Blog · Third-party AI risk

Ask your consultants for their AI policy. Most don’t have one

By Jared Smith, Founder & CEO, SymphonIQ · October 17, 2026 · 11 min read

The long form of a LinkedIn post from October 14, 2026. Original on LinkedIn.

Your pursuit strategy, your pricing logic and your owner correspondence are leaving your company through outside firms that have no AI rules at all. The fix is three questions, asked before the next pursuit and written into the contract: Do you have a written AI policy, and can we see it? Which AI tools touch our work? Can anything we send you be stored or used to train a model?

An AI policy for contractors is the written set of rules a construction or engineering company sets for which AI tools may touch its work, what data may go into them, who reviews the output and who signs it. Many firms now have one for their own people. Few extend it to the consultants, subcontractors, design partners and proposal writers who hold the same files. That gap is where the risk now lives.

Why does your AI policy stop at the front door?

Because it was written to control employees and company devices, and the people who most often hold your most sensitive files are not employees. Your estimators follow your rules. Your IT team locked down the tools. Then a consultant gets your pursuit strategy, your pricing logic and the reasons you win.

I have watched consultants paste a client’s differentiation into a free AI model to “clean up the deck.” No policy. No contract terms. No idea where the data went, or what it is being used for now. They were not malicious. They were as new to AI risk as everyone else. That is the problem.

AI use is now normal across the industry. In the Associated General Contractors of America’s 2026 Construction Hiring and Business Outlook, a survey of 951 contractors, 61% of respondents said their firms use AI or plan to increase AI investment, up from 44% a year earlier; 23% apply it to estimating and 20% to design or preconstruction. Every one of those firms is somebody’s sub, consultant or design partner. The question is whose rules they follow when your files are open on their screen.

Here is who typically holds your data on a large pursuit, and what usually governs their AI use:

If the right-hand column reads “usually nothing” for the firms on your current pursuit, you have found the gap before it finds you.

What goes wrong when an outside firm uses AI on your files?

Five things, in rough order of how often I see them. Each has a quick way to confirm it and a fix.

1. Your data trains someone else’s model. OpenAI’s own help documentation states: “When you use our services for individuals (Free, Plus, Pro), we may use your content to train our models.” The same page says that by default it does not use inputs or outputs from ChatGPT Business, Enterprise, Edu or the API for training. The difference is the account type and a settings toggle, and the consultant on your pursuit may not know which one they are on. Samsung banned generative AI tools for staff in May 2023 after engineers uploaded internal source code to ChatGPT, as Forbes Australia reported at the time. A pricing model or a win theme is no different. Confirm it: ask which account type they use and whether training is off. Fix it: make “no training on our data” a contract term, not a verbal assurance.

2. Nobody can say which tools touched the work. When you ask a firm which AI tools touch client work and the answer is “whatever the team uses,” that is the finding. Unnamed tools cannot be reviewed, logged or switched off. Confirm it: ask for the list. Fix it: require a named inventory of tools used on your work, and require notice before it changes.

3. Numbers and clauses that nobody computed or checked. A general-purpose model will produce an entire deliverable on request: an estimate narrative, a schedule analysis, a claim letter, with figures no tool computed and clause citations nobody traced to a page. Construction runs on numbers, clauses and deadlines, and a fluent paragraph with an invented unit rate is how you lose a claim. Confirm it: pick one number in the last deliverable and ask where it came from. Fix it: require that a named person review any AI-assisted deliverable against sources, and that the reviewer’s name travel with the document.

4. The record disappears when the engagement ends. Prompts, outputs and uploaded files sit in the consultant’s account, not your project record. When the engagement ends, or their employee leaves, that history is gone or, worse, still there and outside your control. Confirm it: ask whether they can export and delete everything of yours on request. Fix it: retention, export and deletion terms, with a date.

5. Your insurer or surety asks, and you cannot answer for your partners. Underwriters have moved past “do you use AI.” Jeff Kulikowski of Westfield Specialty told Business Insurance in April 2026 that the questions are now “What models are you currently utilizing?”, “How did the business decisions get made to utilize these models?” and “What checks and balances are in place to make sure the AI models produce accurate and verifiable results?” On the surety side, Carl Oliveri of Grassi wrote for NASBP in July 2026 that sureties should judge how AI is governed rather than whether it is used, and that “decisions should be traceable to a responsible individual, a documented process, and a clear review trail.” If part of your proposal was produced by a consultant’s unnamed tool, you cannot give that answer. Confirm it: try to answer those three underwriter questions for your last submitted proposal, outside firms included. Fix it: the three questions below, on file for every firm.

What are the three questions to ask every outside firm?

Ask these before the next pursuit, in writing, and keep the answers with the agreement.

