Architecture Firm AI Policy: Free Template + Rollout Guide

An architecture firm AI policy needs six things: approved tools with required account settings, a ban on client data in any other tool, risk tiers, a client-disclosure line, a use log, and one named owner with a review date. The risk tiers send anything touching codes, life safety or contracts to the architect of record, and rollout takes about 30 days, with a first review at day 90.

Below: a copyable two-page template in plain text, a vendor account-settings table checked on 20 October 2026, a 30-day rollout plan, and our own test. On 20 October 2026 we ran 5 policy tasks (risk-tier classification, vendor-terms reading, a disclosure clause, a training quiz, an AI use log row) through two model families, one run each, with fictional, non-confidential inputs.

Does a small architecture firm actually need a written AI policy?

Most small practices do not have one, and most practices use AI anyway. According to the RIBA AI Report 2026 (survey March-April 2026, over 1,100 respondents), 74% of practices use AI on at least some projects, while around 19% have a documented AI policy. The gap between those figures is the reason to write one: the tools are already in your office, often on somebody’s personal account.

The RIBA AI Report 2026 (survey March-April 2026) breaks the figure down by size: among small practices (one to nine staff), 43% have no plans to develop a policy and 29% do not see the need, while 56% of large practices (50+) have one. A year earlier, the RIBA AI Report 2025 (survey January-April 2025, just under 500 respondents) put the overall figure at 15%.

Two sources in design-liability insurance point to the same need. Beazley (4 March 2025) reported that 90% of design professionals in an informal webinar poll (January 2024, around 500 attendees) had no staff training or procedures for AI, and recommends “a formal, written policy detailing the permissible and impermissible uses of new technology”. Victor’s A&E practice leader Kevin Collins told Insurance Business (16 October 2026) that AI-assisted design is “covered generally in the policy”; the article ran under the headline “AI won’t sink A&E firms. Poor governance will”.

Professional bodies say the same. The AIA’s Guidance for the Responsible Use of AI (updated 22 October 2025) asks firms to “Assign clear responsibility for oversight of AI tools and outputs” and to write internal policies on approved systems, data privacy, intellectual property and ethical and legal standards. The RAIC statement (28 April 2026) says Canadian architects and firms “must protect confidential, proprietary, and personal information when selecting and using AI tools”. For EU firms, Article 4 of the AI Act has added a staff AI-literacy duty since 2 February 2025.

What should an architecture firm AI policy cover?

A workable architecture firm AI policy covers eight things. They are scope, approved tools with required settings, data rules, risk tiers, verification rules, client disclosure, images and intellectual property, and a use log with a named owner and a review date. The AIA’s guidance asks for the same core: approved systems and use cases, data privacy and confidentiality, intellectual property, ethical and legal standards, and regular review.

How our template compares with the two sample policies in the AIA AI Firm Toolkit:

Criterion	AIA sample policy (short)	AIA sample policy (detailed)	This template
Length	About 2 pages	About 6 pages; adds a RACI matrix and an AI use log appendix	About 1,200 words (two pages)
Written for	US firms, AIA Code of Ethics anchors	US firms, AIA Code of Ethics anchors	Architecture firms of 2 to 50 people, any country
Sealed documents and codes	Yes - Low/Medium/High/Prohibited tiers	Yes - same tiers, plus roles	Yes - High tier, architect of record approves
Vendor account settings	No vendor-by-vendor table	No vendor-by-vendor table	Dated settings table on this page
Rollout plan	Not in the sample file	Not in the sample file	30-day plan on this page
Cost	Free Word download	Free Word download	Free, plain text
Who it’s for	US firms wanting an AIA-anchored start	US firms wanting roles and a log appendix	Small practices wanting a two-page start

Compared: 20 October 2026, from the published documents (document review; no test run).

The template: copy it, fill the brackets, adopt it

The template below runs about 1,200 words and covers the ten sections a small firm needs. Fill the square brackets with your firm’s names, tools and dates, delete what does not apply, and have your lawyer and your professional liability insurer read it before anyone signs. It is a plain-text architecture firm AI policy, so it pastes into any document system and can be kept under version control.

