Is AI Safe for Engineering Firms? The 5 Real Risks, and How to Control Each One

Yes, AI is safe for engineering firms when they use it with controls. The danger isn't the technology itself. It's three habits: staff pasting client data into consumer chatbots, firms trusting AI output that nobody has checked, and engineers sealing work they didn't really direct. Each of these has a known fix.

So is AI safe for engineering firms? It depends on which data goes into which tool, and on who reviews the output. This guide is for principals, PMs and office managers at small and mid-sized engineering and surveying firms. It covers what ASCE, NSPE and the ACEC Research Institute say, five specific risks with a control for each, how insurers see AI, and a policy checklist you can adopt this month.

Key takeaways

• Professional bodies don't ban AI. They say the engineer stays accountable. The ACEC Research Institute's 2026 study concludes that "Licensed engineers remain responsible for engineering decisions regardless of how AI is used."
• The biggest everyday risk is data leakage through personal accounts. Microsoft found 80% of AI users at small and mid-sized companies bring their own AI tools to work.
• Consumer ChatGPT plans (Free, Plus, Pro) may train on your content unless you opt out. ChatGPT Business and Enterprise, and Microsoft's Copilot, don't train on business data by default.
• As of October 2026, ENR reports that insurers aren't adding AI exclusions to design professional liability policies. That could change, so check every renewal.
• Admin work such as minutes, reminders and invoices carries the least risk, because nothing is sealed and a person can approve each output before it goes out.

What do engineering bodies say about AI safety?

Every major US engineering body that has addressed AI says the same thing: use it if you like, but the licensed engineer stays responsible for the result. None of them prohibits AI.

• ASCE Policy Statement 573 (adopted July 18, 2024) says "AI cannot be held accountable, nor can it replace the training, experience, and judgement of a professional engineer." (ASCE)
• NSPE Position Statement 03-1774 (revised February 2026) calls for "rigorous verification & validation, testing, and continuous monitoring of AI systems," and asks engineers to respect privacy laws when handling personal data. (NSPE)
• The ACEC Research Institute's "Leading Through AI Risk" (August 2026) drew on a literature review and interviews with 21 industry leaders. Its central finding: "Artificial intelligence does not reduce the engineering profession's responsibility." It sorts AI risk into eight domains, from model reliability to data governance and leadership, and argues AI risk is mainly an organizational problem, not an IT one. (ACEC Research Institute)
• The Florida Board of Professional Engineers' executive director put it plainly: "AI can assist your work, but it cannot replace your professional judgment or accountability." (FBPE)

The most useful guidance is a real ethics case. In NSPE Board of Ethical Review Case 24-2, an environmental engineer used an open AI tool to draft a groundwater report and an AI drafting tool to produce plans. The engineer checked the report thoroughly but gave the plans only a cursory review. The client found misaligned dimensions and missing safety features required by local regulations.

The board's conclusions map neatly onto the risks below:

1. Using AI was "not unethical per se."
2. Uploading the client's information to an open AI tool without permission was "tantamount to placing the Client's private information in the public domain."
3. Sealing AI-assisted plans without keeping responsible charge over the tool's output was unethical.
4. There's no automatic duty to disclose AI use, but "Ethical principles favor transparency when AI plays a substantial role in generating work products."

What are the real risks of AI for an engineering firm?

Five risks matter in practice. Each one is manageable once you name it, and each has a specific control.

Five risks, five controls. None of them is a reason to avoid AI altogether.

Risk 1: AI gives confident wrong answers

Generative AI can produce false information that sounds right. NIST's Generative AI Profile (NIST AI 600-1, July 2024) calls this confabulation: "confidently stated but erroneous or false content." Microsoft's own Copilot documentation says responses "aren't guaranteed to be 100% factual."

The best-known warning comes from law, not engineering. In Mata v. Avianca (June 2023), a federal judge fined two lawyers and their firm $5,000 for filing a brief that cited cases ChatGPT had invented. The judge said there's nothing "inherently improper" about using AI, but professionals have a "gatekeeping role" to ensure accuracy (LawSites). The same logic applies to an engineer citing a code section or a design value.

The control: match the review to the stakes. A wrong action item in internal meeting notes is cheap to fix. A wrong load, code section or boundary call is not. Require a source for any factual claim, check it against the source, and never let AI output go to a client or agency unread.

Risk 2: client data leaks through personal AI accounts

This is the risk most likely to hit a small firm this year. Microsoft's 2024 Work Trend Index, a survey of 31,000 knowledge workers, found that 78% of AI users bring their own AI tools to work. At small and medium-sized companies the figure was 80%. If your firm hasn't given staff an approved tool, assume they're using their own.

What happens to that data depends on the plan. OpenAI's data usage page says that on its individual plans (Free, Plus and Pro) "we may use your content to train our models," unless the user turns off "Improve the model for everyone." On ChatGPT Business, Enterprise and the API, OpenAI's enterprise privacy page says "We do not train our models on your data by default."

