Resources

A package arrives at your office. It’s addressed to the company, formal and official-looking, bearing the seal of a state attorney general (AG). Inside is a Civil Investigative Demand: a multi-page legal document requiring your company to produce thousands of documents, answer written questions, and potentially provide live testimony before AG attorneys. You have thirty days to respond.

Most executives have never seen one. The instinct, understandable but dangerous, is to treat it like an aggressive document request. Hand it to whoever handled the last vendor dispute, pull the responsive files, and send them over. Move on.

That instinct is wrong. And it’s expensive.

I spent years issuing CIDs from the other side of this equation, leading consumer financial services enforcement for a state attorney general’s office. I directed investigations, issued demands, and watched how companies responded. Now I defend companies facing those same investigations. What I know from both sides is this: how a company handles the first thirty days of a CID investigation often determines whether the matter ends quietly or becomes a public enforcement action.

What a CID Actually Is

A Civil Investigative Demand is a pre-lawsuit investigative tool that state attorneys general and the FTC use to compel document production, written responses, and testimony without filing a lawsuit first. Unlike a federal grand jury subpoena, there is no judge involved, no docket number, and no public record. The AG issues it unilaterally under state consumer protection law.

That means the AG does not have to tell you what they are investigating, who else has received a demand, or where the investigation is headed. You may be a primary target. You may be a third party whose records touch someone else’s conduct. You may be somewhere in between. The CID itself rarely tells you which.

Receiving a CID does not mean you are a target. But it means you should act like one.

What Most Businesses Get Wrong

In my experience, companies make the same mistakes, and they almost always stem from underestimating what a CID represents.

Treating it like a routine document request.

A CID is not a discovery subpoena in pending litigation. It is an investigative tool being used by a law enforcement office that has not yet decided what it thinks of your company. The documents you produce will shape that decision.

Responding too broadly.

Companies that produce everything potentially responsive, hoping to appear cooperative, often answer questions the AG hasn’t asked yet and open entirely new lines of inquiry. Scope control is one of the most valuable things experienced AG counsel provides.

Responding too narrowly or too slowly.

The opposite error is equally damaging. A response that appears evasive, incomplete, or delayed tells the AG’s office something about your company’s posture, and that posture affects every decision they make from that point forward.

Involving the wrong lawyer.

Handing a CID to outside litigation counsel who has never negotiated with an AG’s office is a common and costly mistake. Enforcement investigations do not follow litigation rules. The relationships, the leverage points, and the decision-making dynamics are all different. Skill in the courtroom does not transfer automatically to the AG’s conference room.

Failing to implement a litigation hold.

From the moment a CID arrives, your company has a legal obligation to preserve potentially relevant documents and communications. Spoliation, even inadvertent, can transform a manageable investigation into an existential one.

Letting employees talk.

AG investigators sometimes reach out informally: a phone call, an email, a seemingly routine question. Employees who respond without counsel, thinking they are being helpful, can inadvertently provide statements that define the AG’s theory of the case.

“The documents you produce will shape what the AG thinks of your company. Scope control is one of the most valuable things experienced AG counsel provides.”

What the AG Is Actually Doing

Here is what most companies, and many lawyers, do not fully appreciate: CIDs are often issued early in an investigation, sometimes before the AG has a clear theory of liability. They are a fishing expedition conducted with the full weight of state law behind them.

They are also frequently coordinated. Multistate CIDs are common in consumer protection, financial services, and technology matters. One state typically leads; others join. The response your company provides to the lead state goes to every participating office. A production strategy that makes sense in isolation may look very different when you account for how it will be read in a dozen state capitals simultaneously.

What the AG is watching at this stage is not just what you produce. It is how you behave. Cooperation posture, response timing, and the tone of counsel interactions are all noticed and remembered. The goal at the CID stage is to control the narrative, demonstrate good faith without waiving privilege or expanding scope, and avoid giving the investigation the thread that unravels into a full enforcement action.

The First 72 Hours

If your company receives a CID, these are the steps that matter most immediately:

1. Do not respond to or acknowledge the demand to anyone outside the company without counsel.
2. Implement a litigation hold immediately: preserve all potentially relevant documents, communications, and data.
3. Get AG defense counsel on the phone: not general outside litigation counsel, and not tomorrow.
4. Begin a quiet internal assessment: what products, practices, or business lines might be at issue?
5. Do not contact the AG’s office directly, even to acknowledge receipt.

Why the Right Counsel Changes the Outcome

I represented a technology company operating in a heavily regulated space that received a CID requiring the production of thousands of documents and live testimony before AG attorneys, a demand that, handled poorly, could have become the foundation of a public enforcement action with significant financial and reputational consequences.

Because of my background working inside an AG’s office, I understood not just the legal mechanics of the response, but the investigative logic behind the demand: what the office was likely looking for, where the real exposure was, and where it wasn’t. I managed the document production to be complete and defensible while controlling scope. I leveraged my knowledge of AG office dynamics and my professional relationships to engage the investigation in a way that built credibility rather than friction.

The matter resolved with a confidential settlement. No enforcement action was filed. No press release. No public record.

That outcome is not guaranteed in every matter. But it is far more likely when experienced AG defense counsel is involved from the beginning, before positions harden, before the investigation expands, and before a company’s response has already shaped the AG’s theory of the case.

AG investigations are not litigation. The rules are different, the relationships matter differently, and the window for shaping outcomes closes faster than most executives realize. If your company receives a CID, the most important call you make is the first one, and it should be to a lawyer who has sat on both sides of that table.

About the Author

Travis Brown is a Partner at Brennan, Manna & Diamond, P.A. and Chair of the firm’s Government Investigations and Regulatory Enforcement practice group. Before entering private practice, he led consumer financial services enforcement for a state attorney general’s office, directing investigations in fintech, data privacy, and consumer protection matters. He now defends companies and executives facing state and multistate AG investigations, civil investigative demands, and regulatory enforcement actions.

If your company has received a CID or you believe one may be on the horizon, contact Partner Travis Brown at btbrown@bmdpl.com.