Privacy in the AI Era

A project manager with a scope letter to write can paste a bid tab into a free chatbot, ask for a clean paragraph and get one in seconds. It hardly feels like a decision at all.

A bid tab can hold subcontractor quotes with unit prices those subs shared under a promise, the owner's budget line, and names and phone numbers. Once it's pasted, all of it sits on a server the company has no contract with, under terms nobody at the company read, and some consumer tiers use what you type to train the next version by default.

The way I see it, privacy with AI comes down to who holds the copy, under what promise and for how long. Construction is more exposed than most industries here, because almost nothing a contractor holds is its own.

A contractor holds a lot of other people's secrets

Start with the contracts you already sign. AIA A201-2017, Section 2.2.4, says that where the owner designates information as confidential, "the Contractor shall keep the information confidential and shall not disclose it to any other person." The exception is for people who "need to know the content of such information solely and exclusively for the Project and who agree to maintain the confidentiality." A consumer chatbot has agreed to nothing.

Section 1.5.2 of the same document says the contractor and its subs may reproduce the drawings and project manual "solely and exclusively for execution of the Work." The design team keeps the copyright. If you upload a drawing set to a service that stores it, reviews it and may learn from it, you've reproduced it for a purpose nobody licensed.

And then there's everything else. Subcontractor pricing is a trade secret only if you treat it like one, and the federal statute asks whether you took "reasonable measures" to keep it secret. Payroll, I-9s, drug tests, and injury reports are employee data with their own state rules. Site photos have faces in them. Anything from a federal or defense job carries markings that turn a paste into a reportable incident with a 72 hour clock. And many data center, pharma, and healthcare owners now add an NDA covering the whole project on top of A201, with language that bars outside services and gives the owner audit rights.

Protecting all of that is the contractor's job.

Consumer tiers and business tiers

The same product name can mean two very different contracts. The consumer tiers of the major assistants either train on what you type by default or make you choose, and several of them keep it a lot longer than people think.

The business tiers from the same vendors say the opposite in writing. ChatGPT's business plans and its maker's API do not train on customer content. Anthropic's commercial terms say "Anthropic may not train models on Customer Content." Microsoft 365 Copilot on a work account keeps prompts inside your tenant. Google Workspace with a qualifying edition does the same. What separates the two is a license fee and a signed data processing addendum.

What "deleted" means changed in 2025 too. In the New York Times case against the maker of ChatGPT, a federal magistrate ordered the company to preserve output logs that users had deleted. The order was narrowed months later, but everything captured in the window stayed on legal hold. The company's own notice said Enterprise customers and API customers with zero data retention were not covered. Data sitting in a vendor's system can get frozen by somebody else's lawsuit. The only ways to stay out of that are a contract tier that never stored it or a machine you own.

Leaks you didn't sign up for

Pasting is the obvious way information gets out. The one people miss is the AI that got switched on inside tools you already pay for.

A meeting note taker joins the owner's OAC call because one attendee installed it. Otter's policy says it trains on audio and transcripts with identifying details removed, and in August 2026 a federal court let wiretap and biometric claims against it proceed because the service "independently collects, retains, and uses communications for its own commercial purposes." HubSpot's AI training toggles default to on. Slack's global model training needs an email to opt out. A PDF tool's new connector hands the text of your drawings to whatever chatbot account the user has connected, which may be the free one.

Even the platforms built for this industry are worth reading up on. Procore publishes which models it routes to and says no outside party trains on your data. Autodesk, Bentley, Trimble, and Oracle say similar things in their own words. Read the actual page instead of the sales deck, and ask one question: does my project data leave your cloud, and who does it go to?

Then there's the phone. A superintendent takes a picture of a sheet and asks a personal assistant app what a symbol means. That goes around every control on the laptop, and the fix is a managed work profile that blocks copying data out of work apps.

It's already happening

Construction hasn't had a public story like Samsung's yet. In 2023, engineers at Samsung pasted source code and a meeting transcript into a consumer chatbot three times in twenty days. The company banned the tools and built its own. No builder has made that headline yet, but the surveys say the same thing is already going on.

AGC's 2026 outlook, with 951 firms answering, found 61 percent use AI or plan to invest in it, and that office and administrative work is the most common use. That's where the confidential documents are. Across industries, UpGuard found more than 80 percent of workers use unauthorized AI tools and executives use them most. IBM's 2026 breach study, released in July, put the global average cost of a breach at a record $4.99 million, found shadow AI involved in 43 percent of breached organizations, up from 20 percent a year earlier, and found 68 percent of breached organizations had no governance to detect unsanctioned AI use.

Insurers caught on first. Cyber applications in 2026 ask for an inventory of AI tools, an acceptable use policy and evidence of controls. Some carriers have added AI exclusions to professional liability forms. For a lot of contractors, a renewal form will be the first place anybody asks them to describe their AI policy, and "we do not have one" now counts against you in underwriting.

The other option is owning the machine

Two years ago, running a capable language model in your own building meant a server rack and a specialist. In 2026 you can do it on a desktop.

I think of private AI as a ladder with four rungs. At the top, open models running on hardware you own, with the network egress blocked: nothing leaves the building, and the only outbound traffic is a model download. One rung down, a private cloud dedicated to your company, where your prompts go to a region of a hyperscaler under a contract that forbids training and, on Azure, lets you turn off the 30 day abuse review. Below that, the enterprise tiers of the assistants, which promise no training but store what you type. At the bottom, the consumer tiers. Every rung you go down, you give up some control over your data in exchange for capability and convenience.

