Shadow AI in Construction: What Your Team Is Using - And What You Don't Know About It

New Zealand's construction sector is heading into 2026 in a period of reset. After years of cost escalation, labour shortages, and financial tightening, firms are operating with more discipline and fewer resources than they had two years ago. According to Hubexo's Construction Outlook for New Zealand 2026, the focus has shifted from chasing volume to selectivity and delivery confidence - and leaders across the sector are increasingly looking to technology as a practical lever in a constrained market.

That pressure is exactly why construction staff across NZ - from estimators to project managers to site supervisors - are quietly reaching for AI tools. Not because they've been told to. Because deadlines are real, resources are limited, and AI tools offer a faster path to a usable output.

Whether generic or sector-specific, the outcome is the same: shadow AI risks sending potentially sensitive company data into third-party AI tools. And in construction - where project financials, subcontractor relationships, tender pricing, and client agreements are commercially sensitive - that risk has specific consequences most firms haven't fully considered.

What Shadow AI Looks Like on a Construction Site and in the Office

Shadow AI in construction doesn't look like a rogue technology project. It looks like this:

An estimator using a public AI tool to draft a preliminary cost plan based on a project brief they've been given. They enter the client's name, project scope, site location, and preliminary specifications to get a faster first-pass document. The tool generates a convincing structure. The estimator refines it. The underlying project data is now on a third-party server.

A project manager summarising meeting notes from a site meeting using an AI transcription tool added to Teams several months ago. The transcript includes discussion of programme delays, subcontractor performance issues, a variation claim under negotiation, and commercially sensitive cost-to-complete figures. The full transcript is stored in a system the firm doesn't control.

A tender writer drafting a methodology section for a competitive bid using ChatGPT to generate initial content from a brief. The brief includes the client's name, contract value, site-specific constraints, and the firm's proposed approach. That approach - developed over weeks of internal discussion - is now in an external AI system.

A quantity surveyor using an AI pricing tool on a free trial to cross-check a bill of quantities. The tool ingests line items, specifications, and supplier pricing that the firm has negotiated. The trial terms permit using that data for model training.

A site supervisor using a public AI tool to draft a health and safety incident report after an on-site near-miss. The report includes the worker's name, the nature of the incident, the site address, and the subcontractor involved. That personal information has just been processed through an external AI platform with no data processing agreement with the firm.

None of these individuals were acting irresponsibly. Each found a tool that made their work faster and used it. The issue is that in every case, commercially sensitive or personally identifiable information left the firm's control - and nobody in management knows it happened.

Where AI Is Genuinely Creating Value in Construction

The instinct to use AI in construction is sound. The opportunity is real. With AI, firms are seeing materially stronger tender quality, tighter and more concise submissions, faster evaluations and quicker approvals - but as always, the output is only as good as the input.

Here's what well-governed AI use looks like in a construction context:

Estimating and cost planning - AI-assisted estimating tools can compress takeoff time significantly. Used with appropriate review - and with firm pricing data and client information kept within governed systems - the productivity gain is material. The key distinction is whether proprietary pricing data and client-specific project information leaves the firm's environment during that process.

Tender writing and bid preparation - AI can accelerate the drafting of methodology sections, quality plans, and standard-form responses within competitive bids. The risk is when a firm's differentiating approach, commercial strategy, or client relationship history is entered into a public AI tool to generate that content.

Programme and schedule drafting - AI-assisted schedule generation and programme management support is a genuine time saver for project managers working across multiple concurrent projects. Within a managed environment where project data is governed, this is low-risk and high-value.

Document management and site reporting - Using Microsoft Copilot within the firm's existing Microsoft 365 environment to draft site reports, summarise correspondence, or generate RFI responses keeps that work within the firm's data governance structure - a fundamentally different proposition from using a public AI tool for the same task.

Health and safety documentation - Drafting and refining safety plans, SSSP documents, and incident reports is an area where AI can reduce administrative burden significantly. The critical requirement is that personal information about workers and incidents is handled within the firm's governed systems, not external AI tools.

Subcontractor communications - Drafting and refining routine subcontractor correspondence, variation notices, and programme updates is a legitimate time-saving application when done within the firm's managed environment.

The consistent thread: AI capability within the firm's Microsoft 365 environment is a different proposition from public AI tools. The data doesn't leave. The governance framework already exists. The firm's confidential project information stays where it belongs.

The Specific Risks for NZ Construction Firms

Construction sits at an intersection of commercial sensitivity, personal information, contractual complexity, and regulatory obligation that makes shadow AI risk more layered than it first appears.