Samsung learned this the hard way in 2023. According to Fortune, one employee uploaded confidential source code to ChatGPT, and another shared a whole meeting so the chatbot could write the minutes. Samsung responded by temporarily banning generative AI tools for work. Meeting minutes are exactly the kind of task an engineering PM might hand to a chatbot.

The control: give staff an approved business-tier tool, so they don't need personal accounts, and adopt a simple data-sorting rule (see the three tiers below). A ban alone tends to push use out of sight rather than stop it.

Risk 3: professional liability and the seal

AI doesn't change who is liable. It changes how easy it is to slip. The AIA Trust's 2025 professional liability review, built on interviews with ACEC and NSPE, reports that "negligence is evaluated based on outcomes and professional responsibility, regardless of the tools used." Carriers, it says, focus less on the technology itself and more on quality control and professional judgment.

The licensure risk is responsible charge: the requirement that the engineer directly controls and supervises the work they seal. Case 24-2 shows the failure mode: the problem wasn't using an AI drafting tool, it was a cursory review before sealing.

On insurance, the news is reassuring for now. ENR reported on October 9, 2026 that insurers aren't adding generative AI exclusions to design professional policies. AXA XL's chief underwriting officer for design professions told ENR "we are not applying AI exclusions" and that its A&E forms "are agnostic as to how the matter occurs." The same article notes that an AI exclusion is "beginning to appear" on commercial general liability policies, and that one carrier's absolute AI exclusion applies to some directors-and-officers and E&O lines, though not, so far, to any design or construction policy.

The control: keep the engineer directing AI-assisted technical work as it happens, not just reviewing it afterward. Record what the AI did and what the engineer checked. At every renewal, ask your broker in writing whether any AI exclusion or endorsement applies to your professional or general liability policies. This is general information, not legal or insurance advice.

Risk 4: security, and AI agents that can be tricked

Engineering firms are already a target. Deltek's 2026 Clarity A&E study of 896 firms found 93% had a cyber attack attempt in the past three years, and about 1 in 5 had a successful attack that caused financial or reputational damage. 52% named data and cybersecurity as a top AI challenge.

AI adds one new kind of attack worth understanding: prompt injection. OWASP ranks it first on its Top 10 for LLM applications. In the indirect form, hidden instructions sit inside content the AI reads, such as an email, a PDF or a web page. If an AI agent can send email or update records, a malicious message could try to make it do something you didn't intend.

The control: OWASP's own recommendations are the right ones for a firm. Give each AI tool or agent only the access its task needs, and "implement human-in-the-loop controls for privileged operations." In plain terms: an agent that drafts invoice reminders shouldn't be able to change bank details, and anything that leaves the firm should pass an approval step until the agent has a long, clean track record.

Risk 5: intellectual property and ownership

Two questions come up: who owns AI-assisted deliverables, and could AI output copy someone else's work? On the first, the US Copyright Office concluded in its January 2025 report that AI outputs are protected only where a human author has determined sufficient expressive elements, "but not the mere provision of prompts." Using AI to assist doesn't remove protection from a human-authored work.

On the second, Microsoft says it doesn't claim ownership of Copilot output. It also commits to defend commercial customers sued for copyright infringement over Copilot output, provided they used its built-in guardrails.

The control: keep engineers as the real authors of reports and design documents, check AI-drafted text for copied passages (Engineer A in Case 24-2 did this), and read your contracts for any client clauses on AI use or deliverable ownership.

Is ChatGPT safe for engineering firms?

A business-tier ChatGPT plan is reasonably safe for most firm work. A personal account isn't the place for client data. The same is true of other assistants: the plan matters more than the brand.

Sources: OpenAI's data usage and enterprise privacy pages; Microsoft Learn, "Data, Privacy, and Security for Microsoft Copilot." Terms as of October 2026; vendors change them, so recheck yearly.

One Copilot point catches firms out. Microsoft says Copilot "only surfaces organizational data to which individual users have at least view permissions." That protects you only if your SharePoint and Teams permissions are right. If the whole firm can open the HR or fee folder, Copilot can surface it too. Tidy permissions before you roll it out.

For a comparison of the main assistants and what they cost, see our roundup of the best AI tools for engineering firms.

A three-tier rule for which data can go where

Most firms don't need a long data classification scheme. Three tiers cover almost everything:

• Green: public. Published codes, manufacturer data sheets, your own marketing copy, public RFPs. Any approved tool is fine.
• Amber: internal and client project data. Drawings, reports, meeting recordings, fees, client emails. Only business-tier tools the firm has approved, signed in with work accounts. Check client contracts for restrictions.
• Red: restricted. Anything a contract or regulation restricts, such as critical infrastructure details, personal data or a client's explicit no-AI clause, plus final sealed documents. Keep these out of general AI tools unless the client agrees and the setup has been vetted.

Green goes anywhere approved, amber only to business-tier tools, and red stays out of general AI tools.

Which AI uses are safest for an engineering firm?