The AIA AI Firm Toolkit (full release 10 August 2026) offers free short and detailed sample policies in Word, with Low/Medium/High/Prohibited risk tiers; the detailed version adds a RACI matrix and an AI use log appendix. That is the deeper resource for US firms. Ours is shorter, in our own wording, and written for firms of 2 to 50 people in any country.

[FIRM NAME] - AI USE POLICY
Version [1.0] - adopted [adoption date] - owner: [AI lead name] - next review: [review date]

1. PURPOSE AND SCOPE
This policy sets out how [Firm name] uses artificial intelligence (AI) tools, to protect client confidentiality and keep professional responsibility where the law places it. It applies to everyone working for or with [Firm name], including freelancers.
It applies according to what the AI contributes to a task, whatever the product is called: chat assistants, image generators, code and specification assistants, transcription tools, and AI features built into software we already use. If a feature drafts, summarises, translates or analyses something that goes into our work, this policy covers it.

2. OWNER AND PRECEDENCE
[AI lead name], [role], owns this policy - one named person, so that questions get answered and reviews happen. The owner keeps the approved-tools list current, decides grey areas, records incidents and runs the review in section 10.
Precedence: applicable law first; client contracts second; this policy third. Where a client contract says nothing about AI, that silence is not permission; ask the owner before using AI with that project's confidential material.

3. APPROVED TOOLS AND REQUIRED SETTINGS
Only tools on this list may be used with project data. Before adding a tool, the owner reads its data-use terms and records:
Tool: [tool name] | Plan: [business / consumer with training off] | Training on our inputs: [excluded by default / switched off on date] | Retention after deletion: [per terms] | Approved for: [tasks] | Not approved for: [tasks] | Verified by: [owner] on [date]
(Repeat for each tool, including AI features inside existing software.)
Required settings:
- Business or team plans are preferred because training is excluded by default. On consumer plans, model training is switched off before the first project use, and the owner records the date.
- Personal or free accounts are never used for project data, client data or firm-internal documents.
- Any tool whose terms the owner has not checked is treated as a public tool: assume anything typed into it may leave our control.

4. DATA RULES
Never enter the following into a non-approved tool or a personal or free account:
- client-confidential documents (briefs, budgets, contracts, correspondence);
- personal data of clients, occupants, staff or job applicants;
- material covered by a non-disclosure agreement;
- unreleased designs, drawings, models or images, ours or a consultant's.
Before pasting, remove names, addresses and identifying details the task does not need. Contract silence on AI is not permission (section 2).

5. RISK TIERS AND REVIEW
Every AI use falls into one tier. The tier decides who reviews the output and how.
LOW - internal, no client data, no design decision depends on it. Examples: rewording an internal email, meeting-note clean-up, mood images for an internal pin-up. Check: the user reads the output for sense.
MEDIUM - client-facing, or informs a design decision. Examples: summarising a client brief in an approved tool, a first-draft design narrative, a field report to the contractor, a client-facing render from our own model. Check: verified against a trusted source; noted in the project record; project manager approves before it leaves the office.
HIGH - informs sealed or stamped documents, building codes, life safety, accessibility, structural assumptions, contract language, or permit submissions. Examples: an egress paragraph for a code sheet, an accessible-route statement, an indemnity clause, an area schedule for a submission, an outline specification section. Rule: AI is an exploratory or checking aid only. A qualified person re-verifies every statement against the current adopted source (code edition, standard, product data, executed contract); for structural assumptions, that person is the structural engineer. The use is logged (section 9). The architect of record approves before the output is relied on.
PROHIBITED - anything barred by a client contract or by law; confidential data in a non-approved tool; AI decisions about people (hiring, applicant ranking) without human review; presenting AI imagery as photographs of built work; imitating another architect's recognisable work (section 7).
If unsure which tier applies, use the higher tier. Borderline cases we have decided: [list, for example "outline specification sections: High", "internal mood images: Low", "ranking job applicants: Prohibited"]. Add new decisions as they are made.

