A risk register is a living list of the things that could hurt a project's cost, schedule, safety, or quality, with a rating for each, a named owner, and a plan to reduce or handle it.
Plan reviews connect field conditions, drawings, and the next decisions on a job. AI-generated illustration.
A risk register is where a project team writes down what might go wrong before it does. Each entry describes the risk, scores how likely it is and how much it would hurt, names one person to own it, and records what the team will do about it. It starts during preconstruction and stays open until closeout. Good registers are short, specific, and reviewed every couple of weeks. Bad ones are a 200-line spreadsheet nobody opens after kickoff.
The register is not insurance and it is not a contingency budget. It is the reasoning behind both: it tells you which risks to price, which to transfer, and which to manage on site.
What goes in a risk register
Risk description: cause and effect in one line. "Switchgear lead time slips past energization date, delaying startup" beats "electrical delays."
Likelihood and impact: often a 1 to 5 scale each, multiplied for a score. Keep the scale simple enough that two people score the same risk the same way.
Cost and time exposure: a rough dollar and day estimate where you can.
Owner: one name, not a company.
Response: avoid, reduce, transfer (to a sub, a supplier, or an insurer), or accept.
Trigger and status: what early sign tells you the risk is happening, and whether it is open, closed, or realized.
A worked example
A GC wins a $5.2 million school gym renovation that must be done before classes start in August. In precon the team logs 14 risks. Three float to the top:
Example: top three entries on a school gym risk register
Risk
L x I
Response
Owner
Hidden asbestos in floor mastic once old wood is pulled
3 x 5 = 15
Ask owner for a hazmat survey before bid; carry an allowance; line up an abatement sub
PM
Rooftop unit lead time pushes past July
4 x 4 = 16
Release RTU submittal in week 1; track as a long-lead item; ask about temporary cooling
Project engineer
Wood floor install needs conditioned space and acclimation
3 x 3 = 9
Sequence HVAC startup ahead of flooring in the schedule
Superintendent
In week 6 the RTU supplier warns of a slip. Because the risk had a trigger and an owner, the PM already had a temporary cooling quote in hand and took it to the owner the same day.
Common mistakes
Listing generic risks (weather, labor shortage) that apply to every job and never get a real response.
Assigning ownership to "GC" or "team." If everyone owns it, no one does.
Building the register at kickoff and never touching it again.
Not tying high-score risks to money. If a risk is likely and expensive, it should be reflected in contingency, an allowance, an exclusion, or a contract clause.
Ignoring opportunities. Some teams track upside items too, such as a value engineering idea that could save weeks.
Who owns the risk register on a construction project?+
Usually the general contractor's project manager maintains it, but each risk gets its own owner, often a superintendent, project engineer, or subcontractor.
How often should a risk register be updated?+
Review it at least every two weeks during construction, and any time something big changes, such as a new change order, a supplier warning, or a schedule revision.
What is the difference between a risk register and an issue log?+
A risk register tracks things that might happen. An issue log tracks things that already have. When a risk happens, it moves to the issue log or becomes a change, claim, or schedule update.
Do small contractors need a risk register?+
A simple one, yes. Even a list of five risks with owners, written during estimate handoff, catches problems a crew lead would otherwise find too late.
AI chatbots are generating fabricated building codes, fake OSHA regulation numbers, and flawed cost estimates that look perfectly accurate. With 71% of E&C firms now piloting AI and hallucination rates hitting 27% on technical queries, the first construction-specific liability case is coming. This episode breaks down the risk and gives you a 5-step protection framework.
Starts muted when the player comes into view.
Read the full episode transcript
Published transcript from Scaling Legends. It may contain transcription errors. View the source transcript.
