Ask a construction firm whether it uses AI and the official answer is mostly no. The ONS put it at 13% of construction firms with ten or more staff in July 2026, the lowest of the industries it reports. Ask the people who work in those firms and you get a different picture. Microsoft's UK survey found that 71% of UK employees have used unapproved consumer AI tools at work, and Deloitte found that 31% of people using generative AI for work do so without their employer knowing.
Both sets of numbers can be right, because they measure different things. A business survey asks the firm what AI it uses, and a firm can only report what it knows about. That gap is what people now call shadow AI.
What it looks like on an ordinary day
A bid manager pastes a client's tender documents into the free version of ChatGPT to help draft a response. A site manager asks a chatbot on their phone to write up a near miss, names and all. Neither of them has done anything malicious and both have saved time. But the tender and the names now sit with an AI company, on terms the firm never agreed to, and nobody has a record that it happened.
What leaves the building
On a personal account, free or paid, the AI company can usually use what staff type to improve its AI unless the user switches that off or declines when asked. The firm has no contract with the AI company and no record of what went in. A business account the firm has approved keeps data out of training by default, comes with a contract, and gives IT control.
So the working question for an MD is which information can go where. Contract letters, drawings and BIM models, tender pricing, site photos with faces and number plates in them, CVs and structural or temporary works calculations should never go into a personal account, and go into an approved one only within your policy and your client's terms.
The rules already expect you to know
There is no UK AI act, but construction firms still answer to professional bodies, data protection law, their clients and their insurers. The RICS standard on responsible use of AI has been mandatory for RICS members and regulated firms since 9 March 2026, and one of its rules covers all AI use: no uploading of private or confidential data without the written consent of the people it concerns. Personal data in a member of staff's personal chatbot account is still the firm's responsibility, and the firm cannot find it, hand it over or delete it when someone asks.
Each of these assumes the firm knows which tools touch client, personal or safety information. With shadow AI, by definition, it does not.
Why banning it loses
The instinct is to lock it down. The trouble is that any tool the firm provides is up against the free one already open on everyone's screen.
We worked with a recruitment firm whose staff had found a browser add-on that could click through their customer database and update records for them. The firm switched it off, for sensible reasons, and the time saving went with it. So we connected their AI assistant directly to the database instead, doing only the jobs they wanted: look up a record, update it, log a call. The time saving came back, inside a tool the firm could see and set rules for.
Take away a tool that saves someone half a day, and you have built your own opposition.
Where to start
Find out first. Run an anonymous survey asking which tools people use, for what, and how much time it saves them. Promise no consequences and keep the promise. Then provide one approved tool that everyone can use with their normal work login, and write the policy last, from what the survey found.