Engineering and architecture

Do you need client consent to license de-identified RFIs and submittals?

By SourceX Editorial · Reviewed by Noah Loul · October 9, 2026

Short answer

Whether you need client consent to license de-identified RFIs and submittals depends on the contract's wording. If it prohibits use beyond the project, ask or exclude. If it has a de-identified data carve-out, work within its conditions. If it is silent, counsel decides whether de-identification satisfies confidentiality, and asking is often the better relationship choice anyway.

Key takeaways

De-identification reduces what a client could object to, but it does not override an express use restriction.
A silent contract is not permission; confidentiality terms and the purpose of the engagement still apply.
RFIs and submittals carry contractor, consultant and manufacturer content that the owner's consent does not cover.
Consent requests work best in writing, scoped to named projects and record types, with an easy way to say no.

The answer turns on three kinds of contract wording#

Client consent to license de-identified RFIs and submittals turns on whether the owner agreement prohibits use beyond the project, permits de-identified use, or says nothing about other uses. Find the governing language in the executed agreement, including amendments and any separate NDA, before deciding anything.

The rule below organizes the question; it is not a legal conclusion. Contracts, governing law and client relationships differ, so counsel should confirm the outcome for each project or group of similar projects.

Start by finding which document governs. Many firms work under a master agreement with task orders, and confidentiality or ownership terms in a later task order can override the master for that one project.

Decision rule by contract wording#

The decision rule sorts each project by the clause that governs other uses of project information. Ownership alone rarely settles consent: the question is whether de-identified records would still disclose what the confidentiality clause protects.

The silent row is the most common and the least comfortable. Counsel will usually ask what the confidentiality clause defines as confidential, whether de-identified records still disclose that information, and whether the client could reasonably expect project records to stay inside the firm. The answers often differ between a routine tenant fit-out and a corporate headquarters.

Decision rule by contract wording
Contract wording	What it usually means	Next step
Prohibits use of project information beyond the project, or requires consent for any other use	Licensing likely needs the client's written permission	Ask for consent or exclude the project
Permits de-identified or aggregated use	Use may be allowed within the carve-out's conditions	Meet the conditions exactly and document how records were de-identified
Assigns all documents and data to the client	The client may control the records themselves	Treat as client-owned; ask or exclude
Standard confidentiality only, silent on other use	Depends on whether de-identified records still reveal confidential information	Counsel review; consider asking even if not required
Client AI clause bars use for model training	Licensing for AI development likely falls inside the restriction	Exclude unless the clause is amended

What de-identification removes, and what it leaves#

De-identification removes names and direct identifiers from RFIs and submittals, but it does not always remove what makes a project recognizable. That gap is why de-identification helps with a silent contract and cannot rescue a prohibiting one.

Many firms keep the question, the response and the review action and drop the attachments. That keeps the design reasoning, which is the part with the most value for AI development, and leaves most third-party material behind.

Usually removable: project name and number, owner, tenant and contractor names, people's names, emails, phone numbers and street addresses.
Harder to remove: references to a unique structure, a landmark site, a named tenant's fit-out or an unusual system that identifies the building.
Belongs to others: manufacturer product data, contractor shop drawings and subconsultant details attached to submittals.
Often lower risk: the question text, the design response, the review action and the stated reason, once identifiers are gone.

When to ask even if the contract allows it#

Asking is sometimes the better choice even where counsel concludes consent is not strictly required. Design firms live on repeat clients and referrals, so relationship risk deserves its own line in the decision.

The reverse also applies. A client who would plainly agree, such as a long-standing developer whose own staff already discuss AI tools on project calls, offers a quick consent that turns a gray-area project into a clean one.

The client is a repeat or strategic relationship with active work in the office.
The project is prominent enough that details could identify it after de-identification.
The client has asked about AI use on its projects or has sent the firm an AI policy.
The client's sector treats facility information as sensitive, such as life sciences, banking or technology campuses.
The wording is ambiguous and a dispute would cost more than the project adds to the package.

A consent request works best when it is short, specific and easy to decline. Send it from the principal who holds the relationship, using wording counsel has approved, and make sure it covers the points listed below.

Keep the request to one page. A long request reads like a negotiation and invites the client's counsel to rewrite it, while a short, specific note signed by the principal usually gets a direct answer.

The projects and record types covered, such as RFI questions and responses and submittal review comments.
What will be removed: names, addresses, contact details, project identifiers and attachments.
The permitted use in plain terms, and a statement that the client's name will not be disclosed.
Confirmation that drawings, specifications and client-furnished information are not included.
A request for a written yes or no, and a note that declining will not affect the relationship.

Illustrative: an architecture firm asks four repeat clients#

Illustrative: a fictional architecture firm wants to license de-identified RFI responses and submittal review comments from its Procore history. Counsel finds that four repeat clients signed agreements with standard confidentiality and nothing about other uses, so the managing principal decides to ask all four rather than rely on a silent contract.

Each client receives a one-page request naming its projects, the two record types, what will be removed and the permitted use. The first client agrees. The second agrees on condition that its headquarters project is left out and no sector detail identifies it. The third declines, and its projects are removed. The fourth never replies after a reminder, and the firm treats silence as a no.

Every reply, including the reminder to the fourth client, goes into the contract file. The package ends up smaller than planned, but every included project has a written basis, and no client learns about the license secondhand.

How SourceX keeps the supplier in control#

SourceX keeps supplier approval at every step of the SourceX five-step transaction, from Supply through Delivery. Which clients to ask, and whether to proceed when one declines, are the firm's decisions; SourceX records them alongside the rights review.

The opening fit check works from descriptions of systems and record types, with no files exchanged. Nothing is delivered until the firm signs the release authorization recorded in the SourceX Evidence Packet, which also lists the projects excluded and the consents received.

Frequently asked questions

Does the owner's consent cover the contractor's content in an RFI?

Not necessarily. RFIs are often written by the general contractor or a subcontractor, and submittals include their shop drawings and supplier data. The owner can consent only to what it controls. Many firms license their own responses and review comments and remove or summarize the third-party content.

Can we rely on a confidentiality clause that has expired?

Some confidentiality obligations end after a stated period and others survive indefinitely. Counsel should read the survival language and any separate NDA. An expired clause may remove a legal restriction, but the relationship question about asking a repeat client remains.

Do de-identified records still count as the client's confidential information?

They can. Confidential information is defined by the contract, and if de-identified records still reveal design details the client treated as confidential, the obligation may still apply. That is why counsel looks at the content of the records, not only at whether names were removed.

Do subconsultants need to consent too?

Only if their work is in the package. A structural or MEP consultant's sketches, calculations or written responses attached to an RFI fall under the subconsultant agreement, not the owner agreement. The simplest route is to license only the responses your own staff wrote and drop consultant attachments; if their content is essential, ask the consultant in writing, as you would the client.

What if a client says no after records were prepared?

Remove that client's projects before delivery and record the refusal. Preparing records does not commit the firm to licensing them, and the release authorization is signed only after the final scope is settled. If the client asked to be told, confirm in writing that its projects were removed.

Can one consent cover all of a client's projects?

Yes, if the request names the projects or defines them clearly, such as all completed projects under a master agreement. A blanket consent is efficient for repeat clients, but it should still list the record types and exclusions, and it should let the client withdraw it for future projects.

Related resources

See if your company qualifies

A short company assessment. No data uploads are needed.

Start a metadata-only fit check Talk to SourceX