Licensing law firm data to AI: what a UK firm can and cannot offer

Written for managing partners, COLPs and practice managers. This page explains the rules in plain terms; it is not legal advice. Take advice from your own regulatory solicitor before licensing anything.

Why do AI buyers want legal work?

Because legal work is expert reasoning written down. AI developers want examples of how professionals draft, review, negotiate and decide, and buyers place legal among their first targets.

• Mercor lists Legal first among its target industries, naming "Contracts, case files, discovery docs"⁹. In England and Wales the litigation term is disclosure, and most of what that list describes is client material, as the next section explains.
• Scale AI lists "Law Firms" and "Legal & Compliance" among its industries of interest, with 40 or more employees as its preferred starting point¹⁰. micro1 asks for 30 or more full-time staff in every industry¹⁵.
• Mode's homepage sets a floor of six or more employees for legal, against 30 or more for most businesses¹¹. Its referral programme looks for ten or more legal staff and lists the United Kingdom among eligible countries¹².
• Surge AI builds "reinforcement-learning gyms" in which AI agents practise tasks such as drafting appellate briefs¹⁴.

Buyers also recognise the limit. Polyshares says its licence "does not cover what you hold on behalf of your own clients"¹³. Demand for legal work is real, but most of the material buyers prize is not the firm's to license.

What does SRA Code 6.3 mean for licensing?

It means client information is off limits unless the law permits its use or the client consents. Paragraph 6.3 reads: "You keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents"¹. The Code of Conduct for Firms imposes the same duty on the firm itself².

The SRA's guidance makes the duty wider than not passing documents on. It calls the duty "unqualified" and says it is "a wider duty not to misuse it, ie, without the consent of a client or former client to make any use of it or to cause any use to be made of it by others otherwise than for the client's benefit"³. It applies to information about a client's affairs "irrespective of the source", and it continues after the retainer ends³.

Four consequences for a licence:

1. Licensing client information is a use for the firm's benefit, not the client's. Without consent, it falls within what the guidance describes as misuse³.
2. Closed matters are covered. The duty extends to former clients^1,3, so an archive of old files is no freer than live ones.
3. Removing names may not be enough. A matter can often be recognised from its facts, and the SRA's wording is about use, not only disclosure. Treat de-identified client material as needing consent unless your own solicitor advises otherwise.
4. Owning a document is not the same as being free to use what it says. The Law Society's practice note on file ownership, as quoted by the High Court in Hanley, says documents prepared for the firm's own benefit or protection, such as file copies of letters to the client, generally belong to the firm, subject to any contract^4,5. The information in them is still the client's confidential information³.

What might a firm license without client consent?

Material that is genuinely the firm's own and says nothing about any client: precedents and templates it wrote, internal procedures, training material and the running of the practice. Every item below needs confirming by the firm's own solicitor.

Whatever is licensed must also have personal data removed. Anonymising is itself processing under UK GDPR¹⁷, and our anonymisation standard explains how we approach it. We prefer removal before records leave the firm's systems; where a buyer removes personal data after transfer, we tell you in writing first and your own solicitor confirms the transfer route. Staff email and chat raise their own questions, covered in licensing Slack, Teams and email archives.

When could client consent make client material available?

Consent can lift the confidentiality bar for that client's own information, but it cannot lift every restriction in a file. It works best when a sophisticated client agrees in writing to license a defined set of its own documents.

What good consent looks like. It names the documents, the buyer or type of buyer, the purpose (AI training and evaluation), how personal data will be removed, the licence terms and the money. It is fresh and in writing, not a clause buried in standard terms of business written before this market existed.

Who gets paid. Paragraph 4.1 of the SRA Code requires you to "properly account to clients for any financial benefit you receive as a result of their instructions, except where they have agreed otherwise"¹. Proceeds from licensing a client's material may be that kind of benefit, so agree in writing with the client who receives what, and ask your own regulatory solicitor how paragraph 4.1 applies to your firm.

What client consent does not cover:

• Documents disclosed in litigation. Under CPR 31.22, a party may use a disclosed document "only for the purpose of the proceedings in which it is disclosed", unless it was read or referred to at a public hearing, the court gives permission, or the disclosing party and the document's owner agree⁶. Your client's consent alone does not lift that.
• Other people's personal data. Opponents, witnesses and employees named in a file have their own rights under UK GDPR; your client cannot consent for them. Their data must still be removed.
• Information others gave in confidence, for example under a non-disclosure agreement in a transaction.
• Privilege. Sharing privileged advice outside the firm raises questions about the client's privilege that the client should take its own advice on.

Precedents, know-how and copyright

The firm owns copyright in what its employees write in the course of employment, unless agreed otherwise. It does not automatically own what partners, LLP members, consultants, clients or opponents wrote.

• Employees. Under section 11(2) of the Copyright, Designs and Patents Act 1988, the employer is the first owner of copyright in a work an employee makes in the course of employment, "subject to any agreement to the contrary"⁷.
• Partners and members. "Employee" means someone employed under "a contract of service or of apprenticeship" (section 178)⁸. Partners and LLP members are not usually employed that way, so check what the partnership or members' agreement says about work they create, and have your solicitor confirm the position.
• Consultants and locums. Their contracts decide who owns what they wrote.
• Borrowed drafting. The author is the first owner of copyright⁷, so a precedent adapted from a client's document, an opponent's draft or a published precedent service may contain material the firm does not own. Check the terms of any precedent service you subscribe to.
• Know-how against confidence. General technique, such as how the firm structures a share purchase, is the firm's. The facts of a particular deal are the client's.
• Metadata. Document properties, tracked changes and comments often carry client names long after the visible text has been cleaned.

Ownership is something a buyer will ask you to warrant in the licence. Our licence terms checklist explains how to keep those warranties to what you can check.

Practical steps for a managing partner

Start with people, not systems: your COLP, your data protection lead and your broker should be in the room before anything is exported.

1. Brief your COLP. A COLP must take all reasonable steps to ensure the firm complies with the SRA's regulatory arrangements, and to make sure serious breaches are reported promptly².
2. Map your systems from metadata. Document management, practice management, email, knowledge bank, intranet and IT helpdesk: what each holds, for which years, and whose information it is.
3. Sort every record set into the three columns above, and record your reasons.
4. Check ownership of precedents and know-how, including partners', members' and consultants' work^7,8.
5. Involve your data protection lead. Agree a lawful basis for de-identifying staff and other personal data, carry out an impact assessment, and plan how staff will be told. Our UK law guide sets out what UK GDPR requires.
6. Speak to your indemnity broker. SRA rules require "adequate and appropriate cover" for current or past practice¹⁶. Ask in writing whether a data licence, and the warranties it contains, is covered.
7. Review client terms. For future matters, consider whether to offer clients a clear opt-in, never a default.
8. Have an independent solicitor approve the licence, even though you are lawyers yourselves. Exclusivity, deletion and re-identification terms matter as much here as anywhere.

Sleeping Asset maps your systems from metadata only, helps you sort the record sets, shows you which buyers fit and what they publish about their terms, and discloses every fee we could earn in writing; see how we are paid. We ask each buyer to confirm in writing that it accepts UK companies before we introduce you. We do not give legal advice. How we estimate value is on our valuation page, and other sectors are compared on our sectors page.

Related sectors: licensing recruitment agency data to AI and selling code and engineering history to AI.

Book a free, confidential 30-minute call for your firm. We reply within one working day.