Aipedia: Management consultants

AI benchmarking with client data: confidentiality

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Using one client's financials or KPIs in an AI tool to benchmark another client can breach confidentiality and create a conflict. The data may also leave your control if the tool reuses or trains on what you upload.

Part of: AI in Management consultants

In short

Benchmarking is a core consulting product, and AI makes it easy to combine data from many engagements. But client data is usually confidential under the engagement terms, and ICMCI 3.4 and 8.3 bar putting confidential or personal data into tools that may reuse, train on or expose it without safeguards. A client that finds its figures reflected in a competitor's report may claim breach of confidence or contract. PI may cover breach of confidentiality in professional services, subject to the wording, while data leakage from the tool itself may fall under cyber cover.

How consultants use AI for benchmarking

Clients want to know how they compare: cost per transaction, headcount ratios, margins, cycle times. Consultants hold this data from past engagements and increasingly feed it into AI tools to clean, normalise and compare it, or ask a generative AI chatbot to draft a benchmarking narrative from several clients' spreadsheets.

Two problems arise. First, the data belongs to other clients and was given for their engagement, not for reuse. Second, if the tool is a public service that retains or trains on inputs, the data may be exposed outside the firm entirely.

The temptation is greatest for specialist firms with deep sector data, where the benchmark is the selling point. Even anonymised figures can identify a client when a sector has few players or a region has one dominant firm, and an AI narrative may add descriptive detail that makes identification easier still.

The duties that apply

ICMCI 3.4 and 8.3: confidential or personal data must not go into AI tools that may reuse it, train on it or expose it, unless proper safeguards are in place. See the ICMCI AI Code explained.
ICMCI 7.2 and 7.3: personal data uses generally need explicit client agreement, and engagement terms should cover data protection and restrictions.
Contract and equity: engagement letters usually contain confidentiality obligations, and the law of breach of confidence applies independently.
UK GDPR: if benchmarking data includes personal data, such as pay by individual, consultants are usually processors or controllers with their own obligations.
Public sector: under PPN 017, contract terms may bar using buyer data to train AI without written approval.

What can go wrong

Illustrative: a consultant builds a sector benchmark by uploading several clients' management accounts into a public AI tool and asking it to compare them. The report for a new client includes a comparator described as a regional competitor, with figures and a description detailed enough to identify a previous client. That client learns of it and alleges breach of confidence, demanding damages for the competitive harm and an account of any profit. The consultant never intended to disclose anything; the detail came from the AI narrative, which nobody compared against the anonymisation rules.

A second risk is conflict. Advising two competitors at once, and using one's data to sharpen advice to the other, can breach professional duties even if nothing is published. The Institute of Consulting code requires honesty and integrity.

Why claims may sit between PI and cyber

A claim that the consultant misused client information while providing professional services may be covered by consultants' PI, some of which include breach of confidentiality, subject to the wording. Where the problem is that the data escaped through a third-party system, with notification duties, regulator contact and forensic costs, cyber cover is usually the better fit. Some policies exclude the other's territory, leaving a gap. See where PI ends and cyber begins, GDPR and data breach cover within PI and cyber insurance for consultants. Intentional misuse may be excluded under dishonesty provisions.

Practical controls

Get written client consent before using its data in benchmarks, and say so in engagement terms.
Anonymise and aggregate before analysis; check that comparators cannot be identified.
Use only approved AI tools with contractual commitments not to train on your inputs.
Keep client datasets separated and log what went into each benchmark.
Run a conflict check when advising competitors.
Remove personal data unless it is essential and lawful to process.

How Apex helps

Apex arranges PI for management consultants. A broker can check whether a confidentiality claim involving an AI tool would fall into a gap. See the AI in management consulting overview.

Sources

Frequently asked

Can I reuse client data for benchmarking?

Only if your engagement terms or the client's consent allow it, and usually only in anonymised, aggregated form. ICMCI 3.4 and 8.3 also require safeguards before confidential data goes into an AI tool.

Is putting client data into a public AI tool a breach?

It can be, if the tool may retain, reuse or train on the data and you have no safeguards or consent. ICMCI 3.4 treats this as a breach for CMCs, and it may breach the engagement letter and data protection law.

Will PI or cyber cover a confidentiality claim?

It depends on the facts and wordings. PI may cover breach of confidentiality in professional services. Cyber usually covers data breach response and liability where data escapes through systems. Check both policies for exclusions that point to each other.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.