Growing Design Firms Need an AI Risk Strategy, Not Just an AI Policy.
Artificial intelligence has quickly moved from something design firms were talking about to something their employees are actually using.
Project managers are using it to summarize meeting notes. Designers are using it to develop concepts. Engineers are testing it for calculations, specifications and code research. Administrative teams are using it to draft proposals and correspondence. Some firms have formally approved these uses. Many have not.
This creates an interesting risk management problem. The question is no longer whether your firm should allow employees to use AI. In many firms, that decision has effectively already been made by the people doing the work. The real question is whether the firm has established enough structure around that use to understand where its risk is coming from.
For growing firms, particularly those with multiple offices, disciplines and project teams, this becomes more important because inconsistency tends to increase with scale. One project manager may be very conservative about using AI while another incorporates it heavily into their workflow. One department may use an enterprise platform approved by IT while someone else enters project information into a free public tool. From a professional liability and risk management standpoint, those distinctions matter.
AI Doesn't Change Professional Responsibility
One of the easiest mistakes to make with AI is to treat it as though it somehow sits outside the normal professional standard of care. It doesn't. If an architect or engineer relies on AI-generated information in performing professional services, the firm's responsibility for the resulting work doesn't disappear simply because a software program produced part of it.
The same principle already applies to spreadsheets, design software, code databases and other technology. AI is simply more complicated because it can produce information that looks authoritative even when it is incomplete or wrong. The practical risk isn't necessarily that AI makes a mistake. People make mistakes too. The bigger concern is automation bias, or the tendency to give greater credibility to something because a sophisticated system produced it. This becomes particularly dangerous when AI is being used for code interpretation, calculations, life-safety issues, accessibility requirements or technical specifications.
The appropriate control is not necessarily prohibiting AI. It is making sure the firm's quality-control process recognizes where AI is being used and requires an appropriate level of independent verification.
Not Every Use of AI Creates the Same Risk
A useful AI policy should distinguish between different levels of use. Using AI to improve the wording of an internal email is very different from asking it to interpret a building code provision. Using it to summarize meeting minutes is different from using it to develop a structural calculation. Using it to brainstorm design alternatives is different from incorporating AI-generated technical information into construction documents.
Trying to regulate all of those activities the same way will either create an unnecessarily restrictive policy or one that doesn't provide much protection. Instead, firms should consider categorizing AI use according to risk. Low-risk activities might require little more than basic review. Moderate-risk uses might require verification against an independent source. High-risk activities involving technical design, regulatory compliance or life safety should require review by the appropriate licensed professional just as if the work had been prepared by another member of the design team. That approach allows the firm to benefit from the technology without pretending every application carries the same exposure.
The Bigger Risk May Be What Employees Put Into the System
There is another issue that receives less attention but may ultimately create just as much exposure: data. Employees routinely work with confidential client information, proprietary designs, contracts, financial information, project schedules and other sensitive materials. If that information is entered into an AI platform, the firm needs to understand where the information goes, how it is stored and whether the provider can use it for other purposes.
The fact that an AI application is easy to access doesn't mean it has been vetted for professional use. This is where risk management, IT and operations need to overlap. Firms should establish which AI platforms are approved, what information can be entered into them, and whether project or client-specific information needs to be removed or anonymized before use. Project managers also need to understand whether the client contract places restrictions on confidential information, intellectual property, cybersecurity or the use of AI itself. A firm policy cannot override a contractual obligation.
Contracts Will Begin Catching Up
This is another area worth watching. Owners and sophisticated clients are beginning to think about how AI is being used within professional services. It is reasonable to expect (and we have already seen) contracts and RFPs to increasingly address AI-generated work, ownership of data, disclosure requirements and responsibility for AI-assisted design. Design firms should be careful about agreeing to provisions that create a higher standard of care simply because AI is involved. For example, a contractual promise that all AI-generated information will be "accurate," "complete" or "error-free" creates an obligation that likely exceeds what the design professional could reasonably adhere to.
The better position is generally that AI remains a tool used in performing the firm's professional services, and the resulting services remain subject to the same professional standard of care applicable to the rest of the firm's work.
The Policy Is Only Part of the Solution
Writing an AI policy is relatively easy. Getting 150 employees across several offices and disciplines to consistently follow it is much harder. That is why the better risk-management approach is to build AI governance into the firm's existing project-management system rather than treating it as a standalone technology initiative.
At a minimum, firm leadership should understand:
-
Which AI platforms employees are actually using.
-
What project information is being entered into them.
-
Which uses require independent technical verification.
-
Who is responsible for approving new AI applications.
-
Whether client contracts restrict AI or data use.
-
How significant AI-assisted decisions are documented within the project file.
-
Whether subconsultants are using AI in ways that could affect your firm's deliverables.
None of these controls need to make the firm less innovative. In fact, the opposite may be true. Employees are more likely to experiment productively when they understand the boundaries.
The Risk Isn't Using AI. It's Using It Without Knowing How You're Using It.
AI will almost certainly become more embedded in design practice, not less. For firms trying to grow, improve productivity and manage increasingly complex projects with limited staff, that presents a significant opportunity.
But efficiency does not eliminate professional responsibility. The firms that manage this transition best probably won't be the ones that prohibit AI or the ones that adopt every new tool first. They will be the firms that understand where AI adds value, where it creates meaningful risk, and where human professional judgment still needs to control the process. That is ultimately the same risk management discipline successful design firms already apply everywhere else.
Know where the risk is. Decide who owns it. Put reasonable controls around it. And make sure the process actually reflects how people are working.