Commercially sensitive project data - Tender pricing, margin analysis, subcontractor rates, and project cost-to-complete figures are among the most commercially sensitive information a construction firm holds. When that information is entered into a public AI tool - even as part of a legitimate cost-checking exercise - it moves outside the firm's control. A competitor gaining access to a firm's pricing approach, even indirectly, has real commercial consequences.

Intellectual property in tender responses - The methodologies, innovation proposals, and technical approaches that distinguish a firm's tender from competitors are intellectual property. When those approaches are drafted using public AI tools, the data handling terms of most AI platforms are incompatible with that IP remaining confidential.

Privacy Act 2020 and worker information - Construction sites generate significant personal information - incident reports, health and safety records, worker certifications, subcontractor personnel details. Processing that information through external AI tools without adequate data governance creates Privacy Act exposure. This is particularly relevant for health and safety incident documentation, where the information involved is sensitive and the firm has specific legal obligations around how it's handled.

Contractual confidentiality obligations - Most NZ construction contracts - NZS 3910, NEC, and bespoke client agreements - include confidentiality provisions governing how project information may be used and disclosed. Using AI tools to process project information without considering whether those provisions permit it creates contractual exposure most firms haven't assessed.

Subcontractor and supplier relationship data - Pricing relationships with subcontractors and suppliers are often negotiated over years and represent genuine commercial advantage. That information - rates, terms, performance history - has real value to competitors. When it's entered into external AI tools, the terms under which it might be retained or used are not the firm's to control.

Health and safety compliance - NZ's Health and Safety at Work Act 2015 creates specific obligations around how health and safety information is documented and managed. AI-generated safety documentation that hasn't been properly reviewed - or that contains errors in how regulatory requirements are described - creates compliance risk the firm may not be aware of until it matters.

Inaccurate AI outputs in a high-stakes context - AI tools produce confident output that is sometimes wrong. In a tender context, a confident error in a methodology, a misquoted specification, or an inaccurate cost assumption that isn't caught in review creates both commercial and reputational risk. In a health and safety context, it creates compliance risk. Review by a qualified professional remains non-negotiable - which means AI assists the work but never replaces the professional judgement that goes with it.

The Visibility Problem in Construction

Deloitte's 2026 State of AI in the Enterprise report found that worker access to AI rose by 50% in 2025 alone, yet only one in five companies has a mature governance model to oversee how that AI is actually being used

Construction firms face a specific version of this challenge. The workforce is distributed - people on sites, in offices, working remotely, moving between projects. AI tools get adopted individually rather than organisationally, and the visibility gap between what's happening across the firm and what management knows about is wider than in a single-office environment.

The average enterprise has 14 distinct AI tools in use, while IT teams are aware of only four to five. In construction, where individual staff members are under significant delivery pressure and have significant autonomy over their own workflows, that gap is likely to be at least as wide.

Nearly 75% of construction companies have yet to move beyond initial discussions or have no capability or planning activity related to AI adoption, according to RICS research. The gap between firms actively governing AI and firms that haven't started the conversation is significant - and the firms that close that gap first will have a governance advantage that compounds over time.

AI features have also been progressively embedded into software construction firms already use - project management platforms, document control systems, Microsoft 365 - often activated through product updates without triggering any formal review. The result is AI processing happening across the organisation's environment without any governance decision having been made.

Visibility comes before policy. Understanding what's actually happening - which tools are in use, what project and personal data is being processed, where the configuration gaps sit in the firm's Microsoft 365 environment - is what makes subsequent policy and governance decisions informed rather than aspirational.

What Good AI Governance Looks Like for Construction Firms

Construction firms that approach AI governance well share a consistent starting point: they find out what's actually happening before they build policy around what they wish was happening.

That means gaining technical visibility into the AI tools and services connecting to the firm's environment - not asking staff to self-declare tools they might assume aren't permitted, but understanding the actual picture. It means reviewing the firm's Microsoft 365 configuration to understand which AI features are active and whether data governance settings are appropriate. And it means identifying which tools have data processing arrangements compatible with the firm's contractual confidentiality and privacy obligations - and which don't.

From that foundation, governance follows naturally:

An approved tool list that makes clear which AI tools are sanctioned for which types of work. An estimator who knows which estimating AI tools are approved and what project data can be used with them makes consistently better decisions than one who's choosing their own tools without guidance.

A simple, practical AI policy covering what project, financial, and personal information can and can't be used with AI tools, what review requirements apply before AI-assisted outputs go to a client or are relied upon commercially, and how new tools get assessed. Readable enough that site staff and office staff alike will actually follow it.

Specific guidance for high-risk workflows. Tendering, health and safety documentation, and subcontractor correspondence are the highest-risk AI use cases in a construction context. Each warrants specific guidance rather than generic policy.

