Guide · For engineering and construction companies
An AI risk framework for contractors
What to write down before the underwriter asks: the NIST framework in contractor terms, controls by stakes, and a register you can start Monday.
Underwriters have stopped asking whether you use AI. They are asking which models, how you decided to use them, and what checks make sure the results are accurate. An AI risk management framework is how you answer with documents instead of assurances. This is one written for contractors: the NIST framework translated into the work you actually do, a risk register by workflow, controls that scale with the stakes, and a 90-day start.
You do not need a compliance department or a certification to do this. You need to write down four things: who decides, where AI is used, how you know it is working, and what you do when it is not. Most of it fits on a few pages, and the first version can be done in a month.
Why contractors need one now
Three audiences are asking, and they all want the same evidence.
Insurers. Jeff Kulikowski of Westfield Specialty told Business Insurance in April 2026 that underwriting questions are now: what models are you using, how did the business decide to use them, and what checks and balances make sure the results are accurate and verifiable. The same reporting covered general liability AI exclusion endorsements from Insurance Services Office that some carriers are adopting. Design and contractor liability carriers have, as of ENR’s October 2026 reporting, largely not added AI exclusions. Coverage is unsettled; the questions are not.
Sureties. Carl Oliveri of Grassi, writing for NASBP in July 2026, advised sureties to judge how a contractor governs AI rather than whether it uses it, and to look for decisions traceable to a responsible individual, a documented process and a clear review trail. That is a description of a framework.
Owners and counsel. Construction lawyers have spent 2026 pointing out that standard contract forms say nothing about AI, and owners are starting to add their own terms. When the owner’s rider arrives, the contractor with a framework signs it; the one without starts writing one under deadline.
Meanwhile the use is already there. In the AGC’s 2026 outlook survey, 61% of contractors said their firms use AI or plan to increase AI investment, with 23% applying it to estimating. A framework does not decide whether you use AI. It decides whether you can show your work.
NIST AI RMF and ISO 42001, in one paragraph each
The NIST AI Risk Management Framework (AI RMF 1.0, published January 2023) is a free, voluntary framework from the U.S. National Institute of Standards and Technology. It organizes AI risk work into four functions: Govern (policy, roles, accountability), Map (understand the context and where risks arise), Measure (assess and test), and Manage (treat risks, respond, improve). In July 2024 NIST added a Generative AI Profile (NIST AI 600-1) that applies the framework to large language models and similar tools. It is the vocabulary underwriters and large owners increasingly use.
ISO/IEC 42001:2023 is the first international standard for an AI management system. Where NIST describes a risk method, ISO 42001 describes an auditable management system, with policies, objectives, controls (including for third parties) and a plan-do-check-act cycle, and it can be certified. Few contractors need certification today. Building to NIST’s four functions gets you most of the way there if a customer ever asks.
The framework: Govern, Map, Measure, Manage, for contractors
Who decides, in writing
A named executive owner. A written AI use policy with approved tools, prohibited uses and data limits. A rule for who may approve high-stakes AI-assisted work. The same expectations written into subcontracts and consultant agreements.
Where AI touches the work
An inventory by workflow: pursuit, estimating, contracts, scheduling, field, closeout. For each, the tool, the account type, the data that goes in, and the decision the output feeds. Include outside firms; they hold your files too.
How you know it works
Before relying on a tool for a workflow, test it on work you already know the answer to. While it is in use, log errors caught and errors introduced. Spot-check citations and figures against sources on a schedule.
What you do about it
Controls scaled to the stakes (below). An incident procedure for data entered into the wrong tool or an AI error that reached an owner. A broker conversation before renewal. A review of the whole framework every six months.
Each function maps to a section of the free AI policy template for contractors: Govern to its sections on governance, approved tools and acceptable use; Map and Measure to its sections on human review and records; Manage to its sections on monitoring and incidents, and insurance. If you adopt the policy, you have the Govern function and the skeleton of the rest.
