Guide
AI governance in a construction firm has two layers. The first is an acceptable use policy: which tools are approved, what data must never be entered into them and who owns the policy. Free templates cover that layer. It does not answer the questions that come up once AI drafts an RFI response, reviews a submittal or updates a register: who approved this output, what was it allowed to change, what did it read, and what happens when it is wrong.
The sections below cover the second layer: controls written for one workflow at a time, in which a model proposes, software enforces the fixed rules, a named person approves anything that changes a project record, every output cites what it read, and the workflow stops and hands the case back when a defined condition is met. It is general guidance, not legal or insurance advice.
Hugo Sequier runs State Method, which sells the assessments, pilots and builds these guides discuss. Apply the same tests to it as to any other provider.
01 / Two layers
Applies to everyone in the firm: approved tools and account types, which classes of data may enter which tool, when AI use is disclosed to a client or owner, who owns the policy and when it is reviewed. The AIA AI Firm Toolkit publishes free sample firm AI policy templates, and several construction software vendors publish versions for contractors. Starting from one of them is faster than a blank page.
Apply to one workflow that reads or changes project records, such as submittal review, RFI intake or a document register. They name the approver, set what the model, software and people may each do, define the audit record and the stop conditions, and are tested on past cases before the workflow goes live. A firm policy cannot hold these, because they are different for every workflow.
Public frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 describe governance for a whole organisation. They give a larger firm useful structure; the controls below are what a single workflow needs on a live project.
02 / Control sheet
One page per workflow is enough if it answers six questions. Each interactive workflow example linked below includes a permission matrix in this shape, built on synthetic project data.
The role accountable for the outcome, and the named person who approves each consequential output, with a deputy for absences. “The project team” is not an approver.
One row per action and who may take it: the model may propose, software may enforce, a person may approve. Mark the actions the model is not permitted to take, such as setting a compliance status or sending anything outside the firm.
Which sources the workflow may read, which revision counts as current, and the rule that every output names the document, revision and page it relied on.
What is kept for each case: the input documents and revisions, the output as the model proposed it, the result of each rule check, the approver, the decision (approved, corrected, rejected or stopped) and its time, plus the prompt and model version in use. The record lives in the firm’s own systems, so it survives a change of vendor.
The conditions under which the workflow produces no output and hands the case to a person instead. Section 03 lists the usual ones.
What happens once a wrong output is found: how the record is corrected, who is told, and whether the workflow pauses until the cause is understood.
03 / Stop
Stopping is a designed outcome, not a failure. A workflow that hands back its difficult cases can still save time on the rest; one that guesses on them produces records nobody can trust.
04 / Approval
Human review only works if the reviewer can check an output quickly and the record shows what was approved. Three design choices make the difference.
A rising approval rate with falling review time can mean the workflow is improving or that reviewers have stopped reading. Sample approved cases every month and check them against the sources.
05 / Liability
Using AI does not move professional responsibility. The AIA AI Firm Toolkit states that licensed architects remain responsible for all work product, whatever AI produced, and the same logic applies to a contractor’s submittal reviewer or document controller. The practical risks are an output that looks reviewed but was not, a status set from a superseded revision, and no record of who decided.
The controls above answer each of these: the model never sets the status, software checks the revision, and the audit record shows who approved what was proposed. Contracts add a further layer. The same toolkit notes that owner-supplied agreements increasingly contain AI provisions, such as required disclosure of AI use, limits on training models with project data and audit rights. Read the project contract before deciding what a workflow may do, and take liability and coverage questions to counsel and the firm’s insurer.
06 / Citations
A model can produce a reference to a clause, standard or drawing that does not exist, in exactly the format of a real one. Telling it to cite only real sources does not prevent this. Checks outside the model do.
07 / Evidence
Requirements differ by insurer, contract and jurisdiction, so ask what is wanted before producing anything. A firm that has done the work above can usually answer from documents it already holds.
08 / Before connecting
Controls are cheapest to write while the workflow is still being tested, before it is live. The AI proof of concept guide covers that test, and the AI readiness assessment checks whether a workflow is ready for one.
FAQ
It needs one as soon as anyone uses AI tools for work. A short policy naming approved tools, data that must not be entered, review rules, disclosure and an owner is enough to start. Workflows that change project records need their own controls on top of it.
For each case: the input documents and revisions, the output as proposed, each rule check result, the approver, the decision and its time, and the prompt and model version in use. Keep the record in the firm’s own systems so it survives a change of vendor.
Continue with the evidence
Assessment / one workflow
Describe the workflow, the records it would read or change, who approves today and what a mistake costs. A person reviews every assessment. Do not send confidential documents through the public form.