Imagine you just hired a new project management intern for your firm. Okay. And this kid is incredibly eager. I mean, they type 100 words a minute, they format documents beautifully, and they never ever say, I don't know. Right. The dangerous kind of eager. Exactly. So you ask them to draft a complex structural compliance report, and they hand it back to you in five minutes. Wow. Yeah. And it looks flawless. The margins are perfect. The citations are neatly bulleted. But there's a catch. There always is. They just made up 27 % of the structural codes they cited. And they didn't do it maliciously, right? They just really wanted to give you a complete looking document. So they, well, they guessed. And, you know, that guessing mechanism is the fundamental architecture of the generative AI tools your project managers
are probably using right now. Yeah. Because general large language models are not databases. I think people forget that. They don't search a repository of absolute truths. Right, they're not Google. Exactly. They operate more like an incredibly high -powered, overly eager autocomplete on your phone. Oh, that's a good way to put it. Yeah, they just calculate the statistical probability of the next word in a sentence based on their training patterns. It is a math engine, not a truth engine. Which brings us to our mission for this deep dive. Because if you are a construction business owner listening to this, whether you're running a massive commercial GC operation, a specialized subcontracting firm, whatever it is, you are looking for ways to scale safely. Absolutely. You want to bid faster. You want to keep your margins intact. But there is this
massive hidden liability ticking away in your back office right now. A ticking time bomb, really. It is. at a stack of warnings from Construction Dive, some really jarring recent legal precedents, and a smart business automators market intelligence report. A lot of ground to cover. Yeah, but our goal today is to pull back the curtain on AI hallucinations in construction documentation. We want to make sure you don't lose your license or your entire business to a totally fabricated building code. And the scope of this issue is fundamentally different from... say catching a typo in an email because when general ai models process everyday requests they hallucinate meaning they confidently generate false information roughly
three to fifteen percent of the time which is already you know not great no it's not but when you feed those same models domain specific highly technical queries like load bearing calculations local zoning laws or complex structural engineering specs the error rate actually spikes. Oh, yeah. It jumps to 27%. Wait, a 27 % failure rate on technical queries? Yes. That means more than one in four technical answers is completely fabricated. Exactly. The AI struggles to differentiate between highly nuanced technical contexts as it starts bridging the gaps with statistically plausible, but entirely fictional. I mean, let's put that in perspective for a second. If one out of every four I -beams delivered to a job site was made
of, I don't know, high -density foam, but it was painted to look exactly like structural steel, we would shut down the project immediately. Absolutely. We'd call the authorities, we'd fire the supplier on the spot. So why are we letting this slide in our project paperwork? Because a hallucinated code reference is invisible until it causes a collapse. And in this industry, that collapse can be physical, financial, or legal. Yeah, that's a terrifying thought. It is. The text generated by AI is so authoritative and perfectly structured that it bypasses our natural professional skepticism. It just looks so right. It does. We see documented, real -world examples right now where AI generates non -existent international building code sections. We see it fabricating OSHA regulation numbers
out of thin air. just to satisfy a safety plan prompt. Wow. We even see it generating cost estimates and material quantities that looks like standard takeoffs, but they have absolute zero mathematical basis in the actual blueprints. I know there are directors of operations and VDC managers listening right now thinking, well, we don't use raw chat GPT, we use RAG. Right, retrieval augmented generation. Yeah. So they think our AI is grounded in our own manuals or we upgraded to the GPT -4 API so we're totally protected. And that is a dangerous false sense of security. It's not enough. No. I mean, GPT -4 is indeed about 40 % better at reducing hallucinations compared to GPT -3 .5. Okay, that's a good step. It is. But 40 % better still leaves a massive margin for factual errors on technical queries.
