.svg)
Key Takeaways
- AI is already making its way into construction back offices. Without clear guidelines, employees could unknowingly expose sensitive company and project information.
- A subcontractor's AI policy doesn't need to be complicated. Start by defining approved tools, acceptable uses, data restrictions, and who reviews AI-generated work.
- Some information should never go into AI tools. Keep payroll records, bank details, and login credentials out. Restrict contracts, pay apps, and lien waivers to approved company tools.
- AI can assist with billing, but people should make the final decisions. Require human approval for pay apps, change orders, lien waivers, and other financially or legally sensitive work.
- An AI policy isn't something you write once and forget. Review AI features in your existing software, vet vendors' data practices, and update your policy quarterly.
Picture this: a PM pastes a subcontract into ChatGPT and asks for a summary of the retainage clause. It takes ten seconds, and the answer is good. It also just moved your contract terms and pricing into an unapproved tool with data usage terms nobody has read.
Most subs are closer to that scenario than they’d like to admit, and many reading this article right now might’ve just muttered “oh shit.” You’re not alone. According to a 2025 ManageEngine survey, 93% of employees admit to using AI tools without company approval. More specifically (as summarized by KiteWorks), “32% have entered confidential client data into unapproved AI platforms, 37% have shared private internal company data through unauthorized tools, and 53% use personal devices for work-related AI tasks.”
With stats like that, businesses must take action. According to the 2026 AGC and Sage Construction Hiring and Business Outlook, 61% of firms said they use AI or plan to increase their AI investment, up from 44% a year earlier. Office and administrative work—back-office territory—was the most common use, at 45%. That means if your accounting team isn’t currently using company-sanctioned AI, there’s a good chance they’re using personal accounts for platforms like ChatGPT, Claude, or Gemini. Without rules and regulations, employees are more likely to err on the side of convenience than caution, even if they mean well.
So, let’s get some rules cooking. We'll walk through how to create an AI policy for your subcontracting business, look at examples from real contractors, and cover how to protect sensitive billing and payroll data.
Why do subcontractors need an AI policy?
Without an AI policy, employees are left to make their own judgment calls about which tools to use, what information to share, and how much to trust the results. This can put sensitive project data at risk and leave mistakes unchecked.
More companies are recognizing the need for these guardrails, but putting them into practice is another story. In Littler’s 2026 Annual Employer Survey, 68% of respondents (~300 U.S. executives, in-house lawyers, and HR professionals) said their organization has a formal AI policy, up from 38% in 2025. But only 55% have a formal review process for AI tools, and just 54% restrict what employees can enter. The difference comes down to what the policy actually covers, and whether employees can realistically follow it.
What should an AI policy for subcontractors include?
A good AI policy doesn’t need to be long or complicated. Two pages are enough to establish some ground rules around which tools employees can use, what information they can share, and when human oversight is required. Some companies call this an AI acceptable use policy or an AI usage policy, but the point is the same. Here’s what it should cover:
What do subcontractor AI policies look like?
Let’s look at two AI policy examples from real contractors. For privacy's sake, I’ve stripped company identifiers. One example allows only named tools, and anything new needs committee approval. The other allows open use of AI platforms but limits what information goes in.
Both policies leave out a few important considerations we covered above:
- What billing, A/R, and lien waiver data employees can share with AI tools
- How employees should report AI-related mistakes
- How often the policy should be reviewed and updated
For subcontractors—particularly those with small accounting teams—a good starting point combines Policy A’s approved-tool approach with Policy B’s clear restrictions on what employees can share.
What data can employees share with AI tools?
Not all information carries the same risk. A generic Excel formula is one thing; a signed lien waiver tied to a specific project and GC is another. Consider setting the following guidelines for what employees can share with AI tools:
- Never enter into general-purpose AI tools: Social Security numbers, bank and routing numbers, passwords, ERP and GC portal credentials, and sensitive employee or payroll records. This information belongs in systems specifically authorized to handle it.
