An architect wants to test an AI tool on a live drawing set. The plan has room names, security zones, a client logo and a site address. Uploading it may take seconds; deciding whether the firm is allowed to do so takes longer. A data-use check should happen before the experiment, not after the tool produces an interesting answer. The question is not simply whether the AI vendor says the product is “secure.” It is whether this particular project permits this particular data to be processed in this particular service.
The AIA AI Firm Toolkit and its guidance on responsible use provide a starting point for firm governance. This article is a practical checklist for design teams, not a legal conclusion about every contract or privacy regime. Client agreements, local law and the tool’s current terms need individual review. The aim is to make an architect’s proposed use legible to the people who can authorise it.
Name the data, not just the file
List what the drawing contains: site location, client identity, floor layouts, security systems, occupant information, commercial plans, intellectual property and consultant material. A drawing can be sensitive even when no personal name appears. A data-centre plan, hospital layout or private residence may reveal operational facts the client expects the firm to protect.
Check whether the file contains metadata, hidden layers, comments or linked documents. Cropping the title block may not remove the underlying text or geometry. A model export can carry far more information than the visible plan. Ask a project lead to classify the data before choosing a tool. If you cannot explain what is in the upload, you cannot evaluate where it may go.
Also identify whose material appears. A consultant’s drawing, product data or contractor submission may be governed by a separate licence or agreement. The architect’s permission to use material for project delivery does not automatically grant permission to process it with a third-party AI service.
State the use case and minimum input
“We want to try AI” is not a project purpose. Write a narrow task: extract door tags for a schedule check, summarise an approved meeting note or compare two public design options. Then ask what minimum data is necessary. Could a synthetic sample, redacted excerpt or simple table answer the question? If yes, start there.
Do not upload an entire model when the task concerns one non-sensitive room schedule. Data minimisation reduces exposure and makes output easier to verify. It also helps the team understand whether the tool is actually useful. A tool that needs every confidential drawing to perform a small task may not be a good fit.
Record who will review the result and where it will be stored. A test that creates an output with no owner can spread unverified design claims through the team. A clear use case includes the human decision path.
Read the contract and tool terms together
The project agreement may restrict disclosure, subcontracting, storage location or use of client information. The AI service may have terms on retention, training, human review by the vendor, subprocessors, data location and deletion. These documents must be considered together. A vendor’s marketing page is not enough to establish the applicable terms for your account and plan.
Ask the firm’s authorised person to confirm whether the tool is approved for the data class and client. If the contract requires client consent or notice, follow that route. If the agreement is silent, do not interpret silence as blanket permission. The firm may still have professional, privacy and commercial obligations.
Do not promise clients that an AI provider never retains data unless the actual service terms and configuration support that claim. Enterprise settings can differ from free consumer accounts. Record the account and configuration used. A policy that says “approved AI tool” should name what level of data it is approved to receive and under which settings.
Check output ownership and reuse
If the tool generates a plan mark-up, description or image, ask how the firm may use it and what third-party terms apply. More important, check whether the output includes confidential input or invented project facts. A summary can reproduce a private room name. A generated image can expose an unpublished design. Treat outputs as project information requiring review and controlled sharing.
Keep attribution and intellectual property questions visible. A client’s commissioned design, a consultant’s detail and a vendor’s reference image may have different rights. The AI service does not magically consolidate those rights. If a final deliverable uses generated material, the project team should know what was generated, what was verified and how it may be licensed or disclosed.
Avoid placing an AI-created drawing directly into an issue set without human technical review. The legal and data-use questions do not replace normal quality control. Both are required for a responsible workflow.
Create an approval card
A one-page card can contain: project; proposed tool and account; task; files or data fields; sensitivity class; contract or client restrictions; vendor retention and training settings; access controls; output location; human reviewer; approval owner; expiry or recheck date. Attach links to the relevant terms rather than copying a reassuring sentence from a sales deck.
The card should be short enough to use before an ordinary experiment. If the answer is no, record what safe alternative is available: synthetic data, local processing, an approved enterprise tool or a manual review. A rejected upload does not mean the firm must abandon the idea entirely. It means the use case needs a different route.
Recheck approval when the vendor terms change, the project moves into a more sensitive stage or the team wants to use a new data type. Permission to summarise public planning material does not necessarily cover uploading a confidential security plan later.
Train the team on the boundary
An AI policy is ineffective if juniors only hear “be careful.” Show examples. A public competition brief may be acceptable for a test. A client’s unpublished floor plan may require approval. A redacted excerpt may still reveal a project through unique geometry. Ask staff to pause and classify data before copying it into a prompt.
Give a clear route for questions: project lead, data-protection or IT contact, and, when needed, legal or client representative. The answer should not depend on whether one technically confident person happens to be online. Keep a list of approved use cases and the reasons behind restrictions so the team can learn.
If a mistake happens, follow the firm’s incident process promptly. Do not quietly delete a chat and assume the exposure is gone. The service’s retention terms and the contract determine what action is needed. A blame-free reporting route makes it more likely that issues surface while they can still be addressed.
A job applicant’s version of the rule
For a firm, the same principle should apply to a trial proposed by a new hire. Give them a safe sample and explain the approved tool route. If the firm wants staff to explore AI, it needs a defined space for experiments; otherwise people may test with whatever file is closest. A small synthetic drawing set can reveal a tool’s strengths without exposing a client’s real plan or creating an uncontrolled copy of project data.
Do not upload a previous employer’s project drawings to an AI tool to improve your portfolio unless you have permission. The fact that you worked on a project does not necessarily give you the right to share its files with a third party. Use public, approved or recreated examples that do not reveal confidential details. Explain your workflow in an interview without exposing a client’s data.
If a prospective employer asks about AI skills, describe how you checked data permissions before testing a tool. That is a professional skill. A candidate who knows the boundary between experiment and authorised project use can help a firm adopt useful tools more safely.
Before uploading, ask: What is in this file, what is the narrow task, which agreement permits this service to process it, and who will verify the output? If you cannot answer, pause the upload and find the person who can.
Browse current architecture jobs on Jobs.archi and compare your next step with our guide to the gap between architecture school and practice.
The post Before Your Firm Uploads Client Drawings to AI: A Data-Use Checklist first appeared on jobs.archi.