How to Write an AI Policy for Architecture and Engineering Firms

If a client asked which AI tools have seen their drawings, could your firm answer with confidence? An AI policy for architecture firms and engineering firms has to cover three very different kinds of work: licensed design, proposals full of pricing, and field crews on phones at the jobsite. A generic generative AI policy template was not written for any of them.

This guide covers what belongs in a one-page firm-wide section, what each group's page should say, and how to pair every rule with a control so the policy produces evidence.

Why does a generic AI policy miss how architecture and engineering firms work?

A generic AI policy is written for office work, while an architecture, engineering or construction firm has three very different groups using AI: designers working on licensed instruments of service, business development staff handling pricing and past bids, and field teams on phones at the jobsite. Each group handles different data under different obligations, so one paragraph of rules cannot cover all three.

The design team's risk is professional. A rendering tool or code assistant that changes a model still leaves the licensee responsible for the result. The proposal team's risk is commercial: fee structures, unit rates and losing bids are the firm's competitive record. The field team's risk is physical and contractual: site photos can show security systems, utility routes and client operations that the owner never agreed to share.

A useful policy keeps one short firm-wide section and adds a page for each group. Principals approve it once, and each group lead owns their page.

What should an AI policy include for the whole firm?

A firm-wide AI policy should include the approved tools, the data that never goes into AI, the accounts people must use and who approves exceptions. Keep it to one page so people actually read it.

• Approved tools. List each approved AI tool by name and plan, and say that everything else needs a request first.
• Firm accounts only. All AI use with firm or client information happens in firm-managed accounts with multifactor authentication. No personal accounts for firm work.
• Never in AI. Controlled Unclassified Information, security-sensitive drawings, client data covered by an NDA that bars third-party processing, and passwords or access codes.
• Human review. A named person reviews AI output before it reaches a client, an agency or a permit reviewer.
• Requests and exceptions. One person approves new tools, with a set turnaround time.

If the firm works on defense projects, the CUI rule carries real weight. DFARS 252.204-7012 requires contractors to protect covered defense information and report cyber incidents, and NIST SP 800-171 requirement 3.1.22 requires control over CUI posted or processed on publicly accessible systems. Our guide to keeping CUI out of AI tools covers that boundary in detail.

What rules should apply to design and engineering work?

Design rules should keep licensed judgment with the licensee, keep client files in approved tools and settle who owns AI-assisted output. California law already frames the first point.

Under the Architects Practice Act, Business and Professions Code section 5536.1 requires the person preparing or in responsible control of plans and specifications to sign and stamp them as evidence of responsibility, and section 5535.1 defines responsible control as the control ordinarily exercised by architects applying the required professional standard of care. For engineers, section 6735 requires civil engineering plans, calculations, specifications and reports to be prepared by or under the responsible charge of a licensed civil engineer, and section 6703 defines responsible charge as independent control and direction using independent judgment. Neither statute mentions AI, and neither makes an exception for it.

Practical design rules that follow from that:

• AI-generated geometry, calculations, code checks or specifications are drafts until the responsible licensee reviews and accepts them.
• Record which tool produced a deliverable component and who reviewed it, in the project file.
• Upload client drawings and models only to tools approved on business terms that exclude your content from model training.
• Treat AI renderings with care in contracts. The U.S. Copyright Office has concluded that purely AI-generated material is not protected by copyright without sufficient human authorship, which affects what the firm can promise a client it owns.

For more on rendering tools specifically, see AI tools for architects.

What rules should apply to proposals and marketing?

Proposal rules should protect pricing and past bids, keep client-confidential project details out of unapproved tools and require a person to verify every claim. AI is useful for first drafts of narratives and resumes, which is why the rules need to be clear.

• Fee proposals, rate sheets, unit pricing and losing bids go only into approved firm accounts, never into free tools.
• Project descriptions for clients under NDA follow that client's terms, even when the project would make a strong case study.
• Every project, statistic, credential and team member named in an AI-assisted proposal is checked against the firm's records before submission. AI tools can invent projects and qualifications that sound plausible.
• Staff resumes and photos are personal information. Use them only in approved tools.
• If a client or agency asks whether AI was used in a submission, the proposal lead answers. Nobody guesses.

What rules should apply to field teams?

Field rules should cover phone apps, site photos and meeting recordings, because that is where most AEC data leaves the firm without anyone noticing. Keep them short enough to fit on a laminated card in the trailer.

• Use only approved apps on firm-managed phones or tablets for site photos, punch lists and markups.
• Do not run site photos showing security systems, access points, server rooms or utility routes through AI tools unless the client has approved it in writing.
• Tell everyone in a meeting before any AI notetaker or recorder starts, get their agreement and follow the client's rules on recording. Recording consent laws vary by state, so ask counsel if you are unsure.
• Do not paste RFIs, submittals or change order pricing into personal AI apps to "clean them up."
• Report a mistake the same day. A fast report is what makes containment possible.

How do you make the policy enforceable?

Make each rule produce evidence by pairing it with a control: approved tools with software and web filtering, data rules with data loss prevention, accounts with single sign-on and multifactor authentication, and field rules with mobile device management. Without the controls, the policy describes what you hope happens.

The CIS Controls give a ready map for this: software inventory and allowlisting, data protection and web filtering safeguards each line up with a policy section, and the CIS AI and LLM companion guide applies them to AI tools. The NIST Generative AI Profile is a useful checklist for the risks each section should address. Our guide to writing an AI policy your tools can enforce walks through the mapping rule by rule.

What should an AEC firm do this quarter?

Start with the firm-wide page and the three group pages, then connect each rule to a control. Most firms can finish the policy in a month and the enforcement over the following quarter.

1. List the AI tools in use today across design, proposals and the field, including phone apps and plugins.
2. Write the one-page firm-wide section and have principals approve it.
3. Have the design, business development and field leads each write their one-page section.
4. Move approved tools to firm accounts with multifactor authentication and block the rest on firm devices.
5. Turn on data loss prevention for client drawings, pricing files and CUI folders.
6. Train each group on its own page, and review the policy every six months.

How s90 helps

s90 helps AEC firms write AI policies that match how design, proposal and field teams actually work, then enforces them with AI guardrails and AI platform policy enforcement on firm devices and accounts. If you want a starting point, we can review your current policy against the three groups above.