- Company-approved tools only: Contracts, bids, change orders, pay applications, schedules of values, vendor pricing, A/R aging reports, WIP schedules, and signed lien waivers. Only share this information through tools your company has approved for that purpose.
- Generally acceptable in approved tools: Public information, generic Excel formulas, and anonymized templates that contain no confidential company, customer, or project details. Review AI-generated results before using them.
When in doubt, employees should check with their policy owner before uploading anything.
Which billing and accounting decisions require human approval?
AI can help subcontractors prepare and review billing documents, but people should retain final approval over decisions that affect payments, contractual obligations, or legal rights. Your policy should make those boundaries clear for common tasks, such as:
Lien waivers and rights deserve extra care because forms and requirements vary by state, meaning that an AI-generated waiver might look correct, but fail to meet applicable requirements. Before relying on AI, make sure you understand your state's lien waiver requirements and mechanic's lien laws, and consult legal counsel when necessary.
How do you roll out an AI policy for subcontractors?
The best AI policy is one your employees can realistically follow. That means understanding how they're already using AI, involving the right people in setting the rules, and making sure they have access to approved tools that meet their needs. Here's how to get started:
- Inventory current use. Ask employees which AI tools they use, including features built into your existing software. Encourage honest answers so you know what you’re working with.
- Name a policy owner. Make one person responsible for the policy (CFO, controller, IT manager, or operations leader), with input from finance, IT, HR, and operations.
- Draft a practical policy. Use the nine components above as your guide. Keep it concise, include examples relevant to your business, and have legal counsel review it.
- Train by role. Tailor training to each department's workflows, and make sure employees understand the work well enough to catch AI mistakes.
- Review and update regularly. Revisit the policy quarterly, update your approved-tool list, and make sure employees know how to report AI mistakes or concerns.
Having the right tools in place can also make your policy easier to follow. For example, Siteline gives subcontractors one place to manage pay apps, lien waivers, change orders, compliance (including lien rights), and collections. It also integrates with your existing ERP, helping you keep sensitive billing information organized in a purpose-built system rather than scattered across spreadsheets, inboxes, and unapproved AI tools.
Curious how Siteline could work for your team? Schedule a demo to find out.
FAQ
Do small subcontractors need an AI policy?
Yes. A small team can expose data as easily as a large one through an unapproved AI tool. You don’t need a lengthy policy to address that risk. A short document outlining the approved tools, data restrictions, and who reviews AI-generated work is a good starting point.
Can employees use ChatGPT for work at a construction company?
Only if your policy allows it. If it does, specify which accounts employees can use, what information they can share, and when human review is required. Employees shouldn’t enter confidential project, financial (such as pay apps, pricing, and payroll data), or personal information into unapproved ChatGPT accounts.
What information should never go into an AI tool?
Keep Social Security numbers, payroll and certified payroll records, bank and routing numbers, and ERP or GC portal logins out of general-purpose AI tools. Contracts, pay apps, pricing, and signed waivers should only be shared through tools your company has approved.
Who should own the AI policy?
Assign one person to maintain it, such as the IT manager, CFO, controller, or operations director. They should work with representatives from finance, IT, HR, and operations to ensure the policy reflects how employees actually use AI.
How often should we update our AI policy?
Quarterly is a good starting point, or sooner when your company adopts new tools or features. Keep your approved-tool list separate so you can update it without rewriting the entire policy.
Can AI approve pay apps or change orders?
No. AI can help prepare and approve them, but a person with experience in this arena should maintain final approval. That includes verifying pay app amounts and approving change order scope and pricing before anything goes to the GC.
This post is general information, not legal advice. Have counsel review your AI policy before you roll it out.
AIA®, G702®, and G703® are registered trademarks owned by The American Institute of Architects and ACD Operations, LLC. Siteline is not affiliated with The American Institute of Architects or ACD Operations, LLC. Users who wish to use Siteline’s software to assist in filling out AIA® forms must have or secure the AIA® forms. Siteline does not and will not provide users with the forms.
%202.webp)