6. VERIFICATION RULES
AI output is a draft until a qualified person has checked it. Always checked at the source before use, whatever the tier:
- code sections and editions (against the edition adopted in the project's jurisdiction on that date);
- standards (against the current edition);
- product data (against the manufacturer's current published data);
- quantities, areas and calculations (recomputed, or checked by a second method);
- contract language (against the executed agreement, and with our lawyer where it changes risk).
The checker records what was checked and against which source (section 9). Nothing AI-assisted is sealed, signed or issued without that check.

7. IMAGES AND INTELLECTUAL PROPERTY
- We do not use AI to imitate another architect's or artist's recognisable work, and we do not prompt for images "in the style of [named architect]".
- Before an image tool is approved, the owner checks its commercial-use terms, who owns the outputs, and whether outputs on our plan are public.
- AI-generated or AI-edited imagery in client material is labelled as such [for example "AI-assisted visualisation"].
- We do not present AI-generated imagery as photographs of built work, in marketing, award entries or portfolios.

8. CLIENTS AND CONSULTANTS
- Fee proposals include our standard disclosure line about AI use [insert clause].
- When a client asks which AI tools we use on their project, we answer plainly.
- When a client restricts or prohibits AI on their project, we honour it and record the restriction in the project file.
- We ask subconsultants whether and how they use AI on our projects, and that they verify AI-assisted deliverables before issue.

9. AI USE LOG, INCIDENTS AND TRAINING
Log. Every Medium and High use is entered in the AI use log at [location], with: date; project; person; tool and plan; task; data entered and its confidentiality level; where the output was used; verification done (by whom, against what); risk tier.
Incidents. Report mistakes and near-misses (an AI error that reached a deliverable, confidential data in the wrong tool) to the owner within [1] working day, without blame; the aim is to fix the process. Preserve the prompts, outputs and related files; do not delete or overwrite them. Where the incident may become a claim, the owner notifies our professional liability insurer and our lawyer.
Training. Everyone completes [60]-minute training on this policy when joining and a refresher every [12] months. The owner records who was trained, when, and on which version.

10. REVIEW
The owner reviews this policy every [6] months, next on [review date], and sooner when an approved tool changes its terms or plans, a new tool is requested, an applicable law changes, our insurer changes its requirements, or an incident shows a gap. Each review is dated, the version number updated, and changes announced to all staff.

Signed: ______________ [name], [role], [date]
Acknowledged: ______________ [name], [date]

This template is a starting point, not legal advice. Have it reviewed by your lawyer and your professional liability insurer before adoption.

Which account settings make a tool “approved”?

A tool is approved when two things are true. Its plan excludes training on your inputs by default, or the training setting was switched off and recorded before the first project use; and the policy owner has read the retention terms. The business plans in the table below exclude training by default, as do OpenAI’s and Anthropic’s APIs. Consumer plans need a setting change or a user choice, and some keep data longer.

Tool and plan	Trains on your chats by default?	How to switch off / what to buy	Retention after deletion or opt-out
ChatGPT Free / Plus / Pro	Yes - OpenAI’s help page says “we may use your content to train our models”	Settings > Data controls > “Improve the model for everyone”, or OpenAI’s privacy portal; Temporary chats are not used to improve models	Deleted chats scheduled for permanent deletion within 30 days (legal and security exceptions)
ChatGPT Business / Enterprise	No - “We do not train our models on your data by default”	Buy Business or Enterprise seats (Edu and API are also excluded)	Deleted conversations removed within 30 days unless the law requires longer; Enterprise admins set retention
Claude Free / Pro / Max	A user choice - you pick whether chats train models	Choose “off” before the first project use; step-by-step in our Claude guide	Up to 5 years (de-identified) if you allow training; 30 days if not; deleted chats removed from back-end storage within 30 days
Claude Team / Enterprise / API	No - commercial products are not used for training by default	Buy Team or Enterprise seats, or use the API under Anthropic’s Commercial Terms	Not stated on the page we checked
Gemini app (consumer)	Google’s page asks you not to enter confidential information it could use “to improve our services”; human reviewers see some data	Use Temporary chats (not used to train) or switch Keep Activity off	72 hours with Keep Activity off; otherwise not stated on the page we checked
Gemini in Google Workspace	No - chats and files “won’t be reviewed by human reviewers or otherwise used to train generative AI models without your permission”	Use a Google Workspace account with Gemini enabled by the administrator	Not stated on the page we checked
Microsoft Copilot with work account	No - “Prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation LLMs”	Sign in with a work account; the page we checked covers commercial accounts only	Not stated on the page we checked

