AI governance for construction vendors: screening, contracting and verifying the AI your suppliers bring

Stage 1 is not a decision anyone took; it is the default produced by how construction buys. AI does not arrive at a contractor the way it arrives at a bank — through an IT procurement gate — it arrives inside packages: a progress-monitoring subscription bought by a project team, machine control that came with the hired excavator, a drone survey sub-let two tiers down. Each purchase was individually reasonable, and nobody is positioned to see the whole.

The tell is the register question. Ask who could list, today, every supplier whose system runs a model on live projects — including the plant fleet and the subcontractors' own tools — and at stage 1 the honest answer is nobody. The corporate IT list exists, but it covers the smallest of the three arrival routes. The exposure is not hypothetical: the firm is already relying on model output in valuations, programme reviews and safety conversations without knowing it has done so.

What makes stage 1 expensive is that every commercial event happens on the vendor's paper. The click-through terms that came with the subscription typically grant the vendor broad rights over uploaded site data, disclaim accuracy entirely, and permit model changes without notice. None of that was negotiated, because nobody knew a negotiation was happening.

Stage 2 firms have solved visibility and mistaken it for control. The register is real and the tender questions are good ones — where does our site data go, is it used for training, who are your sub-suppliers, what accuracy do you claim and on what evidence. What is missing is consequence: the vendor's answers live in a tender file, and the contract that follows is the standard subcontract or the vendor's own terms, which say none of it.

This gap is invisible until it is tested. The vendor that answered 'your data is never used for cross-customer training' at tender is bound by the master subscription terms it signed, which say the opposite. Tender answers are representations at best; recovering anything on them is a litigation exercise, not a contract-management one. The practical result is that a stage-2 firm has excellent documentation of promises nobody has to keep.

Stage 2 is also where screening quality matters most, because it sets what stage 3 can bind. A questionnaire built from a generic IT-security template misses the questions construction actually needs answered: whether the model was trained on projects like yours, what happens to accuracy in rain and low light, whether the vendor's own drone sub-processor sees your site imagery, and what notice you get when the model changes. The frameworks to borrow from are published — the NIST AI Risk Management Framework for the risk vocabulary, ISO/IEC 42001 for what a vendor's management system should be able to evidence — but the questions must be translated into site terms or the answers will be marketing.

Stage 3 is where governance crosses the company boundary and becomes enforceable. The instrument is unglamorous: a schedule of AI obligations appended to documents the industry already executes — an NEC option Z clause set, a JCT supplemental schedule, an addendum to the plant hire agreement. It does not rewrite the contract; it adds the eight or so obligations the standard forms were never drafted to carry: who owns site data and derived outputs, whether the vendor may train on them, what notice a model change requires, what accuracy is warranted and what a miss entitles you to, which decisions require a human, what happens at exit.

The character of vendor conversations changes here. At stage 2 the firm asks and hopes; at stage 3 it trades. Vendors — especially venture-backed ones whose product roadmap depends on training data — will resist the training-use bar and the change-notice clause, and the negotiation reveals more about the vendor than any questionnaire: the vendor that cannot say who its model provider is has just answered a different question. Some pushback is legitimate and priced; wholesale refusal on a tier-1 package is a selection result.

The limit of stage 3 is that paper binds conduct, not performance. A signed accuracy warranty does not make the model accurate on your site, in your weather, on your trades. The firm has obligations it has never tested and flow-down clauses it has never verified below tier one — which is why the move to stage 4 is about evidence, not more drafting.

Stage 4 replaces trust with measurement. The core instrument is the acceptance trial — construction already knows it as the SAT, and applying it to AI is a small conceptual step: before the progress-vision system's output enters a valuation, it runs for three weeks on one work section alongside the QS's measured quantities; before the safety-analytics alerts drive supervision, a month of alerts is reconciled against what supervisors actually found. The trial converts the vendor's warranted accuracy from a contract clause into a measured number on your site, your weather, your trades — and it is astonishing how often the two differ.

In-service oversight is the second half. Models change under commercial pressure: vendors retrain, swap model providers, ship new versions — and construction sites change too, from groundworks to fit-out, summer to winter. A system verified in April against a concrete frame may be materially worse in November against internal finishes. Stage-4 firms treat the contracted change notice as a trigger: notice arrives, a re-verification runs on the affected decision, and the result is logged where a client's auditor can find it. The evidence pack this produces — trial results, performance history, change log — is precisely what a stage-5 tender scoresheet consumes.

The discipline that keeps stage 4 affordable is proportionality. Not every vendor earns a trial: the tier the vendor was assigned at screening decides the depth — full trial and quarterly reconciliation for systems feeding valuations and safety, an annual spot-check for advisory tools. Firms that try to verify everything verify nothing within two quarters; the register's tiers are what make the workload survivable.

Stage 5 moves the unit of governance from the project to the portfolio. The instruments are familiar corporate ones: framework agreements with the AI schedule pre-negotiated, so a project calls off a progress-vision deployment the way it calls off scaffolding; an approved list per category — vision, survey, safety analytics, machine control, document AI — with entry earned by trial evidence and exit triggered by performance; and a vendor performance record that follows the vendor across projects, so the firm's own measured history, not the vendor's references, prices the next award.

What stage 5 buys is speed with control, and it is worth being precise about the mechanism. At stage 4 every project pays the governance cost locally — its own negotiation, its own trial design. At stage 5 the marginal project inherits the framework terms, the trial protocol per category, and the vendor's accumulated record; deploying a governed system on a new site becomes a two-week call-off instead of a two-quarter negotiation. Governance stops being the reason digital adoption is slow, which is the political result that keeps it funded.

The standing risks at stage 5 are concentration and staleness. An approved list hardens into a moat: the incumbent's record advantages it, challengers stop being trialled, and the firm wakes up dependent on one vendor for a decision class across the whole portfolio — which is why the exit plan is a stage-5 artefact, not a stage-3 one, and why it needs rehearsing against a live scenario: vendor acquired, vendor insolvent, model degraded and disputed. A list nobody has exited in two years is a list, not governance.