Before Your Construction Team Puts a Project Document Into AI, Ask These Questions

Artificial intelligence is becoming part of everyday construction work.

Project managers are using AI to help summarize meetings, organize action items, draft stakeholder communications, support project documentation, review change-order information, and build repeatable workflows.

Estimators and preconstruction teams are also exploring AI for document search, estimating support, and administrative work.

That shift is no longer theoretical.

The Associated General Contractors of America recently offered a dedicated AI for Construction Project Management workshop focused on using AI for communication, coordination, documentation, change-order support, look-ahead planning, and project-management assistants. AGC Georgia has also been training contractors on AI use in estimating, document search, and back-office operations while emphasizing the need to protect bid data, contracts, and client information.

The opportunity is real.

But so is the governance question:

Before someone on your team puts a project document into an AI tool, do they know whether that document should be there in the first place?

For construction leaders, that is becoming one of the most important questions in responsible AI adoption.

Why AI Governance Matters in Construction

AI governance is not about banning useful technology.

It is about deciding how AI can be used, what information can be shared with it, which applications are approved, and what controls should be in place before employees begin using AI across live projects.

That matters because construction companies hold a wide range of sensitive business and project information.

Depending on the company and project, that can include:

• Bids
• Contracts
• Project drawings and specifications
• Change orders
• Pricing
• Margins
• Customer information
• Employee information
• Subcontractor information
• Supplier information
• Financial records
• Internal processes
• Project schedules
• Site documentation
• Credentials or system information

The fact that an employee has legitimate access to a document does not automatically mean that document should be submitted to any AI platform they choose.

That distinction is where AI governance begins.

Construction Teams Are Already Finding Useful AI Workflows

AGC's recent AI training makes the direction of the industry clear.

Its project-management workshop focuses on applying AI to everyday workflows such as meeting summaries, stakeholder communication, action tracking, project documentation, change-order support, and look-ahead planning.

AGC also offers role-specific AI workshops for construction firms, including project management, estimating and preconstruction, business development, HR, and workflow systems.

That matters because AI use in construction is becoming more embedded in actual business processes.

Instead of an employee asking a chatbot a general question, AI may now be used alongside project documents, communications, schedules, estimates, or other operational information.

That is exactly when firms need to understand the relationship between productivity and data risk.

The Right Question Is Not "Can AI Help With This?"

A project manager might look at a long meeting transcript and think:

Can AI summarize this?

An estimator might ask:

Can AI help me search this specification?

An operations leader might ask:

Can AI draft a project update from these notes?

Those are reasonable questions.

But before asking whether AI can perform the task, construction companies should ask:

What information would the AI need in order to do it?

That changes the conversation.

A meeting summary might include customer names, subcontractor issues, project delays, financial discussions, employee information, or internal decisions.

A specification may include confidential project details.

A bid document may include pricing, margins, scope decisions, or competitive information.

A contract may contain obligations, project details, or other sensitive information.

The productivity benefit does not automatically outweigh the need to understand what happens to the information after it is submitted.

Question 1: Is This AI Tool Approved by the Company?

The first question should be simple:

Is this an AI application the company has reviewed and approved?

Employees can access a growing number of AI tools through browsers, software platforms, mobile applications, browser extensions, meeting tools, and features embedded inside products they already use.

That creates the possibility of shadow AI, where employees use AI applications without the organization having full visibility into the tool or how it handles company information.

An approved-tool process gives employees a clearer path.

Instead of asking each employee to make their own decision about which AI provider appears trustworthy, the organization can establish which tools have been reviewed and what use cases are permitted.

AvTek's guide to questions businesses should answer before expanding AI use looks at this broader issue of approved applications, access, data handling, and governance.

Question 2: What Information Is Inside the Document?

Before putting a document into AI, identify what the document actually contains.

That might sound obvious, but construction documents can combine multiple categories of information in one place.

A project document could contain:

Customer information

Names, addresses, contact information, communications, or project-specific details.

Financial information

Pricing, margins, payment details, estimates, budgets, or cost information.

Contractual information

Terms, obligations, scope, schedules, or confidential language.

Employee information

Names, internal communications, performance discussions, schedules, or other personnel details.

Subcontractor and vendor information

Pricing, contact details, agreements, performance issues, or account information.

Project intellectual property

Drawings, designs, processes, plans, specifications, or methods.

Before submitting anything to an AI tool, the employee should understand which categories of information are present and whether company policy permits those categories to be used with that application.

Question 3: Does the AI Tool Retain or Reuse the Information?

Different AI products have different terms, configurations, privacy controls, and data-handling practices.

Construction firms should not assume that every AI application treats submitted information the same way.

For any tool that may receive sensitive business information, the organization should understand:

• Whether prompts are retained
• How submitted information is processed
• Whether information may be used to improve or train models
• Whether administrators can configure data-handling settings
• Which outside providers or subprocessors may be involved
• How long information is retained
• Whether information can be deleted
• What security controls surround the platform

These are vendor-risk questions as much as AI questions.

NIST's Generative Artificial Intelligence Profile is designed to help organizations consider risks that are unique to or intensified by generative AI and apply risk-management practices throughout the AI lifecycle.

The goal is not to assume a tool is unsafe.

The goal is to know how the tool works before sensitive project information is introduced.

Question 4: Does the Employee Need to Use the Entire Document?

One of the simplest AI-governance habits is also one of the most useful:

Only provide the information necessary for the task.

If an employee needs help rewriting a paragraph, the entire contract may not be necessary.