Checked: 20 October 2026 against each vendor’s privacy pages (document review; no test run); vendors change these terms, so re-check them at every policy review. Google’s free Gemini API tier is treated differently and is not covered here.

Two details belong in your training session. OpenAI’s help pages (read the same day) state that thumbs-up or thumbs-down feedback can put the entire conversation into training even when the improve-the-model setting is off. Staff on consumer plans should leave the feedback buttons alone.

Google’s Gemini Apps privacy page (updated 19 October 2026) says: “Please don’t enter confidential information that you wouldn’t want a reviewer to see or Google to use to improve our services”. Which brand to buy seats from is covered in our Claude vs ChatGPT comparison; for the policy, record the plan tier and its training setting, whichever vendor you pick.

How do you decide which AI uses need an architect’s sign-off?

Tie the review to the stakes, using four tiers. Low uses get a sense check by the person who ran the tool. Medium uses are checked against a trusted source and approved by the project manager. High uses (sealed documents, codes, life safety, accessibility, structural assumptions, contract language) allow AI only as an exploratory aid, re-verified by a qualified person and approved by the architect of record, and Prohibited uses stay out of every tool.

We tested whether a model can apply that rubric. On 20 October 2026 we gave the same ten office uses, with the tier definitions, to Claude Sonnet 5 and to GPT-6 Astra, run programmatically from a command-line client, one run each, with fictional inputs. Both agreed on the clear cases: a client brief summarised in a personal free account is Prohibited (GPT added “unless explicitly approved”); the egress paragraph for a code sheet and a rewrite of an indemnity clause are High. They split on the borderline items: the outline specification section came back Medium from Claude and High from GPT; internal mood images were Low versus Medium; automated applicant rejection was Prohibited from Claude and conditional from GPT.

In this single run the two models agreed where the rubric was clear and split where it was vague, so the tier table has to name the borderline examples itself (outline specs, mood images, hiring, area schedules). Our template leaves a bracketed line for those decisions, which the policy owner fills in and updates.

Professional liability. The AIA’s sample policy warns that “AI routinely cites superseded code editions and fabricates product names and ASTM references”, and building codes are jurisdiction- and date-specific. The AIA’s guidance states that “Architects remain accountable for all work products, decisions, and representations made to clients, agencies, and the public”, including work produced with AI assistance. NCARB’s updated position (20 April 2026) likewise stresses responsible control and the standard of care. So the High-tier check in section 6 of the template belongs to the person who will seal the set.

For the verification log that goes with a High-tier code check, see our guide to AI building code checks. For the confidentiality step in specification work, see AI for architectural specifications.

Should you tell clients you use AI?

The published advice splits. The AIA, the AIA Trust and Victor’s A&E practice leader say disclose; Beazley says do not raise it proactively. Our recommendation is a short disclosure line in fee proposals plus a plain answer whenever a client asks, with the exact wording decided with your insurer, whose view of your contract carries more weight than ours.

The positions, with dates:

• The AIA’s guidance: “Disclose to clients and stakeholders when and how AI is being used in project workflows.”
• The AIA Trust (14 February 2025): “Be upfront about the use of GenAI tools in your practice.”
• Victor’s Kevin Collins, in Insurance Business (16 October 2026): “What we’re telling our clients is that they’re proactive in disclosure to the client”.
• Beazley (4 March 2025): “We do not recommend proactively stating whether design professionals will or will not use AI as a tool on a project”.

A short, factual line follows the AIA and Victor advice without making promises you cannot verify, which is Beazley’s concern. Your insurer decides which way your firm leans.