Risk rises with two things: how hard an error is to spot, and whether the output carries a seal. That gives a practical ranking, which you can use to decide where to start. It complements the task-by-task fit table in our guide to what AI automation handles in an engineering firm.

Original ranking by Suntex Labs, based on the professional guidance cited in this article. Your firm's risk tolerance may differ.

The review step is what makes AI safe: drafts that fail go back, and only approved work leaves the firm.

The top of the table is where most firms should begin. These tasks recover real hours, errors are easy to catch, and none of them touches the seal. For examples across the firm, from proposals to point clouds, see 14 ways engineering firms use AI.

How to write an AI policy for an engineering firm

A useful AI policy fits on two pages. The ACEC Research Institute stresses that AI risk needs coordination across operations, technology, HR and leadership, not just IT, so get a principal to own it. Cover these eight points:

1. List approved tools and plans. Name the business-tier tools staff may use, and state that personal AI accounts must not be used for firm or client data.
2. Adopt the three data tiers. Green, amber and red, with examples from your own work.
3. Set review rules by risk. Use the risk table above. Anything sealed stays under the engineer's direct control from start to finish.
4. Require sources for facts. Any code section, standard, statistic or design value from AI must be checked against the original.
5. Limit agent access. Each AI agent gets only the systems and permissions its task needs, and anything external goes through an approval step at first.
6. Decide on disclosure. NSPE favors transparency when AI plays a substantial role. Decide when you'll tell clients, and check contracts for AI clauses.
7. Check insurance every year. Ask your broker in writing about AI exclusions or endorsements on professional and general liability policies.
8. Train, log and review. Show staff the policy with real examples, keep a simple log of AI use on projects, and revisit the policy every six months.

Rolling out AI agents adds a few practical steps, such as approval thresholds and a pilot period. The agent rollout checklist and the Academy lesson on approvals and rollout cover them.

Example scenario: a 12-person structural firm writes its first AI policy

Example scenario: from personal chatbots to an approved setup This is an illustrative example, not a real client.

The situation: A 12-person structural engineering firm has no AI policy. During a project review, a principal learns that one PM has been pasting geotechnical reports into a personal ChatGPT account to summarize them, and another uses a free AI note-taker for client meetings. Nobody knows whether those accounts train on the content.

What they do: The principal adopts a two-page policy based on the eight points above. The firm moves everyone onto one business-tier assistant with work sign-in, classifies geotech reports and client meetings as amber data, and rules that AI may summarize reports but every design value comes from the original. It tidies SharePoint permissions before turning on Copilot features. Minutes and submittal reminders move to AI with PM approval. Calculations and drawings stay entirely under engineer control. The firm asks its broker, in writing, whether any AI exclusion applies at renewal.

The likely outcome: If this firm looks like the small and mid-sized companies in Microsoft's survey, where 80% of AI users brought their own tools, unapproved use was probably wider than two PMs. The policy turns hidden use into visible, approved use on tools that don't train on client data by default. The firm keeps the time savings and gets a written record of its review practice, which is exactly what Case 24-2 shows boards look for.

Conclusion

AI is safe for engineering firms that control three things: which data goes into which tool, who checks the output, and who stays in responsible charge of sealed work. ASCE, NSPE, the ACEC Research Institute and state boards agree that AI doesn't shift responsibility away from the engineer. As of October 2026, insurers aren't treating AI as a reason to exclude design professional claims.

The recommendation: give staff an approved business-tier tool this month, adopt a short policy with three data tiers and risk-based review, and start your AI use with low-risk admin work before moving anywhere near sealed documents.

FAQs

Is ChatGPT safe for engineering firms to use?

A business-tier plan such as ChatGPT Business or Enterprise is suitable for most internal work, because OpenAI says it doesn't train on business data by default. Consumer plans (Free, Plus, Pro) may use content for training unless the user opts out, so keep client data out of personal accounts. Either way, check every factual output.

Does professional liability insurance cover mistakes made with AI?

Generally, a claim involving AI-assisted work is treated like any other negligence claim. ENR reported in October 2026 that design professional insurers aren't adding AI exclusions, and AXA XL said its A&E forms are agnostic about how an error occurs. Policies differ and terms change, so confirm with your broker at each renewal.

Can an engineer seal drawings or reports prepared with AI?

Professional guidance doesn't forbid it, but the engineer must be in responsible charge: directing and controlling the work, not just reviewing it afterward. NSPE's Board of Ethical Review found that sealing AI-assisted plans after only a cursory review was unethical. Check your own state board's rules.

Do we have to tell clients we use AI?

There's no general rule requiring it, unless your contract says so. NSPE's ethics board noted that "Ethical principles favor transparency when AI plays a substantial role in generating work products." Many firms disclose substantial AI use on deliverables and check each contract for AI clauses.

Should an engineering firm ban AI?

A ban is rarely effective. Microsoft's research found most AI users bring their own tools to work, so a ban tends to push use onto personal accounts where the firm has no control. An approved tool plus a short policy usually reduces risk more than a ban.