Shadow AI

Why it matters in construction

An estimator with a 200-page spec and a deadline will use whatever helps. If the company has not provided an AI tool, the estimator has a free one in a browser tab, and the spec, the sub proposals, and the owner’s draft contract are going into it. Nobody is being malicious. They are getting the work done with what is available.

The problem is where the data ends up. Consumer AI products often retain inputs and may train on them, with none of the contractual protections a company would negotiate. A GC that has never signed an AI vendor agreement may already have its pricing history, contract terms, and owner correspondence inside several models it has no relationship with.

How it works

Shadow AI often takes these forms in a GC:

1. Document work. Pasting or uploading specs, proposals, contracts, and RFPs into a consumer chatbot to summarize, compare, or draft responses. This often involves the most sensitive project material.
2. Writing. Drafting proposals, owner emails, and meeting recaps. The data risk may be lower, but the content can still include pricing and project details.
3. Browser extensions and meeting bots. Tools installed personally that read email and calendars or record calls. They have broad access and nobody reviews them.
4. Personal devices. Photos of drawings or handwritten notes sent to a phone app, which sidesteps every corporate control.

The response needs a one-page policy that names which data classes, including sub pricing, owner contracts, employee information, and anything under NDA, never go into unapproved tools. It also needs an approved tool that covers real use cases under a business-tier agreement with training exclusions and retention limits, plus a fast way to ask for help. If a tool takes six months to approve, employees will find another option.

Example in practice

For example, a $150M/year commercial GC surveys its 40 precon and project staff and finds 28 use a consumer AI tool at least weekly. Documents uploaded in the past month include 60-plus sub proposals, four owner contracts with negotiated terms, and the firm’s internal labor rate sheet, which a PE uploaded to help build a change order.

Leadership does not punish anyone. It publishes a one-page data policy, signs a business agreement with an AI vendor whose terms exclude training and cap retention at 30 days, rolls out the approved tool for the same use cases the survey found, and adds AI tool requests to the existing software request form with a two-week turnaround. The follow-up survey three months later shows consumer tool use down to 5 people, mostly for personal tasks.