Right. And regarding ARIG, it's vital to understand why it still fails. ARIG works by breaking your documents down into mathematical chunks called vectors. Okay. When you ask a question, it retrieves the chunks it thinks are relevant and stitches them together. Makes sense in theory. Sure. But if the retrieval corpus is incomplete, or if the AI grabs a chunk from the plumbing spec when you actually asked a structural question, it confidently glues that wrong context together into a flawless -sounding answer. Even with RAG, the error rates stubbornly sit between 5 and 10%. And as Construction Dive pointed out recently, the liabilities created by these documentation errors outlive the project itself. They absolutely do. Long after the ribbon -cutting ceremony is over, that fabricated code reference is just
sitting there. there in your stamped plans waiting for a warranty claim or a structural audit. And the scary part is the momentum of adoption. is moving much faster than the implementation of guardrails. People are just rushing in. Exactly. According to Smart Business Automator's market intelligence report, 71 % of engineering and construction firms are already piloting generative AI tools. 71%. That is huge. It is. And that same report projects the global AI and construction market to hit $8 .6 billion by 2031. Wow. So the money is flowing. The tools are literally on the desks. The risk management... is lagging significantly behind. Way behind. So let's follow the timeline of that error. Let's say that foam I -beam of a fabricated building code gets approved,
it gets stamped, and eventually the inevitable happens. Someone catches it. Right, the inspector catches it. Or worse, a failure occurs. Who actually pays for the mistake? That's the million -dollar question. Because if we look at the legal precedents outside of construction, the courts are incredibly unsympathetic. Very. We haven't seen the massive, landmark, construction -specific AI liability case go to trial yet. But legal experts are universally calling it a matter of when, not if. Just a matter of time. Yeah. We have crystal clear precedents from other heavily regulated professions that show exactly how judges are going to handle this. The Mata versus Avianca case in 2023 is the prime example of this. Oh, definitely. A lawyer preparing a brief use chat GPT for research. The AI, acting
like our eager intern we talked about earlier, fabricated six different case citations. Completely fake legal precedents. Right. Complete with fake docket numbers and fake quotes from real judges. And the lawyer submitted it to the federal court without verifying. The professional license holds the liability. And we see that liability extending to the corporate entity as well. Think about the Air Canada chatbot case in 2024. Right. The bereavement fare issue. Exactly. A customer asked the airline's automated AI agent about bereavement fares. The AI hallucinates and gives completely
incorrect, made -up information about the airline's refund policies. Classic AI hallucination. Yeah. And when the customer sued, Air Canada tried to argue a fascinating defense. They claimed the chatbot was essentially a separate entity. a standalone tool, and the airline shouldn't be held responsible for its autonomous answers. And the tribunal flat out rejected that. Completely. They held the airline completely liable, ruling that a company is responsible for all information it provides, whether it comes from a static webpage, a human agent, or a generative AI chatbot. So if we pull those threads together for you, the construction business owner, the mechanism of liability is undeniable. Right. The licensed professional... The professional engineer, the architect, the general contractor remains 100 % liable for the work product. So if an engineer
stamps a set of drawings that incorporates hallucinated AI data. Their personal license and the firm's assets are directly on the line. Let me push back on this though. Sure. Let's say a massive multi -billion dollar tech company sells me a software suite. And it is specifically marketed and sold for construction estimating or, you know, for OSHA safety compliance. I pay enterprise licensing fees for this. How can they just legally wash their hands of it when their product makes up an OSHA code that gets a stop work order slapped on my site? It's frustrating, I know. I mean, how does that burden not fall on the manufacturer of the defective tool? It comes down to the fundamental difference between how software is licensed and how professional services are rendered. Okay,
untack that. Software companies universally insulate themselves, using indemnification clauses and as -is provisions in their terms of service. Like fine print. Exactly. They argue they are providing you a tool, a utility, think of it like a drafting pencil or a calculator. If you use a Texas Instruments calculator to make a catastrophic arithmetic mistake on a bridge design, you don't sue Texas Instruments. Yeah, that makes sense. The AI companies successfully argue the exact same logic. They provide the computational engine. You provide the professional judgment. So because the tech giants are legally insulated by armies of lawyers and airtight terms of service, the risk flows straight down the project chain. Straight down. And it lands squarely on your desk. The general contractor takes the hit on
