Before reusing consulting work for AI, identify who controls each part.

Start here

Does any of this sound familiar?

• An AI or data partner has asked about project files, reports, interview notes, or work papers.
• Your team uses firm methods alongside client-provided data and external research in the same deliverable.
• You need a defensible way to pause, exclude, or approve records before anything leaves the firm.

A firm may own valuable methods but have no right to reuse a client's information for another purpose. Ownership, retention, confidentiality, privacy, and permission to train a model are separate questions.

Review components, not just project folders. A rights map can preserve firm methods without treating possession as permission.

The problem

A signed engagement is not a universal reuse license

A market-entry recommendation may combine a firm-authored scoring framework, client forecasts, licensed research, and staff interviews. The firm may own its framework, the client control forecasts, a provider restrict research redistribution, and interviews carry confidentiality or privacy obligations. One deck does not erase those conditions.

A right to perform an engagement is not necessarily permission to develop a separate AI product. Contracts may assign deliverables, preserve methods, restrict disclosure, or limit retention; privacy and professional duties may add rules. A de-identified extract can remain identifiable or contractually restricted.

A file in the firm's system is evidence of access, not evidence of every right needed for reuse.

The solution

Build a rights ledger before reviewing candidate material

Map provenance and authority before copying any sample or considering a defined AI use.

DataSupply partners only with labs that meet its top 0.01% credibility standard. We help assess whether a qualified buyer may be a fit and negotiate terms that reflect the data's potential value, including exclusivity where relevant. We also help you work through diligence questions about rights, privacy, security, and compliance, then present a high-level inventory of permitted records, not the dataset. Fit is specific to each situation; no buyer or value is guaranteed.

What to inventory before any buyer conversation

• Break the work into components List contracts, deliverables, working papers, source datasets, interviews, and templates separately. Record creator, known owner or controller, retention rule, confidentiality, and location.
• Read the actual use and disclosure terms Check assignment, license, service purpose, confidentiality, publicity, subcontracting, deletion, and machine-learning or disclosure limits. Seek written client or licensor permission if authority is unclear; silence is not consent.
• Document a narrow approval or exclusion A named legal or privacy owner records approved material, purpose, recipients, safeguards, duration, and rationale. If approval is unavailable, exclude the source and consider a firm method description or synthetic task.

Set the boundaries before discussing access.

An NDA or pseudonym does not grant IP, privacy, trade-secret, or client-consent rights. Require least-privilege access, secure transfer, retention and deletion, breach notice, no onward transfer, and rules for outputs. Regulated records need specific legal and client authorization.

What could make a permitted example useful?

Clear rights can reduce review friction but do not guarantee demand or value. If clearance cost, exposure, or client duties outweigh potential benefit, exclude the material.

A practical first step.

Inventory one completed engagement by component without copying records. Ask counsel which terms govern secondary AI use.

datasupply.ai can discuss possible fit and buyer questions without receiving your dataset. You decide whether to pursue any introduction. No buyer, license, or payment is guaranteed.

Documented example / what it proves

Professional confidentiality duties are a real constraint

AICPA & CIMA says AICPA members must maintain client confidentiality and disclose conflicts and referral fees, among other duties. For an accounting consultancy, this underscores that client access is not unrestricted authority to repurpose records. Read AICPA & CIMA, Professional Responsibilities.

The guidance is not a universal rule for all consultants. Contracts, privacy and IP law, client instructions, and other codes need review. Trace authority before considering secondary use.

The important limit: This guidance describes professional duties, not a closed data-license deal or permission to reuse a client's work.