The clause below is the GPT-6 Astra output from our test on 20 October 2026, reproduced verbatim; the prompt asked for plain English, at most 120 words, with no unverifiable promises. GPT returned 66 words; the Claude version ran 121 words against the 120-word cap. Have your lawyer and insurer review this before it goes into a proposal. If your firm keeps any consumer-plan seats with training switched off, adjust the second sentence to match, or the clause promises more than your policy does.

Our firm may use AI tools to assist with drafting and analysis under our internal AI policy. We use confidential project information only in tools whose terms exclude using that information to train AI models. A licensed architect reviews and remains responsible for all deliverables. You may ask which AI tools are used on your project or request that AI not be used for specified tasks.

Before use, have a lawyer or insurer review the confidentiality and training restrictions, architect responsibility language, and handling of client requests for consistency with the agreement and insurance coverage.

How do you roll the policy out in 30 days?

Four weeks is enough for a firm of 2 to 50 people if one person owns the rollout. Week 1 finds out what staff already use, Week 2 fixes account settings and the approved list, Week 3 adopts the policy and trains everyone in 60 minutes, Week 4 starts the log, and a review fixed at day 90 picks up what the first draft missed.

1. Week 1 - inventory. The policy owner runs an anonymous survey: which AI tools each person has used for work in the last three months, on which account (firm, personal, free), and for what. Include AI features inside existing software. Output: a one-page list of tools in use, personal-account cases counted, no names.
2. Week 2 - settings and seats. The owner reads the data-use terms of every tool on the list, using the dated vendor settings table and the vendor-terms reader prompt on this page; where a page is silent on training or retention, ask the vendor in writing. Buy business or team seats where project data is involved; switch training off and record the date on any consumer plan that stays; retire the rest. Output: the approved-tools list in section 3 of the template.
3. Week 3 - adopt and train. The owner fills the brackets, sends the draft to the lawyer and the insurer, and adopts it. Every person signs. Then a 60-minute all-hands training: data rules, tiers with your own borderline examples, account settings, and a scenario quiz. In our 20 October test a Claude-generated quiz had one reversed answer option (“turn off the model-training opt-out”), so review every answer key before use. Output: signed acknowledgements and a training record with names, date and policy version.
4. Week 4 - log and first cases. Start the AI use log on every active project. The first week of entries shows which tiers people are unsure about; the owner adds those to the borderline list. Output: a log with real rows and an updated borderline list.
5. Day 90 - first review. The owner checks the log, the incidents and the vendor pages, updates the approved list, re-dates the policy, and books the next review. Output: version 1.1, announced to all staff.

Just 7% of responding US firms have a formal AI training program, and 26% provide AI training on individual request, according to the AIA/Deltek ABI (23 September 2026, sample size not stated). A 60-minute session puts a small firm ahead of most of its peers.

For firms in the EU, the training record has a second use. The European Commission’s AI literacy Q&A (updated 20 October 2026) states that Article 4 of the AI Act has applied since 2 February 2025, that staff using AI to draft or translate should be informed of risks “for example hallucination”, and that “There is no need for a certificate. Organisations can keep an internal record of trainings”, which is the record section 9 of the template asks for.

Prompts that help you run the policy

These four prompts are the ones we ran on 20 October 2026 through both model families, with the test-specific inputs replaced by square brackets. Paste one into an approved tool, fill the brackets, and treat the output as a draft for the policy owner to check. More prompts for practice work are in our prompt library.

Risk-tier classifier:

You are helping a small architecture practice classify its AI uses by risk. Use three tiers plus a prohibited category:
- Low: internal, no client data, quick reasonableness check by the user.
- Medium: client-facing or informs design decisions; output checked against a trusted source; noted in the project record; PM approval.
- High: informs stamped/sealed documents, life safety, accessibility, code interpretation, structural assumptions or contract language; AI only as an exploratory/checking aid; fully re-verified by a qualified person; logged; architect-of-record approval.
- Prohibited: anything barred by client contract or law, or pasting confidential client data into a tool not on the approved list.

Classify each of these uses. For each, give: tier, one-line reason, the required check. Output a markdown table only, then one line naming any item you were unsure about and why.

