FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Project managers
AI search across past projects can surface useful lessons, but it can also put one client's confidential information in front of a team working for another. Project files are full of commercial data, prices and designs that clients expect to stay within their project.
Part of: AI in project management
In short
PM firms and in-house PMOs may connect AI search and assistants to document stores, so staff can ask questions such as "what went wrong on our last hospital fit-out". The value is real, but repositories often mix many clients' data, often under confidentiality clauses or NDAs that limit its use to the project concerned. If permissions are loose, the assistant may quote another client's costs, programme or dispute. There are also questions about who owns project outputs. Breaches of confidence are sometimes covered by PI, while data incidents commonly sit with cyber cover, depending on the wording.
Typical set-ups connect an AI assistant to shared drives, project management systems and email archives. Staff ask natural-language questions and get answers drawn from past risk registers, lessons-learned logs, cost reports and correspondence. Used well, this turns a firm's history into practical guidance: realistic durations, recurring risks, supplier performance. It also helps when building risk registers and programmes for new work.
The problem is that AI search respects whatever permissions exist, and in some firms those were never designed for a tool that can read everything at once. A folder that was technically open but practically obscure becomes instantly searchable.
Generated answers add a further twist. The assistant may blend material from several projects into one response without saying where each fact came from, so the person reading it has no idea they are looking at another client's confidential figures. Citations back to source documents help, but only if people check them.
PM appointments commonly include confidentiality obligations, and some clients require NDAs, particularly on commercial property, infrastructure and corporate transformation work. Those terms often restrict use of information to the project and may prohibit disclosure to anyone outside the project team. Personal data in project files engages UK GDPR, including purpose limitation. For RICS-regulated PMs, the RICS AI standard bars uploading private and confidential data to an AI system without express prior written consent (3.1), requires an AI register (3.2) and a risk register covering data retention (3.3). Ownership of reports, programmes and methods depends on the appointment: the client may own or be licensed to use outputs, which affects whether they can be reused at all.
Illustrative scenario. A PM firm connects an AI assistant to its project archive. A bid team preparing for a new client asks for typical fit-out rates in a city, and the assistant quotes figures from a named current client's cost report, including a commentary on that client's dispute with its contractor. The material appears in a bid document. The original client learns of it and alleges breach of confidence and breach of its NDA.
Other risks include reusing a client-owned design or method in another project without licence, and assistants retaining data after a client has asked for its information to be returned or deleted at the end of the appointment.
Breach of confidence and NDA claims arising from professional services are covered by some PI wordings and limited or excluded by others, so it depends on the policy. Data protection breaches and incidents caused by system failures or cyber events are commonly excluded under PI and fall to cyber insurance; RICS-compliant wordings carry a cyber and data protection endorsement to that effect. Intellectual property claims can be another grey area. See cyber insurance and AI risks and AI content and IP infringement.
Apex arranges PI for project managers, and a broker can review how your PI and cyber cover respond to confidentiality and data incidents involving AI search. See client data and PM AI tools, AI meeting minutes and the AI in project management hub.
General know-how is usually fine, but specific confidential information such as prices, disputes or client strategy is often restricted by the appointment or an NDA. Sanitised lessons that remove client-identifying and commercial detail are the safer route.
Indexing data internally is not necessarily a disclosure, but it can lead to one if staff on other projects can retrieve it, or if the provider retains or uses the data. Check your contracts and the tool's data terms.
That depends on your appointment. Clients often own outputs or hold a licence, and some restrict reuse. Check ownership before feeding past deliverables into a knowledge tool that will reuse them.
Often both are relevant. Breach of confidence from your professional services may fall under PI, depending on the wording, while data protection breaches and system-caused incidents commonly sit with cyber cover. Check both policies together.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
