this changes the way an examination is scoped and documented

Fix the designation before the acquisition, not after the report deadline. The engagement letter is the primary record of what the examiner was employed to do, and the classification runs through it: retention to provide expert testimony in the case puts the witness inside Rule 26(a)(2)(B), and it is (a)(2)(B) status that carries the Rule 26(b)(4)(C) communications shield. If a testifying role is possible, say so in writing at the outset. If the examiner is genuinely consulting only and is not expected to be called at trial, Rule 26(b)(4)(D) ordinarily bars the other side from discovering facts known and opinions held "by interrogatories or deposition," absent Rule 35(b) or "exceptional circumstances under which it is impracticable for the party to obtain facts or opinions on the same subject by other means." What does not work is leaving the question open and discovering the answer at the deposition.

Keep the examination record separate from the drafting record. Because testing and the notes of testing are outside the 2010 protections while drafts of the report are inside them, the two should not live in one file. Acquisition logs, hash values, tool and version records, and the chain of custody documentation should be treated as discoverable — Rules 26(b)(4)(B) and (C) do not shield them. Build them to be produced: complete, contemporaneous, and legible to an adversary. The same holds for the scope decisions behind a mobile device extraction, where what was not collected is as much a cross-examination subject as what was.

Route counsel-supplied facts and assumptions through one identifiable channel. Exceptions (ii) and (iii) make the identification of attorney-provided facts and relied-upon assumptions discoverable. If those arrive scattered across months of email, the production is an email-by-email privilege fight. If they arrive as a dated assumptions memorandum and a transmittal index, the production is two documents. This is a documentation choice with a direct cost.

Put the expert protocol into the Rule 16(b) order. Rule 26(f)(3) requires the discovery plan to state the parties' views on what changes should be made in the timing, form, or requirement for Rule 26(a) disclosures, on any issues about disclosure, discovery, or preservation of electronically stored information, and on "any issues about claims of privilege or of protection as trial-preparation materials" — including, if the parties agree on a procedure to assert those claims after production, whether to ask the court to include their agreement in an order under Federal Rule of Evidence 502. Expert-materials handling belongs in that conversation, alongside the format questions that arise with collaboration platform data and the validation record behind technology-assisted review. Where the technical disputes are dense enough, a discovery special master may be a faster path than motion practice.

Calendar the timing and the supplementation. Absent a stipulation or court order, Rule 26(a)(2)(D) sets disclosure at least 90 days before the date set for trial or for the case to be ready for trial, with disclosures intended solely to contradict or rebut evidence on the same subject matter due within 30 days after the other party's disclosure — and the 2010 note confirms that rebuttal window applies to (a)(2)(C) disclosures as it does to (a)(2)(B) reports. Rule 26(a)(2)(E) requires supplementation under Rule 26(e). For a report witness, Rule 26(e)(2) extends the duty "both to information included in the report and to information given during the expert's deposition," with any additions or changes due by the time Rule 26(a)(3) pretrial disclosures are due — at least 30 days before trial unless the court orders otherwise. When a re-collection or a new artifact source surfaces late, the preservation posture and the supplementation deadline are the same conversation.

Remember the sequencing and the fee. Rule 26(b)(4)(A) permits deposing any person identified as an expert whose opinions may be presented at trial, but where Rule 26(a)(2)(B) requires a report, "the deposition may be conducted only after the report is provided." No equivalent sequencing protects an (a)(2)(C) witness. And under Rule 26(b)(4)(E), unless manifest injustice would result, the court must require the party seeking discovery to pay the expert a reasonable fee for time spent in responding to discovery under Rule 26(b)(4)(A) or (D).

Learn more

• Katherine Charonko — Partner and ESI Practice Group Leader, Bailey & Glasser
• Gail Gottehrer — VP, Global Litigation, Labor & Employment, and Government Relations, Fresh Del Monte Produce, Inc.
• David Shonka — Partner and General Counsel, Redgrave LLP; three-time Acting General Counsel of the FTC
• Claude M. Stern — JAMS neutral; chaired or co-chaired Quinn Emanuel's national IP litigation practice, 2003–2021
• Hon. Gregory M. Sleet — JAMS neutral; 20 years on the U.S. District Court for the District of Delaware, seven as chief judge
• Hon. James Orenstein — JAMS neutral; former U.S. Magistrate Judge, Eastern District of New York

This article is general information about federal procedure and is not legal advice; consult counsel about the requirements applicable to your matter and jurisdiction.