Your design firm is using AI to generate specifications faster. Your GC is running project schedules through an AI optimization tool. Your owner’s rep is using AI to draft RFI responses.

All of that might be genuinely useful. But there’s a question buried in every one of those workflows that most owners never think to ask: where is my data going?

Your project data is valuable. Treat it that way.

A construction project generates an enormous amount of sensitive information. Budget details. Proprietary program requirements. Site constraints. Business plans embedded in the building’s design. Contract terms. Subcontractor pricing.

When any of that gets fed into a third-party AI tool, it exists somewhere outside your control. The tool’s terms of service determine what happens to it. And most people signing up for AI tools, including the professionals working on your project, have never read those terms carefully.

Some tools use your inputs to train future models. Some store data in ways that could be accessed by the vendor’s other clients. Some have data residency rules that matter if you’re in regulated industries or working with government entities.

This isn’t hypothetical. It’s how most consumer-grade AI tools work. And most of the AI tools your vendors are currently using were originally built as consumer products.

The question you should be asking in every vendor conversation

“What AI tools does your team use on projects, and how does client data flow through those tools?”

If the answer is a blank stare, that’s a problem. If the answer is “we have a policy and I can walk you through it,” that’s a firm paying attention.

Any vendor doing serious work in 2025 should have an AI policy. It should define which tools are approved for use, what categories of data can and can’t be fed into those tools, and how client confidentiality is maintained when AI is part of the workflow.

The absence of a policy isn’t just a security concern. It’s a maturity signal. Firms that haven’t thought through AI data governance are also probably not thinking carefully about other risks on your project.

What good AI governance actually looks like

You don’t need your vendors to be cybersecurity experts. You need them to be thoughtful about where your information goes.

Good governance looks like: approved tool lists that have been evaluated against data privacy requirements, contract provisions that address third-party AI use, and regular review as the tool landscape changes.

For projects involving government clients, regulated industries, or particularly sensitive program information, the standard should be higher. Private AI deployments, where the model runs on the firm’s own infrastructure or in a dedicated cloud environment, keep your data from touching shared systems entirely. They’re more expensive to set up. For the right projects, they’re worth it.

The key question for any AI tool in your project workflow: can the firm control where your data goes, or are they using a shared service where that control doesn’t exist?

The risk that rarely surfaces in pitch meetings

There’s a persistent dynamic in AI adoption: the people making decisions about which tools to use are often not the people who understand the data privacy implications. A project manager adopts a new AI scheduling tool because it makes their job easier. That’s a reasonable motivation. A careful review of the tool’s terms of service? That typically doesn’t happen.

Multiply that across every person on your project team, every firm in your project delivery chain, and every tool that’s been adopted informally because someone found it useful, and you have a data governance situation that no one has mapped.

You’re not responsible for running your design team’s IT department. But you are responsible for protecting your own project information. That means putting requirements in your contracts.

What to put in your contracts

Three things worth adding to your project agreements, or at least asking about before you sign:

A provision requiring vendors to disclose what AI tools they use on your project and how client data is handled in those workflows.

A requirement that client-specific information not be used to train AI models without your written consent.

A data security baseline, particularly if your project involves sensitive program information, that establishes the standard your vendors must meet.

None of this is onerous to ask for. Firms doing thoughtful work will have straightforward answers. Firms that resist the conversation are telling you something worth knowing before you start construction.

The bottom line

AI in your project workflow is mostly a good thing. It helps your vendors work faster, catch problems earlier, and manage complexity more effectively. The efficiency gains are real.

But efficiency gains built on your data should come with transparency about where that data goes. Ask the questions. Read the policies. Put the requirements in writing. Your building is a serious investment, the information behind it deserves the same protection.