AI-assisted tools are already inside most practices, whether leadership has sanctioned them or not: drafting text, summarising documents, generating imagery, writing scripts. The productivity upside is real. So is the governance gap.
The risks specific to AEC
Design practices trade on intellectual property and client confidentiality. Pasting project information, client details or unreleased designs into consumer AI tools may transfer that material outside your control, in ways that can conflict with client agreements and data-protection obligations.
Accuracy matters too: AI output that looks authoritative still needs professional review before it informs a design decision, a specification or a contractual document.
What a proportionate policy covers
Good AI policies are short. They name the approved tools and accounts, define what data may and may not be entered, require human review of outputs used in deliverables and give staff a clear route to request new tools rather than adopting them quietly.
Pair the policy with sanctioned, business-grade tools so the compliant path is also the convenient one, shadow AI thrives where the official answer is simply “no”.
Where the model runs
Most AI policies stop at which tools are approved. The harder question is where the processing happens. A tool inside your own Microsoft 365 tenant, a model running on hardware in your building and a consumer app on a personal login are three completely different answers to a client asking where their project data went. Practices with framework or public-sector obligations increasingly need the first two rather than a promise about the third.
Governance as an enabler
Handled well, governance accelerates adoption: staff experiment confidently inside known guardrails, clients get credible answers about how their data is handled and the practice builds an honest picture of where AI genuinely helps.
There is now an international standard for managing AI, ISO 42001, built along the same lines as ISO 27001 for information security. Certification is not something most practices will pursue, but the structure it describes, a defined scope, named owners, assessed tools, recorded decisions and periodic review, is a sound model for a practice policy whether or not you ever get audited against it.
WIT is certified to ISO 27001 and ISO 9001. We are extending both to cover AI under ISO 42001. We help practices define approved toolsets, configure enterprise controls, deploy private models where client obligations require it and align AI use with their wider information-security duties.