Can consulting firms reuse anonymized client work? Engagement letter clauses

What may a consulting firm reuse without asking?#

A consulting firm may generally reuse its own know-how, methods, tools and templates without asking clients, because many engagement letters and MSAs reserve those as the firm's pre-existing or general materials. What a firm cannot freely reuse is client confidential information and deliverables the client owns, and a letter that is silent on consultant materials needs a closer reading.

The line runs through the middle of most project folders. A workshop design and the interview guide behind it are usually the firm's; the client's cost data, the findings about that client and the final report are usually not. Internal records such as proposals, resource plans, project reviews and lessons learned are the firm's own, though they often quote client facts that are confidential.

Licensing to an AI developer is a step beyond reuse inside the firm. Even where a letter lets the firm improve its services with engagement learnings, handing records to an outside party for model training is a separate use that the letter has to permit.

Clauses that already govern reuse#

Before drafting anything new, a managing partner should know what the firm's existing letters say. The clauses below usually decide the answer, and they often pull in different directions.

A sample benchmarking and aggregated insights clause#

Sample wording, for discussion with counsel and not for use as drafted: Firm may create De-identified Engagement Data from information obtained in performing the Services by removing the identity of Client, its personnel, customers and suppliers, and any other information from which Client could reasonably be identified. Firm may use De-identified Engagement Data, alone or combined with data from other engagements, to develop benchmarks, methods and analytical tools, and to license it to third parties for developing, training and evaluating software and AI models, provided that the recipient is bound by confidentiality, is prohibited from attempting to identify Client or any individual, and receives no Client Confidential Information in identifiable form.

Three features make this wording more useful than a typical benchmarking clause. It names third-party licensing and AI training expressly, it defines de-identification by reference to whether the client could reasonably be identified, and it requires downstream contract terms rather than trusting the recipient.

Clients may push back on the licensing sentence. A firm that cannot get it can still keep the internal benchmarking rights and rely on its own records for any licensing.

Limits that apply even with the clause#

A well-drafted clause does not cure every problem in a client file. These limits usually survive any benchmarking language and should be built into the review.

• 1Distinctive facts: a client that is the only regional port operator or the only maker of a niche product can be recognized from the story alone.
• 2Third-party material in client files: vendor contracts, licensed market data and other companies' documents the client shared.
• 3Personal data: interview notes, employee rosters and survey responses usually fall under the client's data protection terms.
• 4Client-specific prohibitions: some clients, often in regulated industries, ban any reuse regardless of de-identification.
• 5Order of precedence: a later SOW or the client's own MSA terms can override the firm's standard engagement letter.
• 6Retention: anything that should have been returned or destroyed at the end of the engagement is out of scope.

Legacy engagements versus new letters#

Legacy engagements are governed by the letters signed when the work was done, so a new benchmarking clause helps only with future work. Firms usually sort past engagements into a few groups and choose a route for each.

A consent request works best when it is specific. Name the record types, describe how client identity and identifying facts will be removed, state that the recipient is contractually barred from re-identification, and offer the client a chance to exclude particular matters. A vague request to use engagement data for AI tends to draw a refusal that then covers everything.

Illustrative: a supply chain consultancy sorts its engagements#

Illustrative: a fictional procurement and supply chain consultancy keeps engagement files in Box, proposals and pipeline history in Salesforce, and staffing and utilization records in Kantata. Before any buyer conversation, the managing partner asks counsel which of those records the firm can stand behind on its own.

Counsel reads a sample of letters from each era of the firm's history. The oldest letters contain only confidentiality and deliverable ownership terms; letters from recent years include a benchmarking clause limited to internal service improvement; two large clients signed their own MSAs that ban any reuse. No letter mentions third-party licensing or AI training.

The firm proceeds with proposals, staffing plans, internal project reviews and sourcing playbooks, with client names and identifying facts removed, and excludes everything tied to the two client MSAs. Client deliverables stay out. The firm adopts the broader clause for new engagements and asks a few long-standing clients for consent to include de-identified project review notes from their work.

How SourceX approaches consulting archives#

Engagement letters drive how SourceX reviews a consulting archive. Each record family is linked to the clause that permits its use, and records with no clear basis wait for client consent or stay out. The managing partner makes those calls at each stage of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery.

After client identities and identifying facts are removed, the SourceX Evidence Packet gives the firm an engagement-by-engagement account of what was licensed and why. That is the document a client will want to see if it ever asks how its work was handled.