Controls by stakes: three tiers
The mistake most frameworks make is applying the same weight of control to everything, which means either strangling low-risk use or under-protecting the decisions that matter. Scale the control to what the output can cost.
Internal, low stakes
Summarizing meeting notes, first drafts of internal emails, reformatting documents, searching your own files.
Minimum controlsApproved tools only. No restricted data. The user reviews before relying on it.
Leaves the company
RFIs, submittal cover letters, proposal narrative drafts, owner updates, schedule narratives.
Minimum controlsTier 1, plus a named reviewer checks facts and references against sources before it goes out. Keep the reviewed version.
Commits the company
Prices and estimates, notices and change order positions, claim narratives, contract interpretation, anything touching a stamped design, safety decisions.
Minimum controlsTier 2, plus every number traceable to a calculation and every clause to a page. An authorized person signs, and the record shows who decided on what evidence. No consumer AI accounts, ever.
Tier 3 is also where people are most tempted to overstep, because a chat model will produce a confident price or a notice letter on request. The control has to run both ways: the tool must not close a Tier 3 decision on its own, and a person must not delegate one to it. The guide to AI in construction has more on that failure mode.
A starter risk register
Start with these rows, delete what does not apply, and add an owner’s name to each. A register that fits on one page and is actually reviewed beats a long one nobody opens.
| Use | What can go wrong | Tier | Controls | Evidence you keep |
|---|---|---|---|---|
| Employees using consumer AI with project data | Bids, owner correspondence or privileged material leave the company; may be used for training | Tier 3 | Policy prohibits consumer accounts for project data; approved enterprise tools provided; training | Policy acknowledgments; approved-tool list; account settings |
| Outside firms using AI on your files | Same as above, outside your control; AI-assisted deliverables arrive unlabeled | Tier 3 | AI rider in subcontracts and engagement letters; the three questions at onboarding | Signed riders; Schedule A per firm; answers on file |
| Proposal and pursuit drafting | Invented claims about experience or approach; confidential owner material in the wrong tool | Tier 2 | Drafts from your own past material in approved tools; proposal lead reviews every statement | Reviewed final; reviewer’s name |
| Estimating support | A generated number enters a bid; scope gap missed | Tier 3 | AI may find, check and flag; numbers come from takeoff, history and calculation tools; estimator signs | Estimate with sources; reviewer; error log |
| Contract and notice review | Wrong clause, missed deadline, mis-stated notice period | Tier 3 | Every answer cites the clause; a person reads the clause; counsel on disputes | Cited answer; who acted on it; date |
| Claims and change order records | Narrative overstates or misstates the record; AI drafts become discoverable | Tier 3 | AI assembles and cites the record; a person owns the narrative; drafts handled under counsel’s direction | Record with source links; drafts per policy |
| Schedule analysis | Invented durations; float misread | Tier 2–3 | Scheduling software computes; AI narrates; scheduler reviews | Schedule files; reviewed narrative |
| Field vision (progress, safety detection) | False alarms stop work; real hazards missed | Tier 3 (safety) | Qualified person verifies before acting; independent safety judgment preserved | Alerts and dispositions |
| Licensing, certification and continuing education | A credential certifies work the person did not do | Tier 3 | Policy prohibits AI completing credential requirements; managers reinforce | Policy acknowledgment |
What underwriters and sureties ask, and the document that answers
| The question | The document that answers it |
|---|---|
| What AI models or tools are you using? | Approved-tool list with account types; inventory from the Map function, including outside firms |
| How did the business decide to use them? | The AI use policy, its owner, and the approval record for each tool |
| What checks make sure results are accurate and verifiable? | Tier definitions; reviewer requirements; testing and error logs from the Measure function |
| Are decisions traceable to a responsible individual? | Tier 3 sign-off records: who decided, on what evidence, when |
| What happens when something goes wrong? | Incident procedure; incident log; corrective actions |
| Do your subs and consultants follow the same rules? | Signed AI riders and Schedule A for each firm (model rider here) |
The first 90 days
Write it down
Name an executive owner. Adopt a written AI use policy; the template is built for this. Survey project teams for every AI tool in use, including the ones nobody approved, and ask your top ten outside firms the three questions. Fill in the register with an owner per row.