If the answer to the first question is no, you just found the gap. That is not a reason to drop the firm. It is a reason to hand them a policy and put the terms in the contract. They are as exposed as you are.

How do you put an AI policy for contractors into the contract?

Have counsel add four things to the engagement letter, subcontract or teaming agreement. This is a checklist for that conversation, not legal advice.

1. Which policy applies. Either the outside firm’s written AI policy, attached as an exhibit, or yours, flowed down. Name the document and its version.
2. Named tools and data limits. The tools permitted on your work, by name and account type, and the categories of your data that may not go into any AI tool at all. For a contractor that usually means bid and subcontractor pricing, owner correspondence, privileged claim analysis and anything under an owner NDA.
3. No training, bounded retention, export and deletion. Nothing you send may be used to train a model for anyone else. Your material and the interaction data about it are returned or deleted on a stated date, with an export first.
4. Human review and a named signer. Any AI-assisted deliverable is reviewed by a named person who checked figures and citations against sources, and that name is recorded with the deliverable.

We published those four items, expanded into twelve model provisions with a Word rider, as the AI clause your subcontract is missing.

Then make it routine: the three questions at onboarding, the terms in every new agreement, the questions again at renewal. Firms change tools between engagements and vendors change terms between versions.

What if the firm does not have an AI policy?

Give them one. We published a free AI policy template for contractors that a construction company can adopt in a week: version 1.1.5, 13 sections, PDF and editable Word, with the full text readable on the page. It is a template, not legal advice. Counsel should adapt it to your existing contracts.

Two sections do the work for this problem. Section 6 covers confidential information, privilege and discoverability: subcontractor pricing is named as confidential, confidential data goes only into approved tools, and contract terms must say that interaction data is not used to train models for others, is not over-retained and can be exported. Section 9 is a written vendor questionnaire: where the data lives, no training on company data, no mixing with other customers’ data, export and deletion, access logging, source citation, model version control and a dated security audit. Hand those two sections to a consultant and they have most of what they need to answer your three questions properly.

How do you keep the gap from reopening?

Keep the project record somewhere the outside firm’s tools cannot reach, and make your own AI use something you can describe on one page to an underwriter, a surety or an owner.

That second part is how we built SymphonIQ. It runs in one private environment per customer, on AWS or in your own cloud account. Nothing is pooled. Nothing is trained across customers. If you leave, the environment is deleted with your files in it. Inside it, the model writes the sentence, but a calculation tool produces every number, every clause traces to a page and paragraph, and an authorized person signs before anything counts. The governance architecture that enforces this is patented. Our SOC 2 Type I audit is underway, with Type II to follow, and the controls are listed on our security page.

None of that governs your consultant’s laptop. It does mean the pursuit record, the pricing logic and the decisions live in an environment you own, with receipts. The version an outside firm holds is a copy of something you control, not the only copy that exists.

When should you escalate?

Treat it as an incident the moment you learn an outside firm has put your files into a tool nobody approved. Get three facts in writing the same day: which tool, which account type, and whether training was turned off at the time. Then talk to counsel about the contract and to your broker about coverage. ENR reported on October 9, 2026 that insurers of design and contractor liability policies have not added AI exclusions and do not expect to soon, with AXA XL’s Michelle Chia saying “the short answer is we are not applying AI exclusions.” The same article notes a Gallagher advisory, reproduced by ISO, that a generative AI exclusion is “beginning to appear” on commercial general liability policies, with coverage gaps that could affect bids and prequalification. Coverage for an AI-assisted error is unsettled. Do not assume it is there.

Frequently asked questions

Bring us one live pursuit

If you want to see what a governed project record looks like with your own files in it, book a 30-minute working session. Bring one live pursuit, the list of outside firms on it, and the person who signs. We will show you where every number comes from and who signed it.

Sources

1. Associated General Contractors of America, 2026 Construction Hiring and Business Outlook (survey of 951 contractors, November 4 to December 15, 2025). agc.org
2. OpenAI Help Center, “How your data is used to improve model performance.” help.openai.com
3. Forbes Australia, “Samsung bans ChatGPT among employees after sensitive code leak” (May 2023). forbes.com.au
4. Matthew Lerner, “Insurers, brokers adjust as AI exclusions emerge,” Business Insurance, April 7, 2026. businessinsurance.com
5. Carl Oliveri, “Risk Multiplier or Mitigator? What AI Adoption Tells Sureties About Contractor Maturity,” NASBP, July 8, 2026 (republished by FASA, October 5, 2026). fasacares.org
6. Richard Korman, “AI Exclusions Won’t Soon Be Popping Up in Designer Liability Insurance Policies,” ENR, October 9, 2026. enr.com
7. SymphonIQ, AI Policy Template for Contractors, v1.1.5, October 2026. symphoniq.ai