Firms getting practical value from AI are not deploying a single bot. They are building a governed knowledge substrate that onboarding, internal learning, business development, marketing, and proposals can all draw from. This brief maps the landscape, the evidence, and a practical evaluation framework for an AEC firm deciding how to start.
Across the public examples reviewed, the winning architecture is not a single chatbot. It is a stack. Onboarding, learning, BD, marketing, and proposals all draw from the same foundation. Build the substrate right and each function gets its own interface on top.
Each case study below represents a distinct entry point. There is no single "right" first move. The question is which entry point matches the firm’s most valuable pain point and available content. Click any source to read the primary reference.
For enterprise-tier platforms, SOC 2 Type II attestation is the rule, not the exception. Every major AI platform a US firm would reasonably consider is attested, with enterprise data excluded from model training by default.
The practical question is not whether AI can be used compliantly. It is whether a firm’s deployment sits inside its own governance layer: data classification, access controls, retention policies, audit trails, and human review.
| Platform | SOC 2 Type II | Default Training | Context | Source |
|---|---|---|---|---|
| Claude (Enterprise) | ✓ Yes | No | 12-month report across all five Trust Service Criteria. ISO 27001 also. | Anthropic |
| ChatGPT Business / Enterprise / API | ✓ Yes | No | Consumer ChatGPT (Free, Plus) is not covered. Tier matters. "Team" renamed "Business" Aug 2025. | OpenAI |
| Microsoft 365 Copilot | ✓ Yes | No | Inherits M365 compliance stack. HIPAA/HITECH supported via BAA (no formal HIPAA cert exists). | Microsoft |
| Google Gemini (Workspace) | ✓ Yes | No | SOC 1, 2, and 3 attested. Data stays in Workspace tenant. | |
| Glean (Enterprise Search) | ✓ Yes | No | Trust Center lists SOC 2 Type 2 and ISO certs. Sits across multiple existing systems. | Glean |
| Flowcase (AEC Proposals) | ✓ Yes | No | Purpose-built for resumes, CVs, case studies. ISO 27001 also. GDPR and EU AI Act alignment. | Flowcase |
| Knowledge Architecture (Synthesis) | ✓ Yes | N/A | SOC 2 and GDPR compliant. Drata-powered Trust Center. Platform behind Shepley, Bora, BWBR. | KA |
US frameworks: NIST AI Risk Management Framework and its Generative AI Profile are the most widely expected. SOC 2 Type II and ISO 27001 for vendor evaluation. ISO/IEC 42001 (AI management systems) is emerging in enterprise vendor assessments.
US state activity: The Colorado AI Act is scheduled to take effect June 30, 2026 (after being delayed from February 1) and remains subject to amendment efforts. California’s automated decision-making rules were finalized in 2025. 20+ states now have general privacy laws in force.
EU AI Act: Has extraterritorial reach but applies to US firms only when providing AI systems to EU customers, placing AI outputs on the EU market, or having EU operations. For a Pennsylvania-based AEC firm using AI internally for staff, it is not directly applicable absent those conditions.
The tool market is loud. These questions narrow the decision to what actually matters for a disciplined rollout. Answer them before a vendor demo, not after.
It is a narrow pilot with approved content, clear permissions, and one business problem that matters. The firms moving fastest are the ones who invest in the substrate first and put AI on top, not the other way around.