[paste your list of AI uses, one per line]

Both models placed 6 of 10 uses in identical tiers, and a seventh (the client brief) was Prohibited from both with a GPT qualifier; they split on the spec outline, the mood images and the hiring use, and Claude flagged its own doubt on the spec outline. Add your own borderline decisions to section 5 of the template before staff use the prompt.

Vendor terms reader:

Below is the data-use section of an AI tool's terms that a staff member wants the office to adopt. Read it and fill this table: | Question | Answer from the text | Exact quote | Risk for an architecture firm |. Questions: (1) Does the vendor train on our inputs by default? (2) Can we opt out, and how? (3) How long are inputs retained? (4) Who owns outputs? (5) Can the vendor share data with third parties? (6) Is there a business/commercial plan with different terms? If the text does not answer a question, write NOT STATED - do not guess. After the table, give a verdict in at most 3 lines: approve / approve with conditions / reject, and the conditions.

TERMS EXCERPT:
[paste the data-use section of the tool's terms]

We fed the vendor-terms reader a fictional vendor’s terms. Both models answered all six questions correctly, wrote NOT STATED for output ownership, caught that the opt-out was not retroactive, and returned “approve with conditions”.

Training quiz:

Our architecture office ([number] people) is adopting a written AI policy. Write 8 scenario-based training questions to check that staff understood it. The policy's key rules: (a) only approved tools for project data; (b) model-training opt-out on before first use, or a business plan where training is excluded by default; (c) never paste client-confidential documents, personal data or NDA material into unapproved tools; (d) AI output on codes, products, quantities and contract language is a draft verified by a qualified person against the source; (e) significant AI use on a project is logged; (f) no AI imitation of another architect's recognisable work; (g) report mistakes and near-misses without blame. Each question: a realistic office scenario, 3 answer options, the correct option, and a one-sentence explanation tied to the rule letter. Keep each question under 70 words.

The Claude quiz had a flaw: one answer option with reversed logic, which a reviewer must catch before the quiz is used. Both versions covered all seven rules in eight questions.

AI use log row:

Turn these messy notes into one row of an AI use log for a project record. Columns: Date | Project | Person | Tool and plan | Task | Data entered (and confidentiality level) | Output used where | Verification done (by whom, against what) | Risk tier. If a field is missing from the notes, write MISSING rather than inventing it. Then list the missing fields as questions to ask the person.

Notes: "[paste your notes]"

Neither model invented the missing fields: both wrote MISSING for the date, the confidentiality level and the risk tier, and both recorded that the check against current regulations had not been done. A log row with MISSING fields prompts follow-up questions, which is the point of the log.

What usually goes wrong with firm AI policies?

Six failures come up repeatedly: a blanket ban that staff route around on personal phones, a document written once and never reopened, a committee that owns the policy so nobody does, a scope defined by the word “AI” that misses features inside existing software, image tools used to imitate other designers, and a silent contract read as permission. Each comes with its fix below.

1. The blanket ban nobody follows. A ban moves AI use to personal accounts, where the training settings are wrong and nothing is logged. Fix: approve a short list with the right settings, and ban only the Prohibited tier.
2. The set-and-forget document. Vendor terms, plans and model names change within months; the vendor table on this page carries a check date for that reason. Fix: a review date in the policy, plus the triggers in section 10.
3. The policy owned by a committee. The AIA AI Firm Toolkit (10 August 2026) wants one designated person tracking AI developments and warns that “Quarterly reviews that belong to everyone tend to belong to no one”; Beazley (4 March 2025) recommends a committee, so the sources differ. For a firm of 2 to 50 people we side with the toolkit: one named owner, who can consult whoever they like.
4. Scoping by the “AI” label. If the policy only covers “AI tools”, the AI features inside your design, office and email software escape it. Fix: scope by what the AI contributes, as in section 1 of the template.
5. Image-tool imitation. Victor’s claim example, reported in Insurance Business (16 October 2026): an AI tool surfaced an existing artist’s work, the firm recreated it, and “The claim was settled with the original artist.” Fix: section 7 of the template, and an owner who checks image-tool terms.
6. Reading contract silence as permission. The AIA sample policy states: “If a client contract does not mention AI, that is not implicit permission to do anything.” Fix: section 2 of the template, and a question to the owner before AI touches that project’s confidential material.

