AI data security in construction comes down to three questions. Which project data can the system see? What can it do with that data? Who can prove afterwards what it did? Firms that answer those before rollout tend to keep control. Firms that leave the answers to individual employees end up with unsanctioned tools holding drawings, tenders and contract terms nobody approved.
This guide covers the threat picture for the sector, the AI-specific risks that sit on top of it, the guidance that now shapes what a reasonable program looks like, and a checklist for evaluating any AI platform that touches project documents.
02
03
It is tempting to treat AI security as a new discipline. In construction it is mostly the old discipline, with higher stakes. The Wipfli research report describes the sector as one of the most targeted for cyberattacks, with 228 ransomware victims recorded between April 2023 and March 2024 and phishing behind 91% of breaches.
The maturity gap is worse than the headline. According to a CMAA paper on improving cyber defenses, 80% of executives call cybersecurity controls critical, yet 70% lack endpoint detection and response tools and 56% have no written incident response plan. Controls are endorsed on paper and absent in practice.
The structural reasons are familiar to anyone who has run a project. A single job involves the owner, the designer, the general contractor, a dozen subcontractors and suppliers, each with their own systems and their own email. The ABC ransomware defense guide lists an expanding attack surface from digital transformation among the sector’s data security weaknesses. Every new tool that ingests documents adds one more place where project data lives.
The practical consequence: an AI platform is not secured by its own controls alone. If the surrounding environment has no multi-factor authentication, no endpoint monitoring and no incident plan, the best AI vendor in the world cannot compensate.
04
Project documents are not generic text. They carry commercial and operational value that is easy to underestimate.
| Data type | Why it matters | Typical exposure |
|---|---|---|
| Tender documents and price schedules | Reveal margins, strategy and supplier terms | Pasted into a public chatbot to summarize or compare bids |
| BIM models and drawings | Show design intent, and for critical infrastructure, physical layout | Uploaded to tools for quantity extraction without review |
| Geotechnical and survey data | Often client-confidential, sometimes tied to critical assets | Shared by email, then reprocessed by assorted tools |
| Contracts and claims correspondence | Legal position, dispute strategy | Summarized by whichever AI tool is at hand |
| Personnel and safety records | Personal data, regulatory exposure | Fed into analytics tools with unclear retention |
A second category of risk is less about leakage and more about integrity. Deloitte’s analysis of AI in construction points out that construction data is fragmented across project tools, and that if underlying data is unsourced or inconsistent, the output of any AI built on it cannot be trusted. A model that confidently quantifies from a superseded drawing revision is a security problem of a quieter kind: the record itself has been corrupted.
05
The most common exposure is not an attack. It is an engineer with a deadline and a free chatbot. Commentary on the UK NCSC’s position, summarized by Secarma, treats unauthorized AI use as a major vulnerability that arises when sanctioned tools are slow or inefficient, and advises providing secure alternatives that fit real workflows rather than simply blocking.
The lesson for a contractor is blunt. A ban without a usable replacement moves the behavior out of sight. People who need to check a 300-page specification against a code requirement will find a way to do it, and the way they find will not be logged.
Physical and digital controls both belong in the same conversation. Site-level measures such as portable video surveillance equipment protect the jobsite, but they do nothing about a drawing set pasted into an unapproved web form from the site office. Treat the two as separate layers of one security posture.
Assistants that only answer questions have a small blast radius. Agents that plan, call tools and act on documents have a larger one. The UK NCSC’s guidance on managing the cyber risk of agentic AI recommends naming the individuals or groups responsible for agent activity, keeping human oversight of its actions, monitoring in real time and restricting the agent’s access to only the resources the task needs. It also advises denying network traffic by default and allowing only what is required.
Practitioners describe the same pattern as a deny-by-default environment: isolated agent compute, restricted network access and unique non-human identities for each agent. For a construction firm, the translation is simple. An agent that prepares a quantity report should not be able to read HR files, and its credentials should be revocable without touching a human user’s account.
The same systemprompt.io guide identifies the tool-call interface as a frequent failure point. Anyone with write access to a document can plant hidden instructions in a file the agent later retrieves, which hijacks the agent’s actions through ordinary data flow. This is called indirect prompt injection.
Construction is unusually exposed to it, because documents arrive from outside as a matter of routine: subcontractor submittals, supplier datasheets, tender returns from bidders who are, by definition, interested parties. An AI system that reads those files and can also act on internal systems needs separation between reading and acting, and a human checkpoint before anything consequential leaves the building.
