Two pages, written in an afternoon, covering four things: which AI (artificial intelligence) tools are allowed, what data may go into them, who verifies what comes out, and who answers for it when it is wrong. A 12-person firm does not need a governance committee; it needs a short document people have actually read and a principal whose name is at the bottom. The AI policy template for an architecture firm laid out below follows the structure of the AI Risk Management Framework from NIST (the National Institute of Standards and Technology), but the version that gets used fits on a studio wall.
Two reasons it matters now. About three in four U.S. architecture firms have fewer than 10 employees (American Institute of Architects Firm Survey Report 2024), so the policy has to be written by someone who also has a permit set due. And Deltek Clarity 2026 reports that 62% of A&E (architecture and engineering) firms are still working out where and how to apply AI, and 52% name data and cybersecurity as a top challenge. The tools are already in the office (what AI can actually do for architects right now lists the ones worth the trouble). The policy is catching up to them.
What should an AI policy template for a small architecture firm cover?
The template has 11 short sections, most of them a paragraph.
- Purpose and scope. Who it applies to (everyone, including interns and contractors) and what counts as an AI tool (anything that generates text, images, code, or summaries, your email assistant included).
- Approved tools by tier. A table: tool, tier, allowed data, owner.
- Data classification. Four classes and what may go where.
- Client disclosure. The sentence you put in proposals and contracts.
- Ownership and copyright. AI output is a draft. Per the U.S. Copyright Office’s Part 2 report (January 2025), purely AI-generated material is not copyrightable; Thaler v. Perlmutter (D.C. Circuit, 2025) affirmed the human authorship requirement.
- Verification duty. Who checks code, zoning, calculations, and specs before they leave the office.
- Professional responsibility. The AIA (American Institute of Architects) Code of Ethics: members seal only work they have reviewed and are competent to judge.
- Procurement. How a new tool gets approved, and who reads the data terms.
- Training. What everyone gets, and when.
- Incident reporting. What happened, what data, what output, what we did.
- Review cadence and acknowledgment. When the document gets reread, and a signature line.
The NIST AI RMF (AI Risk Management Framework, version 1.0, January 2023) organizes risk work into four functions: Govern, Map, Measure, and Manage. Its Generative AI Profile (July 2024) adds the risks specific to models that make things up. For a small firm the translation is plain. Govern is who owns the policy. Map is which tasks use AI and what could go wrong in each. Measure is the spot check. Manage is what you do on the day it goes wrong.
Which tools are allowed, and with what data?
The tiers do the work here.
- Tier 1. Firm-owned accounts whose terms say your data is not used for training: a Copilot license inside your Microsoft 365 tenant, or a team plan on ChatGPT or Claude. Client-confidential data may go in. Restricted data may not.
- Tier 2. Consumer or free accounts. Public and internal data only. No client names, no budgets, no drawings.
- Tier 3. Not approved. Browser plug-ins nobody vetted, a transcription bot that joined the call uninvited.
The four data classes: public (the website, published work), internal (templates, standards, boilerplate), client confidential (RFPs, meaning requests for proposals, plus budgets, drawings, contracts, and anything under an NDA, a nondisclosure agreement), and restricted (security-sensitive projects, personnel records, firm financials). The rule of thumb that fits on a sticky note: if you would not email it to a stranger, do not paste it into a free chatbot.
Meeting bots get their own line. Some states require every participant’s consent to record a call, so say who announces the bot and when the recording is deleted.
Who verifies AI output before it goes out?
Name a role for each output type, in a table. Zoning summaries: the project architect, against the ordinance itself, not the model’s summary of it. Code analysis: the project architect, against the adopted edition. Calculations: the engineer of record. Specifications: whoever owns the office master. RFI (request for information) responses: the project architect, with the contract in hand. Meeting minutes: the project manager who was in the room. Anything client-facing: a principal.
Then say the quiet part: the licensee’s seal is the verification, every state board says so in its own words, and “the model drafted it” is a description, not a defense.
Verification is easier when the material the model draws on is clean: a model asked to draft a code summary from your standards reproduces whatever is in them, current or not. The policy should say where approved content lives, and the governance in who owns the firm’s content library applies unchanged: one owner, a version, a review date.
What do you tell clients?
One paragraph, in the proposal and in the agreement, along these lines: “We use AI-assisted tools for drafting, research, and image studies. All deliverables are reviewed and sealed by licensed staff. We do not enter your confidential information into tools that use it for training.” Then honor it.
Some clients will ask for more. Public agencies, healthcare systems, and federal work increasingly include AI clauses in their RFPs, and a few prohibit specific uses. And watch Article 7 of the AIA B101-2017 owner-architect agreement, which licenses the instruments of service to the owner: if part of a deliverable is purely AI-generated and therefore not copyrightable, what exactly you are licensing gets murky. What the copyright risks of AI in architecture are goes deeper than a policy should.
How do you keep the policy alive?
Review it every six months, because the tools change faster than that, and a policy that names a product nobody uses anymore is one nobody reads. Route every new tool through one person who reads the data terms before anyone pastes a project into it. Run the incident form even for small misses, such as a client name that ended up in a free account, because the pattern matters more than the event.
Training is a 1-hour session plus a plan, and how to train your team to use AI tools without a revolt has the six-week version. AIA’s TAP knowledge community (Technology in Architectural Practice) is where firms compare notes; borrow from one your size before drafting from scratch. The acknowledgment signature is not bureaucracy. It is how you find out who has not read it.
A policy nobody has read is a liability document, not a practice document. Keep it to two pages, name real people, and revise it when the tools do.
AECPulse Project Manager keeps its AI assistants inside the project record, so a meeting summary or RFI draft sits next to the name of the person who reviewed it, which is most of what a verification clause asks for.