Microsoft Copilot as the governed alternative. For firms on Microsoft 365 Business Premium, Copilot provides AI capability within the firm's existing data governance environment. It doesn't send project data to external AI models. It works within the firm's existing document and permissions structure. It's the practical alternative that lets staff capture the productivity benefits they're looking for without the commercial and compliance risk.

Executive visibility. Someone in the firm has a clear, periodic picture of how AI is being used, where the governance posture sits, and what the risks look like. In construction, where projects and teams change constantly, this requires active maintenance rather than a one-time review.

Gaining Visibility Before Building Policy

If your firm hasn't taken a structured approach to AI governance yet, the starting point isn't writing a policy. It's understanding what's already happening.

Most NZ construction firms that begin this process are surprised by the scope of what they find - not because staff have been doing something they knew was wrong, but because the tools arrived faster than the conversation, and the gap between what's in use and what's governed is wider than anyone expected.

NSP's approach starts with exactly that visibility - mapping the current state of AI adoption across the firm's Microsoft 365 environment, identifying shadow AI exposure, and reviewing configuration and governance posture before any policy work begins. For construction firms specifically, that exercise surfaces the contractual, commercial, and privacy implications that generic AI governance frameworks don't account for.

For firms ready to build a more comprehensive programme, NSP's Secure AI Accelerator provides a structured 12-month approach covering AI enablement, security, governance, and ongoing optimisation - with executive reporting that gives leadership a documented, evidenced picture of AI governance maturity. The programme starts where any genuine AI governance programme should: with visibility into what's actually happening, before making decisions about what should be.

The construction firms that will use AI most effectively over the next five years won't be the ones that banned it - banning AI doesn't work, with 46% of employees saying they'd continue using AI tools even after an organisational ban. They'll be the ones that understood what was already happening, made deliberate decisions about how it should work, and gave their people the tools and guidance to use AI as a genuine operational advantage rather than a commercial liability.

If you're not sure how much AI is already in use across your firm's Microsoft 365 environment, that's the question worth starting with. NSP can help you understand your current shadow AI exposure and governance readiness before you begin building policies or wider AI initiatives.

Talk to NSP about AI for your firm →

Or call us: 0508 010 101

Frequently Asked Questions

What is shadow AI in a construction firm? Shadow AI refers to AI tools being used by construction staff - estimators, project managers, tender writers, site supervisors - without formal approval or oversight from the firm's management. This includes public AI tools used for estimating, tender writing, project reporting, and health and safety documentation, as well as AI features embedded in existing software activated without a formal review. In construction, shadow AI is particularly significant because of the commercially sensitive project data, contractual confidentiality obligations, and Privacy Act implications involved.

What are the main risks of shadow AI for NZ construction firms? The primary risks are commercially sensitive project data - tender pricing, margin analysis, subcontractor rates - leaving the firm's control; intellectual property in tender approaches being processed through external AI systems; Privacy Act obligations being breached through unmanaged processing of worker and incident information; contractual confidentiality clauses being inadvertently breached; and AI-generated outputs containing errors that aren't caught before they're relied upon commercially or submitted to clients.

Can construction firms use AI safely? Yes - with appropriate governance. The critical distinctions are whether commercially sensitive project data and personal information stays within the firm's governed environment, whether AI outputs are reviewed before being submitted or relied upon, and whether the tools in use are compatible with the firm's contractual confidentiality obligations. Microsoft Copilot within a properly configured Microsoft 365 environment is the most common example of governed AI use in a construction context.

What should a NZ construction firm do about shadow AI? Start with visibility - understand what AI tools are actually in use across the firm, including AI features embedded in existing project management and productivity software. From that foundation, develop a practical policy, build an approved tool list with specific guidance for high-risk workflows like tendering and health and safety documentation, and implement Microsoft Copilot as a governed AI alternative within the firm's existing environment.

How does Microsoft Copilot help construction firms manage AI risk? Microsoft Copilot operates within the firm's existing Microsoft 365 data governance environment - it doesn't send project data to external AI models, and it respects the firm's existing permissions and access controls. For construction firms on Microsoft 365 Business Premium, Copilot provides AI capability for document drafting, meeting summarisation, email management, and data analysis without the commercial and compliance risk of public AI tools. Most firms on Business Premium are already paying for this capability without having activated it in a governed way.

Continue Reading

• Shadow AI in Legal Firms: What You Don't Know Is Happening
• Shadow AI in Accounting Firms: What You Don't Know Is Happening
• Cloud Drift Management: Why Security Doesn't Stay Fixed in the Cloud
• What Is Microsoft Entra ID and Why Does Every NZ Business Need to Understand It?
• Resilience Was Never Built During the Crisis - AI Governance for Canterbury Business
• NSP Secure AI Accelerator
• AI Governance - NSP
• Managed IT - NSP