FAQ

Is an AI policy a legal requirement for architects?

We found no general legal requirement for an architecture firm AI policy. In the EU, Article 4 of the AI Act has required AI-literacy measures for staff since 2 February 2025, per the European Commission’s Q&A (updated 20 October 2026), and an internal record of trainings can serve as documentation. The AIA’s guidance asks firms to set policies, and Beazley recommends a written one. Requirements vary by country and contract; check with your lawyer.

Can staff use free ChatGPT or Claude for project work?

Not for project data, under this template. OpenAI’s help pages (read 20 October 2026) state that individual plans may use your content to train models unless you opt out, and that thumbs-up or thumbs-down feedback can put a conversation into training even after opting out. Claude’s consumer plans make training a user choice. Free accounts are fine for learning with public material; project files belong in a business plan or a recorded, training-off seat.

Who owns AI-generated renderings?

Ownership of an AI-generated rendering depends on how much a human determined the image. The US Copyright Office’s report (29 January 2025) says AI outputs are protected only where a human author determined sufficient expressive elements, “but not the mere provision of prompts”; AI assistance “does not bar copyrightability” (US law). Check the image tool’s terms on output ownership, document your own authorship, and ask your lawyer where it matters; this is not legal advice.

Does professional liability insurance cover AI mistakes?

Generally yes, according to Victor’s A&E practice leader Kevin Collins, who told Insurance Business (16 October 2026) that AI-assisted design is “covered generally in the policy”; his example claim, an AI-surfaced artwork the firm recreated, “was settled with the original artist.” That is one market view: coverage depends on your own policy wording, so ask your broker directly and record the answer at the next policy review.

How often should we update the policy?

Put a fixed review date in your architecture firm AI policy and review sooner when a trigger fires. Our template says every six months; the AIA’s short sample policy says “reviewed at least annually”, while the toolkit site suggests a quarterly review. Triggers: a vendor changes its terms, a new tool is requested, a law or your insurer’s stance changes, or an incident shows a gap; each review gets a new date and version.

Sources

• RIBA - AI Report 2026 (PDF) (survey March-April 2026; read 20 October 2026)
• AIA - Guidance for the Responsible Use of AI (PDF) (updated 22 October 2025)
• AIA/Deltek - ABI August 2026, AI special questions (23 September 2026)
• AIA - AI Firm Toolkit, sample firm AI policies (full release 10 August 2026)
• AIA Trust - Ethical challenges of generative AI in architectural practice (14 February 2025)
• Insurance Business - AI won’t sink A&E firms, poor governance will (16 October 2026)
• Beazley - Using new tech and tools (4 March 2025)
• RAIC - Statement on artificial intelligence in architecture (28 April 2026)
• NCARB - Updated statement on the use of AI in architecture (20 April 2026)
• European Commission - AI literacy: questions and answers (updated 20 October 2026)
• US Copyright Office - Copyright and AI, Part 2: Copyrightability (29 January 2025)
• OpenAI - Data controls FAQ (read 20 October 2026)
• OpenAI - How your data is used to improve model performance (read 20 October 2026)
• OpenAI - Enterprise privacy (updated 8 January 2026)
• Anthropic - Updates to consumer terms and privacy policy (28 August 2025)
• Anthropic Privacy Center - How long do you store my data? (1 July 2026)
• Google - Gemini Apps Privacy Hub (updated 19 October 2026)
• Microsoft - Data, privacy, and security for Microsoft Copilot (updated 18 August 2026)
• Google - Generative AI in Google Workspace Privacy Hub (updated 6 October 2026)

Your first step this week: send the anonymous tool inventory from Week 1 and put the day-90 review in the calendar. The newsletter brings one tested AI workflow for architects a week, with the verification step spelled out, so the High-tier rules in your policy have a concrete procedure to point to. Subscribe.