If AI is helping create a generic project update format, real customer names and project details may not be required.

If someone is testing a prompt, a sanitized example may work just as well as a live project document.

This follows a basic risk-management principle: limit unnecessary exposure.

Before submitting a document, employees should ask whether they can:

• Remove customer-identifying information
• Remove pricing or financial details
• Remove employee information
• Remove credentials or system information
• Use an excerpt instead of the full document
• Use a fictional or sanitized example

AI governance should make these expectations clear instead of leaving employees to decide on their own.

Question 5: Who Can Access the AI Output?

Data governance does not end after information goes into an AI tool.

The output matters too.

An AI-generated summary may reproduce sensitive details from the source material.

A generated report may contain pricing, contract language, customer details, internal decisions, or other restricted information.

That output may then be:

• Copied into email
• Shared in Teams
• Saved in a project folder
• Added to another application
• Sent to a subcontractor
• Used in a customer communication

Construction firms should treat AI-generated material according to the sensitivity of the information it contains.

AI does not make confidential project information less confidential simply because it has been summarized.

Question 6: Is a Human Still Reviewing the Work?

AI can support construction workflows.

It should not automatically eliminate professional review.

AGC's project-management training specifically emphasizes using AI while keeping the project manager in control of decisions and outcomes.

That principle matters.

AI-generated material may need to be checked for:

• Accuracy
• Missing context
• Incorrect assumptions
• Contractual implications
• Project-specific details
• Sensitive information
• Appropriate recipients

The level of review should reflect the importance of the task.

Using AI to reorganize internal notes is different from relying on AI-generated language for a change order, contract communication, customer deliverable, or project decision.

AI governance should define where human review is expected rather than assuming the same process works for every use case.

Question 7: Is AI Accessing More Than the Employee Realizes?

The AI conversation is also moving beyond uploading individual documents.

New AI systems can connect to business applications, document repositories, email platforms, project-management tools, and other data sources.

That means an employee may not manually upload a file at all.

The AI may already have permission to retrieve it.

This makes existing access controls increasingly important.

If an employee has overly broad access to project folders or business systems, an AI tool connected to those systems may make that information much easier to locate and use.

Construction firms should understand:

• What systems the AI can access
• Which user permissions it inherits
• Which project folders it can search
• Whether access is limited appropriately
• Whether sensitive information is classified
• Whether permissions are reviewed regularly

AI governance and traditional cybersecurity increasingly overlap at this point.

AI Governance Is a Data Governance Problem Too

A construction company cannot effectively govern AI without understanding its data.

That means answering foundational questions:

What information do we have?

Where does it live?

Who has access to it?

How sensitive is it?

Which AI tools are allowed to interact with it?

Those questions are not unique to AI.

They are core cybersecurity and information-management questions.

AI simply makes them more urgent because the technology can make large amounts of information easier to search, summarize, combine, and redistribute.

AvTek's Managed IT Services are built around helping organizations reduce technology risk, improve security, and manage IT environments proactively.

For construction companies with internal IT teams, AvTek's Co-Managed IT Services can add cybersecurity, monitoring, automation, and operational capacity while the internal team retains control over strategy and priorities.

What Should an AI Acceptable-Use Policy Cover for Construction?

An effective AI acceptable-use policy should be practical enough that employees can actually follow it.

Depending on the organization's needs, the policy may address:

• Approved AI tools
• Prohibited applications
• Permitted business use cases
• Restricted categories of data
• Customer and project confidentiality
• Employee information
• Financial information
• Contracts and legal documents
• Bid and pricing information
• Human-review requirements
• Vendor approval
• Reporting or escalation procedures

The policy should also be understandable to employees who are not technical.

A project manager should not need to understand how a large language model works in order to understand whether a particular project document belongs in one.

Don't Treat AI Governance as a One-Time Policy Project

AI applications change.

Features change.

Vendors introduce new capabilities.

Employees find new workflows.

AI agents and automation may eventually take on tasks that previously required more direct user involvement.

That means governance needs to evolve with actual use.

NIST's AI Risk Management Framework is structured around four ongoing functions: Govern, Map, Measure, and Manage. It is intended as a voluntary framework for organizations managing AI risk across the lifecycle of AI systems and use cases.

For construction companies, that means revisiting questions such as:

• What AI are employees using now?
• What new tools have appeared?
• What project data are those tools accessing?
• Which use cases are producing value?
• Which use cases introduce unacceptable risk?
• Are company policies still realistic?
• Do technical controls support those policies?
• Has a vendor introduced new AI functionality?

Governance should follow the technology as it changes.

Frequently Asked Questions About AI in Construction

Before the Next Project Document Goes Into AI, Establish the Rules

Construction teams are already finding useful ways to apply AI.

That adoption will continue.

The opportunity for construction leaders is to put the governance structure in place while those workflows are still developing.

Start by answering a few basic questions:

Which AI tools are employees allowed to use?

What project information can those tools receive?

What data should never be submitted?

Who reviews AI-generated work?

What AI applications are employees already using that leadership may not know about?

What happens when AI starts connecting directly to project systems instead of waiting for someone to upload a document?

If your organization cannot answer those questions yet, that does not mean AI adoption needs to stop.

It means it is time to establish the guardrails.

AvTek Solutions helps organizations reduce technology risk through cybersecurity, managed IT, co-managed IT, risk assessments, and AI governance.

If your construction teams are already experimenting with AI, now is the time to understand how it is being used and establish the rules around your project data before those workflows become harder to unwind.

Talk with AvTek about your technology and AI risk