Consulting and recruiting
AI clauses in consulting MSAs and engagement letters: what to add in 2026
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
An AI clause in a consulting contract should settle whether the firm may use AI tools on client work, which client data may enter them, that client material will not train outside models, who owns AI-assisted deliverables and whether de-identified learnings may be reused. Put the framework in the MSA and project-specific limits in each SOW.
Key takeaways
- Older MSAs are silent on AI, and silence invites disputes because confidentiality clauses predate generative tools.
- Keep durable AI terms in the MSA and project-specific restrictions, such as banned uses, in the SOW or engagement letter.
- Separate three uses clients view differently: AI tools on client inputs, training firm models on engagement material, and reuse of aggregated learnings.
- Ownership clauses for AI-assisted deliverables should assign whatever rights exist rather than rely on copyright alone.
- Log every client-specific AI restriction on the engagement record so later knowledge reuse or licensing respects it.
Why consulting contracts need AI clauses now#
Consulting contracts need AI clauses because most MSAs and engagement letters in use today were drafted before consultants routinely used generative tools for drafting, analysis and research. A clause that limits client information to use solely for performing the services may or may not cover pasting an interview transcript into an AI assistant, and neither side wants to argue that point after a deliverable ships.
Client procurement teams have noticed. Security questionnaires and vendor onboarding forms now ask which AI tools the firm uses, where prompts are stored and whether client material can train a vendor's model. A firm with a clear clause and a short policy answers once; a firm without one negotiates the same questions on every engagement.
Which AI clauses belong in a consulting MSA?#
A consulting MSA needs a compact set of AI terms that sit alongside confidentiality, IP and data protection rather than in a separate addendum nobody reads. The sample wording below is neutral and illustrative only; counsel should adapt it to your paper, your clients and the law that governs the agreement.
| Clause | What it settles | Neutral sample wording |
|---|---|---|
| AI tool disclosure | Whether the firm tells the client it uses AI tools | Consultant may use AI-enabled software tools to assist in performing the Services and will describe its use of such tools on request. |
| Client data in AI tools | Which client information may be entered, under what controls | Consultant will enter Client Confidential Information only into tools operated under terms that maintain its confidentiality and limit access to authorized personnel. |
| No training | Whether client material may train third-party or firm models | Consultant will not use Client Confidential Information to train or fine-tune any AI model made available to third parties without Client's prior written consent. |
| Output ownership | Who owns AI-assisted deliverables | Deliverables are assigned to Client on payment, whether or not prepared with software tools, subject to Consultant's Pre-Existing Materials. |
| Know-how carve-out | What the firm keeps | Consultant retains its methodologies, templates, tools and general know-how, including improvements that contain no Client Confidential Information. |
| Human review | Accountability for accuracy | Consultant remains responsible for the Deliverables and will review AI-assisted output before delivery. |
| Aggregated data | Whether learnings can be reused across clients | Consultant may use information aggregated with other sources and de-identified so that neither Client nor any individual can reasonably be identified. |
| Flow-down | Subcontractors and tool providers | Consultant will require subcontractors that process Client Confidential Information to meet obligations no less protective than these. |
MSA or engagement letter: where should each AI term live?#
The MSA should hold AI terms that apply to every engagement, while the SOW or engagement letter should hold anything that changes from project to project. That split keeps master terms stable and lets a cautious client tighten one engagement without reopening the whole agreement.
| Term | Put it in the MSA | Put it in the SOW or engagement letter |
|---|---|---|
| Confidentiality and data use | Default rules for AI tools and client information | Extra limits for sensitive work, such as no AI tools on board materials |
| No-training commitment | Firm-wide default | Any client consent to train an internal model on that project |
| Named tools | Rarely, because tools change faster than contracts | Approved tools for that engagement, if the client asks |
| Ownership and know-how | Assignment rules and retained materials | Deliverables list and any jointly developed tools |
| Aggregated data | Permission and its conditions | Client-specific opt-out or notice requirements |
How to draft the client data and no-training terms#
The client data and no-training terms work best when they separate three uses that clients treat very differently. Running an enterprise AI tool on client inputs to draft a deliverable is common and often acceptable with controls. Training a model the firm controls on engagement material is a larger ask. Reusing aggregated, de-identified learnings sits in between and depends on explicit wording.
Check the AI vendor's own terms before promising anything. Enterprise plans of many AI tools commit not to train on customer content and offer retention controls, while consumer versions may not, so the contract promise should match the tier your consultants actually use. Personal accounts are the usual gap: GitHub's Copilot documentation, for example, states that from April 24, 2026 interactions on individual Copilot plans may be used to train AI models unless the user turns that setting off. A consultant using a personal plan on client work can quietly break a firm-wide no-training promise. Write the clause around controls you can show: approved tools, access limits and a written policy.