The top rung got a lot cheaper. A 128 GB unified memory desktop built on AMD's Ryzen AI Max+ 395, around $2,200 for a mini PC in mid 2026, runs the larger open models built for this class of machine fast enough for two or three people at once. NVIDIA's DGX Spark, about $4,000 to $4,700, runs the same models faster with the CUDA tools most integrators know. Apple's Mac Studio with the M5 Ultra, announced in August 2026 from $5,499 and configurable to 512 GB later this year, holds models in the 235 billion parameter class. A workstation with one RTX PRO 6000 card serves a 70 billion parameter model to a whole office. All of it is exposed to this year's memory shortage, so quote hardware the week you buy it.

The models are open, too. The Qwen3 family including the vision models that read drawings and site photos, Mistral Small, DeepSeek, and GLM ship under Apache 2.0 or MIT licenses. Llama and Gemma work but carry custom terms worth reading. What these models are good at is the paperwork we do in the trailer: answering questions across a project folder, summarizing a 400 page project manual, drafting an RFI, cleaning up meeting notes, and reading a photo of a sheet.

A sensible setup for a firm of 10 to 50 people is one of those desktops on a UPS in the server closet, a second identical unit as a cold spare, and a short software stack: a document parser, an embedding model, a vector store that carries the same permissions as your SharePoint folders, a model server, a gateway that logs every prompt, and a chat window behind your single sign on. Insist on the permissions. A PM shouldn't be able to ask the assistant about another job's pricing, and the system has to enforce that when it pulls documents.

Most of the cost of running this is people, meaning the setup work and an administrator's time, usually part time. Compare that with the seat licenses you'd otherwise buy, and with the cost of a single breach from the IBM study.

Where the local machine falls short

Open models still trail the leading hosted models on the hardest reasoning tasks. On a subtle contract interpretation or a long synthesis across many documents, a frontier model still wins. A local machine also needs somebody to patch it, back up the index and swap models without breaking what worked last month. When private AI projects fail, it's usually on the day to day upkeep.

What works for most contractors is a hybrid, where the data's classification decides where a prompt goes, not the kind of task. Bid pricing, sub quotes, payroll, owner financials, incident narratives, and anything under an NDA stay on the local model over the local index. Public code questions, marketing copy, general research, and cleanup of notes with nothing confidential in them go to an enterprise API with zero data retention. One gateway fronts both, so people see one chat window and the auditor sees one log with the routing decision beside each prompt.

Whichever rung you pick, you check it the same way. Read the vendor's data processing page, confirm the retention setting in the admin console rather than the brochure, watch the egress logs for a week, and rehearse the incident.

The controls that cost nothing

Most of the protection is paperwork and settings, and it all fits on a page.

First, an acceptable use policy written the way a crew actually talks: use only the approved tools, signed in with the company account. Never put "never paste" data into any AI tool, approved or not. AI output is a draft until a person with the right authority checks it. No note taker joins a meeting unless the host announced it and outside participants were told. If something sensitive went into the wrong tool, tell IT the same day; nobody gets in trouble for reporting, people do for hiding it. Subs and vendors who touch our project data follow the same rules.

Next, sort your data into three tiers. Never paste: controlled federal data, health information, information the owner designated confidential, unopened or unleveled bids, employee identity and medical records, security drawings, anything under litigation hold. Internal tools only: drawings and the project manual, schedules, change order narratives, cost reports, photos, incident narratives with names removed. Any tool: public code questions, generic email polish with no project identifiers, training content. There's a simple test a superintendent can use. Would I be comfortable if this showed up on the owner's desk with a note saying I sent it to a company we have no contract with?

Then the settings. Label confidential libraries in SharePoint or your project platform. Turn on the endpoint rule that blocks paste and upload of labeled content to the generative AI site group, and warns on the rest. Point the company's chatbot domain at your enterprise workspace only. Put every approved tool behind single sign on. Manage the phones. Turn off "discoverable" sharing anywhere it exists; in 2025, roughly 4,500 shared chatbot conversations ended up indexed by Google because a checkbox existed.

Then an incident playbook in six steps. Contain the same day: delete the conversation, turn off training on the account, request deletion in writing and keep the screenshot. Classify on day one, because controlled federal data starts a 72 hour clock and an owner NDA usually has its own notice window. Notify per the contract and the policy, with counsel before any statement. Preserve the logs and the device. Fix the control that let it happen. Write one paragraph in the incident log, because the insurer will ask for it at renewal.

And last, the contract. Flow the same AI rules down to your subs, because their paste is your breach under the owner's clause. Watch for new owner language that bans outside AI services outright, which would sweep in the platforms you already run, and negotiate it to "no service that trains on or retains project data outside a written agreement."

Decide where your copies live

In this industry we usually bolt the new thing onto the old process and see what happens. That's fine for a layout robot, but with a tool that only works because you hand it your documents, you need to make a decision first.

The firms that come out fine will be the ones that decided early, and wrote down, where their copies live. For some that's an enterprise contract with retention turned off. For more and more of them it's a machine in the server closet running a model they downloaded once that never sends anything back out. Either way, ask every tool, every vendor and every new hire the same thing a super asks about a gang box at the end of the day, which is who has the key.

Disclosure: this publication is run by SubPro, which processes customer project documents for submittal work. The spec book you upload is deleted when processing finishes, and nothing you send is used to train an AI model. No vendor or product named in this article paid to be included.