Is It Safe to Use AI for Construction?

The short answer fits in one line. AI can help with the method, but don't hand it your confidential data. A construction file holds very sensitive information. Your priced bid. Your margins. Your subcontractor rates. Your workers' data. The site's plans and access. Pasted into a consumer AI, this data travels to a third party's servers. There it can be retained, reviewed or reused for training. A bid price is a trade secret: disclosing it can strip its protection. Worker data, meanwhile, falls under the GDPR. There is a clean method: anonymise before you send.

What a construction file lays bare

A construction project produces four families of sensitive data. Each one interests someone other than you.

• The priced bid: your total price, your margins, your net cost.
• Subcontractors and suppliers: their rates and terms, often confidential by contract.
• Workers and safety: inductions, right-to-work checks, certifications, incident reports.
• The site: plans, access, schedules and security arrangements.

This is exactly what a competitor wants to see. Your price. Your margins. Your subcontractor rates. Pasting a tender into a consumer AI sends all of it to a third party.

Bid and tender data is a trade secret

A trade secret is commercial information that has value because it stays secret. WIPO (the World Intellectual Property Organization) makes the point. Unlike a patent, its protection depends on one thing: the information is never disclosed.

Your bid price is a good example. So is your margin build-up. So are your subcontractor rates. They stay protected only while they remain confidential. Pasting them into a public AI, which sends them to a third-party server, can strip that protection.

In Europe, the Trade Secrets Directive (2016/943) points the same way. It sets a common definition of a trade secret. It protects against its unlawful acquisition, use or disclosure. A bid, a costing or supplier terms carry legal weight — as long as they stay secret.

There is a second layer. Most tenders impose a confidentiality clause. You agree not to disclose the documents or your price. That is a contractual duty, separate from the law. Pasting it into an AI can breach that duty.

Workers and safety are personal data

A construction site is also people. And their data falls under the GDPR (General Data Protection Regulation). The organisation that decides why and how to process that data is the 'controller'. That is you. As controller, you answer for compliance.

Many site documents are personal data. Induction records. Right-to-work checks. Certifications. Incident or injury reports. These last ones are a special case.

An injury report often holds health information. The GDPR places health in its 'special categories' (Article 9). This data gets stronger protection. Processing it generally needs a firmer legal basis and extra safeguards.

The GDPR also sets a security principle. You must protect this data with appropriate technical and organisational measures. Routing a worker file through a consumer AI works against that principle. No contract. No defined retention. Possible use for model training.

What cyber authorities warn

The National Cyber Security Centre (NCSC), the UK's cyber authority, warns clearly. Queries typed into a public chatbot can be stored by the provider. They can be used to train future models. They can also leak if the provider is breached.

Its conclusion is simple. Do not enter sensitive or confidential material into a public LLM (large language model). The NCSC also advises reading the terms and privacy policy first. Consumer and enterprise tiers differ sharply on retention and training.

The fix: anonymise before you send

Good news: AI stays very useful on site. It can draft a method statement. It can check the logic of a schedule. It can format a letter. For that, it needs none of your prices, names or site details.

The idea is to anonymise before the prompt. You replace bid prices with tokens. Subcontractor names too. Worker identifiers and access details as well. The AI reasons about the shape of the problem, without ever seeing the real values.

1. 1Spot the sensitive data: prices, margins, subcontractors, workers, site plans.
2. 2Replace it with reversible tokens, in the browser.
3. 3Send only the anonymized text to the AI.
4. 4Restore the real values in the reply, locally.

Keep one simple rule. Some data must never leave the company. Priced bids. Site security arrangements. Classify them, and keep them out of public tools. For the rest, prefer an enterprise tool with a data processing agreement (DPA) and no-training terms.

That's what ONYRI Sanitize is for. The engine detects sensitive data — bid prices, subcontractor names, worker identifiers, site details — and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymized text reaches the model. The AI finds only tokens, never your bid or your worker data. You get the help, without breaking trade-secret confidentiality or the GDPR.