AI Tools for Architects: How to Use Them Without Exposing Client Drawings

Your designers are probably already using AI tools to turn massing models into presentation renderings and to clean up proposal graphics, sometimes on personal accounts. Some AI tools for architects publish what you upload by default, which puts client drawings, and the confidentiality terms in your owner agreements, at risk. Here is how to keep using AI while keeping control of the drawings.

Are AI rendering tools private when you upload a client drawing?

Not always: an uploaded drawing is governed by the tool's terms, and on some tools it is public by default. Midjourney's terms of service (version effective May 27, 2026) state that by default, user content is publicly viewable and remixable. The same terms grant Midjourney a perpetual, worldwide, irrevocable license to content users input, including uploaded images, and that license survives cancellation.

Privacy settings help less than people expect. Midjourney's Stealth mode is limited to its Pro and Mega plans, the terms describe it as a best-efforts commitment, and images created in public Discord channels stay visible to others even with Stealth on. A designer on a lower tier who uploads a client's elevation to get a quick rendering may be publishing a version of that design.

Other tools have different terms, and business plans often differ from personal ones. That is why the review has to happen at the firm level, before anyone uploads, instead of by each designer working against a deadline.

What is the risk to a design firm if a client rendering leaks?

A leaked rendering can breach the confidentiality terms in an owner agreement or NDA and damage the client relationship. Developers often keep projects quiet until entitlements or financing are in place, so an early rendering in a public gallery can turn into a contract dispute and a hard call with the client.

Ownership is a second issue. The U.S. Copyright Office's January 2025 report on copyrightability concluded that AI outputs are not protected by copyright based on prompts alone. Human-authored expression that is perceptible in the output, and creative human selection or modification, can still be protected. A firm that relies on AI-generated imagery in deliverables should know which parts of the work are its own.

Can you use AI tools on defense or federal projects?

Not public ones, if the project involves Controlled Unclassified Information. The DFARS 7012 clause points to NIST SP 800-171, and requirement 3.1.22 requires firms to control CUI posted or processed on publicly accessible systems. A public AI service is a publicly accessible system, so CUI drawings should not go into one. For where CMMC stands now, see what still applies during the CMMC Phase 2 suspension.

Drawings for military facilities, secure areas, utilities and other sensitive sites often carry handling markings or contract restrictions even when they are not CUI. Treat any marked drawing as off limits for AI tools unless the contract and the tool have both been reviewed.

How should an architecture firm choose which AI tools to approve?

Approve tools against written criteria before anyone uploads project files. The NIST Generative AI Profile lists data privacy, information security and intellectual property among the risks generative AI creates or worsens, which makes a useful frame for the questions to ask.

• Training. Does the vendor use uploads or outputs to train models, and can the firm turn that off for every user?
• Visibility. Are generated images private by default on the plan you will buy?
• License. What rights does the vendor take over inputs, and do those rights survive cancellation?
• Retention. How long are uploads kept, and can an admin delete them?
• Access. Does the plan support single sign-on and central user management, so access ends when someone leaves?

Record the answers with the date you checked them. Vendor terms change, and the review should be repeated at least yearly.

How do you block unapproved AI tools on firm workstations?

Use the same controls that enforce any software policy: an inventory of authorized software, blocks on unauthorized software, DNS and URL filtering, and restrictions on browser extensions. The CIS Controls v8.1 AI and LLM companion guide (April 2026) is written for text-based generative AI, but it maps the same existing safeguards to AI use.

In practice that means web filtering that blocks unapproved AI design sites, an allowlist for desktop plug-ins in Revit, Rhino and similar tools, and DLP rules that block uploads of DWG, RVT, IFC and PDF files from project folders to unapproved domains. Sensitivity labels on confidential project folders make the DLP rules more precise. Run new rules in audit mode for two weeks first. The reports show which tools designers rely on, so the firm can approve a replacement before blocking anything in the middle of a proposal deadline.

Some firms run AI rendering on local workstations instead of in the cloud, which keeps the files on firm hardware. If you are weighing that, see what Revit workstation to buy for rendering and AI.

Field and remote staff need the same rules. Zero Trust Network Access lets designers reach project files from home or a jobsite without a VPN that exposes the whole file server, and it keeps access policy in one place.

What should an AEC firm do about AI tools this quarter?

1. Ask each studio which AI tools they use for renderings, massing, image editing and proposal graphics. Check sign-in logs and expense reports to fill gaps.
2. Review the terms of the tools people want, using the criteria above, and approve one or two on business plans.
3. Block unapproved AI design sites and plug-ins on firm workstations.
4. Turn on DLP rules for CAD, BIM and PDF uploads from project folders to unapproved sites, starting in audit mode.
5. Flag defense, federal and security-sensitive projects in your project list and exclude them from AI tools in writing.
6. Add a short AI section to your design standards: approved tools, what may be uploaded, and who approves exceptions.

How s90 helps

s90 helps architecture, engineering and construction firms use AI without losing control of client drawings. We set up DLP rules for project files, block unapproved AI tools and plug-ins, and give staff Zero Trust access to project folders from the office, home or jobsite. Our agreements commit to 72-hour breach notification and 24-hour evidence production. If you want a quick read on which AI tools your designers already use, we can start there.