Avoid drafting a no-training promise so broadly that it captures ordinary improvement. A clause forbidding any use of client information to improve the firm's services could arguably reach a consultant refining a template after a project. Define training narrowly, as using client material to train or fine-tune a model, and keep firm know-how carved out.
Who owns AI-assisted deliverables and the firm's know-how?#
Ownership of AI-assisted deliverables should follow the same structure as any other deliverable: the client receives the deliverables on payment, and the firm keeps its pre-existing materials, methods and general know-how. What changes is the reliance on copyright. Copyright protection for material generated mostly by AI, without meaningful human authorship, may be limited or uncertain, so the clause should assign whatever rights exist and lean on confidentiality for the rest.
The know-how carve-out matters more than it used to. Firms increasingly turn templates, interview guides and project review notes into internal knowledge tools, and a client who believes every improvement belongs to them will object. State plainly that firm methodologies, and improvements that contain no client confidential information, remain the firm's.
A checklist before your next MSA redline#
A short internal checklist before redlining keeps the firm's position consistent across partners and clients, and stops promises made in proposals from contradicting the paper.
- Inventory the AI tools consultants actually use, including browser extensions and meeting transcription.
- Read each tool's enterprise terms on training, retention and subprocessors, and note which tier you pay for.
- Set a default position for each clause and one fallback partners may accept without legal review.
- Decide which client changes need escalation, such as a total ban on AI tools or a broad license back to the client.
- Add a field to the engagement record in your CRM or project system for AI restrictions and aggregated data permissions.
- Train partners and engagement managers on the policy before the next proposal season.
- Review the clause set on a regular schedule as tools and client expectations change.
Illustrative: an operations consultancy standardizes its AI terms#
Illustrative: a fictional operations consulting firm received AI questionnaires from several manufacturing clients in the same quarter, each asking slightly different questions. Its MSA said nothing about AI, and partners were answering by email with inconsistent promises.
The general counsel drafted a default set: disclosure on request, no training of third-party models, assignment of deliverables with a know-how carve-out, and an aggregated data clause with notice. One client struck the aggregated data clause, which the firm accepted as a pre-approved fallback. The restriction was logged on that client's account in the firm's CRM, so its engagement files were excluded automatically when the firm later built an internal knowledge library and reviewed records for possible licensing.
How SourceX reads AI clauses in a licensing review#
SourceX reads AI and data use clauses during the Rights step of the SourceX five-step transaction, engagement by engagement, before any record is prepared for licensing. Client deliverables and engagements whose contracts prohibit the intended use are carved out, and firm-owned material such as methodologies and internal project reviews is assessed on its own.
The outcome is written into the SourceX Evidence Packet under licensing rights and permitted use, so the firm, its counsel and any licensee can see which contracts were checked and why each set of records was included or excluded.
Frequently asked questions
Do we need client consent to use AI tools at all?
Not always; it depends on your contract wording and the client's expectations. A confidentiality clause limiting use to performing the services may permit tool use under strong controls, while some client paper bans third-party processing outright. Where the answer is unclear, disclosure and written consent are the safer route, so review the language with counsel.
Should the contract name the specific AI tools we use?
Usually not in the MSA, because tools change faster than master agreements. A better pattern is a commitment to use only tools that meet stated controls, with a list of approved tools provided on request or attached to a SOW when a client insists.
What if a client's paper bans all AI use?
Decide in advance whether a ban is acceptable for that engagement and how the team will comply in practice, including meeting transcription and drafting aids. If you accept it, record the ban on the engagement record so staff see it, and price any extra manual effort into the SOW.
Do AI clauses need to flow down to subcontractors?
In most cases, yes. Independent consultants and specialist subcontractors often bring their own tools, so the firm's promises are only as strong as their compliance. Flow the same confidentiality, no-training and data-handling terms into subcontractor agreements and ask which tools they use.
Can we add AI terms to an MSA that is mid-term?
You can propose an amendment or a short side letter, and many clients welcome the clarity. Some firms add the terms when the next SOW is signed, stating that its AI provisions apply to that engagement. Avoid unilateral changes by notice unless the MSA expressly allows them.
Sources
- GitHub's Copilot documentation states that starting April 24, 2026, interactions on individual Copilot plans (Free, Pro, Pro+ and Max) may be used to train and improve AI models, and users can turn this off. Source
Related resources
- QuestionIs selling company data legal?
- QuestionShould companies sell or license their data?
- InsightIs it safe to license company data for AI training?
- InsightHow do I de-identify contracts and legal documents for AI training?
- InsightHow do I de-identify legal briefs and memos for AI training?
- IndustryBPO & contact centers data
See if your company qualifies
A short company assessment. No data uploads are needed.