If you run a construction company, AI is probably already part of your business, whether you’ve approved it or not. Project managers are using tools like ChatGPT to tidy up client emails. Estimators are pasting tender documents into AI to summarize them. Office staff are using it to draft proposals faster.
That’s not a bad thing. Used well, AI in construction companies saves real time on paperwork. The risk is in how it’s being used, and what’s being shared along the way. The answer isn’t banning AI. It’s knowing what’s in use, and putting a few simple guardrails around it.
Where AI is already showing up on your projects
Most construction teams don’t think of themselves as “using AI.” They’re just using the tools that make their day easier. Here’s where it tends to show up.
In the office
Writing and rewriting emails, summarizing long contracts or specifications, drafting proposals, cleaning up meeting notes and building schedules. These are the most common uses, and usually the first.
In estimating and pre-construction
Reviewing tender packages, pulling key requirements out of bid documents, and drafting scope descriptions. This is where AI saves the most time, and where the data being shared is often the most sensitive.
In the field
Phones and tablets bring AI to the jobsite: voice-to-text notes, photo-based tools and quick look-ups. Field staff often use personal apps on personal devices, which makes this the hardest area to see.
Using AI tools that the business hasn’t approved, or doesn’t know about, is often called “shadow AI.” It’s the first thing we look at when construction leaders ask us about AI.
“Shadow AI is our main concern when we first talk about AI with stakeholders. Your team has the best intentions: they want to be more productive and improve internal processes. But do you have complete control over the data going into AI, and the outputs coming out? Is your data protected from competitors, and does your team have the tools and information to use AI safely?”
Juan Paolo Maranan, Client Success Manager, Reis Informatica
The real risk: project data leaving your control
The biggest risk with AI isn’t the technology. It’s what people put into it.
When someone pastes a drawing, a bid, a contract or client information into a free, public AI tool, that information leaves your business. Depending on the tool and its settings, it may be stored on someone else’s servers, used to train future models, or kept longer than you’d expect. Once it’s out, you can’t pull it back.
For construction firms, a few types of information deserve extra care:
- Bids and pricing. Your numbers are your competitive edge. They shouldn’t sit in a tool you don’t control.
- Drawings and design files. These often belong to your clients or architects, and come with confidentiality expectations.
- Contracts and client details. Many contracts include confidentiality clauses. Sharing their contents with a public tool could put you in breach without anyone realizing it.
- Employee and subcontractor information. Personal details, rates and certifications are protected information.
Public AI tools vs. company-approved AI
Not all AI tools carry the same risk. The difference comes down to who controls the data.
|
Free / public AI tools |
Company-approved AI |
|
|---|---|---|
| Who controls the data | The tool provider | Your business |
| Data used to train models | Often, depending on settings | Typically no, under business agreements |
| Who can see what | Hard to know | Managed through your existing permissions |
| Admin controls | None | Yes: you can manage users, access and policies |
| Visibility for the business | Little or none | Clear oversight of how it’s used |
Business-grade tools, such as those built into Microsoft 365, are designed to work inside your existing security and permissions. That’s what makes them a safer starting point.
4 steps to make AI use safer this month
You don’t need a big project to get this under control. Start here.
1. Find out what’s already in use
Ask your team, without judgement, which AI tools they’re using and what for. You’ll likely be surprised, and you’ll learn where AI is already saving time.
2. Set a simple “do not upload” rule
Make it clear that drawings, bids, pricing, contracts and client information never go into public AI tools. A one-page guideline is enough to start.
3. Choose an approved tool
Give your team a safe option that works with the systems you already use. If people have an approved tool, they’re far less likely to find their own.
4. Clean up who can access what
Company-approved AI tools can generally surface any file a user has access to. If your shared folders are wide open, AI will make that easier to see. Reviewing permissions now protects you either way.
How Reis helps construction firms use AI securely
Reis Informatica works with construction companies to keep the office, the site and the project team connected and protected. That includes helping firms adopt AI the right way: understanding what’s in use, setting up approved tools, and making sure the systems underneath are secure.
Learn more about how we support construction companies, or see how we’ve worked with S.G. Cunningham.
Frequently asked questions
Is it safe to use ChatGPT for construction documents?
It depends on the document and the version of the tool. Free, public versions aren’t a good fit for drawings, bids or client information. Business versions with proper data controls are a much safer option.
Should we ban AI tools at our company?
Banning AI usually pushes it out of sight rather than stopping it. A better approach is to give your team an approved tool and clear rules on what can and can’t be shared.