Control the stakes
Move all Tier 3 work to approved, business-grade tools, or stop AI use there until you can. Add the AI rider to every new subcontract and consultant agreement. Test one Tier 3 workflow on work you already know the answer to before relying on it.
Make it provable
Start the error log: errors caught and errors introduced, by workflow. Run one tabletop incident: an estimator pasted bid pricing into a consumer chatbot; what happens in the first 48 hours? Take the policy, register and tool list to your broker before renewal and write down the answers.
At day 90 you can answer every question in the table above with a document. Review the whole framework every six months, and whenever you add a tool or a customer adds a requirement.
Where SymphonIQ fits
This framework is vendor-neutral and works with whatever tools you approve. SymphonIQ is governed AI built for engineering and construction companies, designed so that Tier 3 work is governed by default: one private environment per customer, every number computed by a tool, every clause cited to its page, an authorized person signing before anything counts, and the record kept. If you want to see that on one of your own live projects, bring it to a 30-minute working session.
Questions people ask
What is an AI risk management framework?
A written way of deciding which AI uses a company allows, what can go wrong with each, what controls apply, who owns them, and how the company checks that the controls work. The best-known is the NIST AI Risk Management Framework (AI RMF 1.0), which organizes the work into four functions: Govern, Map, Measure and Manage.
Does a contractor need ISO 42001 certification?
Usually not. ISO/IEC 42001 is the international standard for an AI management system and can be certified, but certification is a significant program. Most contractors get most of the value from a written policy, an inventory of AI use, controls scaled to the stakes, and a record. If an owner or customer later requires certification, that foundation is the starting point.
How do you assess AI risk on a construction project?
List every place AI touches the project, including tools used by subcontractors and consultants. For each, note what data goes in, what decision the output feeds, and what happens if it is wrong. Rank by stakes: anything that feeds a price, a notice, a claim, a stamped design or a safety decision is high-stakes and needs a named human reviewer and a record.
What will insurers and sureties ask about AI?
Underwriters have begun asking which AI models a company uses, how it decided to use them, and what checks make sure the results are accurate and verifiable. Sureties are being advised to judge how AI is governed rather than whether it is used, looking for decisions traceable to a responsible individual, a documented process and a review trail. A framework is how you answer those questions with documents instead of assurances.
Where should a contractor start?
With three documents in the first month: a written AI use policy, an inventory of where AI is used today (including by outside firms), and a one-page register of the high-stakes uses with an owner and a control for each. Everything else in a framework builds on those.
General information, not legal or insurance advice. Have counsel and your broker review your framework against your contracts, policies and jurisdiction.
Sources
- National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023. nist.gov
- NIST, AI RMF: Generative Artificial Intelligence Profile, NIST AI 600-1, July 2024. nist.gov
- ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system. iso.org
- Matthew Lerner, “Insurers, brokers adjust as AI exclusions emerge,” Business Insurance, April 7, 2026. businessinsurance.com
- Carl Oliveri, “Risk Multiplier or Mitigator? What AI Adoption Tells Sureties About Contractor Maturity,” NASBP, July 8, 2026 (republished by FASA). fasacares.org
- Richard Korman, “AI Exclusions Won’t Soon Be Popping Up in Designer Liability Insurance Policies,” ENR, October 9, 2026. enr.com
- Associated General Contractors of America, 2026 Construction Hiring and Business Outlook. agc.org
- “When Your Scheduler Hallucinates: Managing AI Risk on the Job Site,” ConsensusDocs, February 16, 2026. consensusdocs.org
About the author
Jared Smith is the founder and CEO of SymphonIQ, governed AI for engineering and construction firms. He spent twenty years on the contractor's side of large infrastructure pursuits before building the platform.