Consulting and recruiting

Client AI-use clauses in MSAs: what they mean for your records

By SourceX Editorial · Reviewed by Noah Loul · October 9, 2026

Short answer

Client contract AI restrictions in an MSA usually limit what a firm does with client data and deliverables, not with its own operating records. The catch is definitions: if Confidential Information covers everything about the engagement, time entries, status reports and staffing notes that mention the client can fall inside. Read the definitions first, then the AI clause.

Key takeaways

Most client AI clauses govern client data, client confidential information and deliverables, not the firm's internal processes.
Broad definitions can pull firm records that mention a client, such as time entry narratives and status reports, under a clause.
A no-training clause may be written to cover any model training by anyone, which would include a licensee of your records.
Survival and return-or-destroy terms decide whether restrictions continue after the engagement ends.
Clauses differ by client, so the review is an inventory across the client base, not a reading of one template.

What do client AI-use clauses usually say?#

Client AI-use clauses usually do one of four things: ban AI tools on the engagement, allow approved tools only, require disclosure of AI use, or prohibit using client data to train or improve any model. Many MSAs combine two or more, and some push the detail into a separate AI policy, security schedule or supplier code of conduct incorporated by reference.

The clauses were written mainly to stop client information from flowing into public AI tools during delivery. They were rarely drafted with a consulting firm's own back-office records in mind, which is why their effect on those records depends so heavily on the definitions they borrow.

How each clause type affects licensing your own records#

Each clause type reaches your own operational records differently, and only some reach them at all. Treat the third column as a prompt for questions rather than an answer: exact wording, carve-outs and the order of precedence between the MSA, each SOW and any incorporated policy decide the real effect.

Ownership clauses deserve a separate read. When a client owns all work product and derivatives, analyses, models and templates created during the engagement may belong to the client unless the MSA reserves the firm's pre-existing materials and general know-how. Without that reservation, even a sanitized version of an engagement model can be hard to license.

How each clause type affects licensing your own records
Common client clause	What it restricts	Effect on licensing your own operational records
No AI tools on the engagement	Use of AI tools while delivering the work	Usually indirect, unless worded as a restriction on all engagement information
Approved AI tools only	Which tools may process client information	Little direct effect, but signals the client expects control over AI processing
Disclosure of AI use	Using AI without telling the client	May require notice before records holding client information feed any AI use
No training on client data	Training or improving models with client data	Direct: records containing client data need removal, aggregation or consent
Client owns work product and derivatives	Firm reuse of outputs	Can reach analyses and templates built on the job; check pre-existing IP carve-outs
Return or destroy on termination	Keeping client materials afterward	Records that should have been returned or destroyed cannot be licensed

Which of your records can a client clause reach?#

A client clause reaches your records through its definitions. If Client Data means data the client provides, your internal staffing plan probably sits outside it. If Confidential Information means all information relating to the client or the engagement, a time entry that reads 'reviewed client's freight contracts with CFO' may sit inside it.

Records that describe only how the firm works, such as methodology guides, internal training material and playbooks written without client facts, usually sit outside client definitions. The practical work is separating the two, record family by record family.

Time entry narratives in the PSA or billing system that name the client, its people or its systems.
Status reports, steering committee notes and project review memos filed with the firm's own records.
Proposals and SOW drafts that restate the client's problem and internal context.
Staffing plans and resource requests that mention client sites, sponsors or deadlines.
Slack or Teams channels named after the client.
Lessons-learned write-ups and knowledge base articles drawn from specific engagements.

Does a no-training clause stop you licensing records for AI?#

A no-training clause generally stops you licensing records that contain the client's data, unless the client consents or the information is removed. Read the wording closely: some versions prohibit training by the firm's AI vendors, while others prohibit any use of client data to train, fine-tune or improve any model, by anyone.

Some clauses permit use of aggregated or de-identified data. Others are silent, and silence should not be read as permission. Where de-identified use is allowed, check how the contract defines it, because a client may expect more than removing its name, such as removing its industry, region and any distinctive event.

Survival, amendments and the time dimension#

Survival terms decide whether AI restrictions outlive the engagement. Confidentiality obligations commonly survive termination, and AI terms written into the confidentiality section may survive with them. AI terms placed in a delivery schedule may end with the SOW.

Older contracts need a second look. An MSA signed before a client adopted AI terms may since have been changed by an addendum, a renewal or an updated supplier policy incorporated as amended from time to time. Pull the current paper, not the copy in the original deal folder.

Return-or-destroy terms add a factual question: what actually happened at the end of each engagement. If the firm certified destruction but copies survive in email, chat exports or a partner's laptop, those copies are a compliance problem to fix, not records to license.

How to build a clause inventory across your client base#

A clause inventory turns dozens of separate contracts into a decision you can act on. Often a small group of strict clients drives most exclusions, and their records can be carved out while the rest of the archive moves forward.

List active and past clients whose information appears in the records you might use.
Pull the governing MSA, every SOW, amendments and any incorporated AI or security policy.
Record the definitions of Client Data, Confidential Information and Deliverables for each.
Tag each AI term by type: no tools, approved tools, disclosure, no training, ownership, return or destroy.
Note carve-outs for aggregated, de-identified or general know-how use.
Mark survival terms and whether each engagement has ended.
Sort clients into four groups: proceed, remove client information first, ask for consent, or exclude.

Illustrative: a procurement consultancy sorts its client paper#

Illustrative: a fictional procurement consulting firm wants to license its internal sourcing playbooks, proposal archive and project review memos. Its clients include manufacturers, distributors and a national specialty retailer, each on its own paper.

The inventory shows that most MSAs restrict only client data and deliverables. Two clients define Confidential Information as anything relating to the engagement and add a no-training clause with no de-identification carve-out. The firm excludes every record tied to those two clients, removes client names and identifying facts from the remaining review memos, and keeps playbooks that were written without client material. Counsel signs off on the grouping before any preparation begins.

How SourceX handles client clauses#

SourceX reviews client clauses during the Rights step of the SourceX five-step transaction, after the firm has described its records and before any preparation work. The review maps each record family to the contracts that touch it and flags what needs removal, aggregation, consent or exclusion.

The outcome is recorded in the SourceX Evidence Packet under licensing rights and permitted use, so a buyer can see which client restrictions were checked and how each was handled. The firm decides what goes forward, and its counsel confirms the reading of each contract.

Frequently asked questions

Should we ask clients for consent to use their information?

Sometimes. Consent can open records a clause would otherwise block, but asking draws attention and can affect the relationship. Many firms first remove client information and use only records outside the clause, then approach a few supportive clients whose records add something specific.

Do client AI clauses cover our employees' information?

Usually not. Client clauses protect the client's information. Employee data in timesheets and staffing plans falls under what your firm told its staff, its own HR policies and any employment or privacy rules that may apply, so it gets a separate review.

What if a client's AI policy changed after we signed?

Check whether the MSA incorporates the policy as of signing or as updated from time to time. A policy incorporated with update rights can change your obligations without a new signature, so the current version may control.

Can we negotiate carve-outs in future MSAs?

Often. Firms can propose carve-outs for general know-how and for aggregated or de-identified operational learnings. Clients are more likely to accept them when the definition is tight and their name, data and identifying details stay out.

Which wins when the MSA and a SOW disagree?

Look for the order-of-precedence clause, which settles conflicts between documents. Some MSAs let a SOW change terms only when it says so explicitly; others give the latest SOW priority. Record the rule for each client in your inventory, since it changes which AI term actually binds.

Related resources

See if your company qualifies

A short company assessment. No data uploads are needed.

Map your records against client terms Talk to SourceX