What is “shadow AI”?
Shadow AI is when employees use AI tools the business hasn’t approved or doesn’t know about. It’s common, usually well-intentioned, and the main reason companies lose track of where their data is going.
Not sure where your business stands? Book a no-cost, 30-minute AI & Construction Technology Readiness Review with Reis. Book your review
SEO title: AI Readiness Checklist for Construction Firms
Meta description: Before you roll out AI, make sure your people, policies, access, data and backups are ready. A practical checklist for construction firms.
URL: /blog/ai-readiness-checklist-construction · Primary keyword: AI readiness checklist
Before You Roll Out AI: The Technology Checklist for Construction Firms
AI only saves time if your foundation is ready for it. Roll it out on top of messy permissions, shared logins or untested backups, and you’re likely to create new problems faster than you solve old ones.
Before you introduce AI tools across your company, use this AI readiness checklist to check five areas: people, policies, identity and access, data, and backup and security. If you can tick most of the boxes, you’re in good shape. If not, you’ll know exactly where to start.
The 5-point AI readiness checklist
1. People
AI is only as safe as the people using it. Your team needs to know what’s allowed, what isn’t, and why.
- We know which AI tools our team is already using
- Staff have had basic training on safe AI use
- Office and field teams both understand the rules, not just head office
- There’s a clear person to ask when someone isn’t sure
2. Policies
A short, clear policy beats a long one nobody reads.
- We have an acceptable use guideline for AI tools
- There’s a “do not upload” list covering drawings, bids, pricing, contracts and client data
- Approved AI tools are named, so people aren’t guessing
- The policy is reviewed as tools change
3. Identity and access
Construction firms often have more people, devices and outside partners touching their systems than they realize.
- Multi-factor authentication (MFA) is on for every account
- Site staff have their own accounts, not shared logins
- Subcontractor and partner access is limited to what they need
- Access is removed promptly when people leave or projects end
4. Data
Company-approved AI tools can generally find and use any file a person has access to. That makes clean data and tidy permissions more important than ever.
- We know where our project files actually live
- Each type of data has a clear owner, and we know who uses it and why
- Sensitive folders (bids, HR, finance, client files) have restricted access
- “Anyone with the link” sharing is turned off for sensitive files
- Old projects and outdated files are archived
5. Backup and security
AI doesn’t replace the basics. It depends on them.
- Backups run automatically, and we’ve tested restoring from them
- Every device, including field tablets and laptops, is protected and up to date
- Our systems are monitored for suspicious activity
- We have a plan for what to do if something goes wrong
Common gaps we see in construction firms
When we start working with construction companies, the biggest gap usually isn’t where data is stored. It’s how that data is governed.
“What we typically see is that companies know where most of their data lives. They know where to find historical plans, bids and documentation. What they usually struggle with is the why, what, who and how of that data. Data governance and ownership is paramount before you build automations or connect AI to your data, and it’s always our first discussion point.”
Juan Paolo Maranan, Client Success Manager, Reis Informatica
A few other gaps come up again and again:
- No clear data ownership: nobody is responsible for deciding who should access what, or why
- Shared logins on jobsite devices, which make it impossible to know who accessed what
- Project files spread across too many places, including email, personal drives and various apps
- Former employees or subcontractors who still have access long after they’ve moved on
- Backups that run, but have never been tested
What to do if you’re not ready yet
Most firms won’t tick every box, and that’s normal. The key is to tackle it in the right order:
- Secure the basics first: MFA, individual accounts and tested backups.
- Get clear on your data: who owns it, who uses it and why, and who should have access.
- Set the rules: publish a simple AI guideline and an approved tool.
- Start small: pilot AI with one team or one workflow, then expand.
This approach lets you get value from AI quickly without taking on unnecessary risk.
Learn how we support construction companies, and how we help businesses adopt AI securely.
Frequently asked questions
How long does it take to get AI-ready?
It depends on where you’re starting. Many firms can cover the basics (MFA, individual accounts and an AI guideline) in a few weeks. Sorting out data ownership and file access across years of projects can take longer.
Do we need Microsoft 365 Copilot to use AI safely?
Not necessarily. Copilot is one option for businesses already on Microsoft 365, but the right tool depends on how your team works. What matters most is choosing an approved tool and preparing your systems first.
What should an AI policy include?
Keep it short: which tools are approved, what information should never be shared, who to ask with questions, and how the policy will be updated.
Ready to see where you stand? Book a no-cost, 30-minute AI & Construction Technology Readiness Review. Book your review