06
No single US statute governs AI in construction data handling. What exists is a layer of guidance that is formally voluntary and practically influential.
None of this converts into a certificate. What it supplies is a vocabulary for the board and the insurer: documented risk assessment, defined ownership, incident planning and evidence of controls.
07
Deloitte’s finding is the one most often ignored: a common pitfall is to delegate AI governance to IT as a policy exercise. Its construction analysis argues for executive ownership, decision rights and escalation paths defined before a tool goes live, and for emphasis on transparency, accountability and reliability alongside technical security.
A workable minimum for a contractor or consultancy:
For teams starting with a specific use case, our piece on rolling out construction risk AI with workflow and governance walks through how those decision rights look in a real rollout.
08
Marketing pages rarely answer the questions a security reviewer cares about. Put these in writing and expect written answers.
A vendor that cannot answer the traceability and sign-off questions is selling a black box, and in an engineering setting a black box is a liability regardless of how clever it is.
09
We build Yesper as an AI civil engineer, and we start from a position that may sound odd for a software company: an AI that cannot be reviewed should not be trusted with engineering work. Security in this field is not only about keeping outsiders out. It is about being able to show, afterwards, what the system read, what it assumed and what it produced.
That is why Yesper writes down its assumptions, so a reviewer can check them the way they would check a colleague’s, and why we emphasize traceability and source verification as part of the product rather than an add-on. A deliverable that arrives without its reasoning shifts the burden of proof to the person who signs it. Our view is that the reviewing engineer should be able to follow the chain from output back to the document that supports it.
We also think the industry has the shadow AI debate partly backwards. Telling engineers not to use general chatbots does little if the approved alternative cannot read a BIM model or a stack of tenders. People use what works. A purpose-built tool, used across the organization and connected to existing systems, gives security teams something they can actually govern, instead of a hundred private experiments.
Finally, human sign-off is a design principle, not a limitation. Our notes on keeping human sign-off with AI for BIM and on tender analysis with human signoff describe where we think the checkpoint belongs. Governance that sits with executives, as the Deloitte analysis argues, only works if the tooling gives them something concrete to own.
10
Security reviews tend to fail when they come last. If your team is weighing AI for document search, compliance checks, quantity takeoff or deliverable creation, bring security, legal and the project executives into the evaluation from the first call. Our overview of construction software integrations explains why mapping existing systems first prevents integration surprises later, and the connection scopes are exactly what a security reviewer will want to see.
Yesper is used by teams at companies such as AFRY, NRC Group and Netel, and is built for construction and infrastructure work from the ground up. If you want to see how it handles source verification and review in practice, you can book a demo or read more about the company.
Owners and executives who care about the broader business case can also read why quality and accountability matter for property owners: the same logic applies when an AI output is the basis for a decision, because someone remains accountable for it.
FAQ
Treat it as unsafe unless your firm has approved the tool and its terms. Tender prices, drawings and client-confidential data should only go into tools that have passed your security review and whose data handling terms you have read. Staff who lack an approved option are the main driver of shadow AI, so provide one.
For most firms it is the unmanaged basics, not exotic attacks. The CMAA paper reports 70% of firms without endpoint detection and 56% without a written incident response plan. Phishing, which the Wipfli report ties to 91% of breaches, remains the usual way in, and AI tools connected to compromised accounts inherit the problem.
It is an attack where hidden instructions sit inside a file that an AI agent later retrieves, so the agent acts on the attacker’s text. Construction handles many externally supplied documents, such as submittals and tender returns, so the exposure is real. The defense is separating reading from acting and requiring human approval for consequential steps.
It should not sit with IT alone. Deloitte’s analysis identifies delegating governance to IT as a common pitfall and recommends executive ownership with decision rights and escalation paths set before launch. IT implements the controls, but leadership decides what the AI may do.
Much of it is voluntary, but legal commentary suggests it can become the yardstick for reasonable care if a breach is litigated. That makes it worth aligning with, especially for firms working on critical infrastructure. Ask your counsel how it applies to your contracts and jurisdictions.
Sources
This post was written with AI assistance and published by Yesper. General information, not professional advice: requirements vary by project and jurisdiction, and the professional responsible for the project decides what applies. Spotted an error? Write to benjamin@yesper.ai.
Get news and articles in your inbox.
Yesper is the AI civil engineer for construction and infrastructure. AFRY, COWI, NRC Group and other Nordic firms use it to halve the time on a study, rerun calculations in minutes, and catch errors that would otherwise slip through. Get in touch if you'd like to see what it can do for you.
Book demo