Can law firms and accounting firms license their records?

ABA Model Rule 1.6(a) bars a lawyer from revealing information relating to the representation unless the client gives informed consent, the disclosure is impliedly authorized to carry out the representation, or an exception applies. Licensing to an AI buyer carries out no one's representation, so for client material, consent is the route. The comments to the rule say the duty covers that information whatever its source, and that a hypothetical is acceptable only when there's no reasonable likelihood the listener could identify the client or the situation. Whether de-identified material meets that standard is for your ethics counsel to judge, not a redaction script.

ABA Formal Opinion 512 (July 2024) says informed consent is needed before client information goes into a self-learning AI tool, and that general boilerplate in an engagement letter isn't enough. It addresses using AI tools, not licensing records, but licensing to train someone else's models is a more direct disclosure, so we treat that standard as the minimum.

Using it is restricted too: Rule 1.8(b) bars using information relating to a representation to the client's disadvantage without informed consent. Closed matters aren't exempt: Rule 1.9(c) carries both the use and the disclosure limits over to former clients. State versions of these rules vary, and some are stricter. We aren't aware of any bar opinion that approves licensing client files for AI training.

A company's own legal department is different. The organization is the client (Model Rule 1.13(a)), so the company can decide to license its legal team's records once privilege, counterparty confidentiality and deal information are handled.

AICPA Code 1.700.001 says a member in public practice shall not disclose confidential client information without the client's specific consent. Interpretation 1.700.060 covers uses where the client isn't named, such as benchmarking: the consent should preferably be written and state the nature of the information, the type of third party and the intended use. Firm-authored methodology with no client information falls outside the rule, and members may share expertise from past client work when no client is identifiable. The Code binds CPA members, and state accountancy laws bind licensees.

Income tax return information is a harder line. Section 7216 of the Internal Revenue Code makes it a crime for anyone in the business of preparing returns, or providing services in connection with them, to knowingly or recklessly disclose information furnished for a return, or use it for anything other than preparing returns, unless an exception applies. The regulations:

• Count statistical compilations as tax return information even when no taxpayer can be identified.
• Bar a preparer from selling or exchanging such a compilation for value, except when selling the practice.
• Treat people who develop tax software, and authorized e-file providers, as preparers.
• Require disclosures outside narrow listed exceptions to rest on the taxpayer's signed consent, given in advance and naming the recipient.

We don't license income tax return information at all, with or without consent. That includes workpapers, review notes and job records from tax engagements, named or not.

From easiest to hardest:

1. Firm-authored know-how with no client information in it.
2. A company's in-house legal or finance department records, licensed by the company itself.
3. Work product from clients who give specific, written consent for this use, matter by matter, de-identified inside the firm before anything leaves it.

Time and billing narratives describe client work, so they need the same consent, and removing names may not be enough to protect the client. Whether de-identified material meets the professional standard is for your ethics counsel to judge; it doesn't replace the client's consent.

Out regardless: income tax return information, privileged communications on open matters, anything under a protective order or seal, and client-supplied books that the client hasn't licensed itself.

• Nothing drawn from client files comes to us before the client's documented consent. Until then we work only from counts and metadata you give us at intake. Keep client names and facts out of your free-text answers.
• The intake asks whether client-confidential material is in your systems and whether you have consent, and asks accounting firms, tax-software companies and financial advisers about income tax return information. Gaps are flagged before anything goes to market.
• Where consent is needed, it would be collected before anything drawn from a client's files leaves the firm, name the type of buyer and the use, and be opt-in, never a condition of the engagement. De-identification happens inside the firm.
• We don't take custody of raw records, so client material doesn't pass through us.

Your ethics counsel, and for CPA firms your state board's rules, decide what's in scope. This isn't legal advice. More on legal and accounting records.