The policy vacuum is the actual risk
In most commercial construction companies, people are already using general-purpose AI tools. An estimator pastes a specification section in to summarize it. A project engineer drafts correspondence. A superintendent turns notes into a report. This is happening whether or not leadership has discussed it, and in the absence of guidance people make reasonable-seeming choices that may not be reasonable at all.
A prohibition will not work. It will move the usage out of sight and remove any ability to guide it. A short policy that states what is acceptable, what is not, and what always requires review is achievable and far more effective.
Be specific about confidential information
The most concrete risk is confidential information entering a service the company has not vetted. Contract documents under confidentiality obligations, unreleased bid pricing, employee personal information, client financial details, and drawings marked proprietary all belong on a do-not-paste list. Many prime contracts contain confidentiality terms that flow down and apply regardless of what your internal policy says.
Distinguish between approved tools with appropriate terms and consumer services with none. Staff generally comply when told plainly which tool to use for which kind of information. They cannot comply with a policy that only says be careful.
Name the decisions that stay with people
Write down what must never be issued on generated output alone. Pricing sent to a client. Technical answers in an RFI response. Safety determinations. Contract interpretations and notice decisions. Purchase commitments above a threshold. Anything signed, and anything sent outside the company.
The rule should be that generated content is a draft and a named person with the relevant authority approves it. This holds regardless of how accurate the tool has been, because the exposure is on the company. Make it a workflow requirement rather than an aspiration, so the approval step exists in the process and not only in the policy document.
Check the output, and check it on a schedule
Automated workflows drift. Document formats change, a supplier alters a template, a general contractor updates a portal, and classification quality degrades quietly. Build in periodic sampling: review a set of outputs each month against what a person would have produced, and track the exception rate over time.
Keep a record of what each workflow does, what data it touches, who owns it, and when it was last reviewed. On a handful of workflows this takes an hour a quarter. It is also exactly what a client, an insurer, or an auditor will ask for, and having it ready is considerably easier than assembling it under pressure.
Client requirements are arriving in contracts
Owners and general contractors have begun including terms about artificial intelligence in contracts and prequalification questionnaires: disclosure of AI use in deliverables, restrictions on processing project data through third-party services, and requirements around confidentiality of design documents. These clauses are not yet standard, and they are appearing more often.
Read them, because they flow down. A contractor who has a written policy, knows which tools are approved, and can describe how project information is handled answers these questions quickly. One who has never considered it either delays the submission or answers in a way that is not accurate, which is the worse outcome.