a hallucinated material price that ruins a bid. The owner bears the financial risk of project delays. Yes. But what about the subcontractors? Because I hear from subs all the time who think they are insulated. They think they're just executing on the specs handed down from the prime contractor. Right, they think they're safe. Yeah, if the GC gives them an AI -hallucinated spec, the sub is safe, right? Not at all. That is a dangerous misconception due to flow -down liability clauses. Oh, flow -down clauses. Yes. If a subcontractor executes work based on a hallucinated spec, and that work fails to meet the actual real -world municipal code, The prime contractor's legal team will absolutely invoke flow -down provisions. Basically pointing the finger right back at them. Exactly. They'll argue the sub failed to perform
their own due diligence or construct a standard. Everyone in the blast radius is exposed. And the insurance industry is keenly aware of this exposure. I mean, they are not going to sit around and pay out claims for tech they don't understand. Precisely. We are seeing professional liability insurers waking up to this reality right now. Making moves. Yeah, they are actively beginning to add AI -specific exclusions and strict auditing policies. Wow. They are looking at that 27 % failure rate and deciding that blindly utilized AI is just an uninsurable risk. do we actually build a workflow to survive this? The sources outline a five -step protection framework, but really this is about completely rethinking the life cycle of a document in your firm. It really
is a cultural shift. Yeah. So the absolute baseline rule step one is that raw AI output is never, ever used in a final or stamped document. It is exclusively a first draft. Which means the document must then move into a rigorous verification phase. That's step two. If an AI generates a draft safety plan and cites an international building code section or an OSHA regulation. You cannot just assume it's correct because the formatting looks official. Right. Don't trust the intern just because the margins are nice. Exactly. Your team must physically open the actual IBC database or the OSHA portal and verify that citation word for word. Wow. If that code section doesn't exist in the official external database. The AI fabricated it. But here is where we hit
a massive friction point, I think. Okay, what is it? The third step in this framework demands that you thoroughly document this verification process. Yes, step three. You have to create a paper trail proving a qualified human checked the AI's work before implementation. I have to be honest, this sounds like an absolute nightmare for project managers. It's definitely a change of process. I mean, we're talking about an industry that is already drowning in administrative bloat. Margins are tight. Timelines are compressed and PMs are burning out. Yeah. If I have to force my team to document every single time they verify an AI output, aren't we just killing our margins and defeating the entire purpose of automation? It's a highly valid concern, and it's the exact friction point every major firm is wrestling with right now. I'm sure they are. But you have to weigh the administrative cost against the
concept of uninsurable risk we just discussed. Let's say your PM skips the documentation. Okay. Two years later. A structural flaw is traced back to a hallucinated code in your plans. You get sued. Right. You go to your E &O insurance provider, but your policy has an AI exclusion clause requiring proof of human verification. Oh, no. Because your PM didn't document the audit, the insurer denies the claim. You are now paying a multi -million dollar settlement out of pocket. That's devastating. So documenting the verification isn't administrative bloat. It is the literal shield protecting your company's balance sheet. So it fundamentally shifts the role of the project manager. They are no longer just creators of documents. They are auditors of machine -generated
work. Exactly. Which requires formalizing this process. That's step four, right? Yes. You can't just leave it up to the individual PM's discretion. You need an internal review board or a standardized sign -off protocol before any AI content enters the project ecosystem. And step five, which you mentioned earlier, you need to call your insurance broker today to review those E &O policies for exclusions. It is a non -negotiable step for survival in the current landscape. But let's take a step back, because if I look at all these manual checks, cross -referencing, review boards, documenting the audits. It feels incredibly heavy. It is a lot of work up front. Yeah. And the whole reason a construction owner buys this technology is to scale the business and save time. If I have to spend three hours auditing the confident
intern's work, why did I hire the intern at all? Because the firms that view this as a temporary administrative burden. are missing the broader strategic play? How so? The firms that build these verification protocols into their workflows right now are going to survive the first brutal wave of litigation that is coming. The wave is definitely coming. Oh, yeah. And industry leaders are already signaling this shift. The American Society of Civil Engineers is developing rigorous guidelines for AI use. Okay. The Associated General Contractors of America has issued stark advisories. Major platforms like Autodesk and Procore are already baking human verification disclaimers right into their interfaces. So it's everywhere. It is. The secret to scaling isn't abandoning AI. It's transitioning from open -ended general
AI to purpose -built gated. Right, because AI shouldn't be used to pull random facts from the open internet. You shouldn't be asking a general chatbot to guess the wind load code in Miami -Dade County. Please don't do that. AI becomes a competitive advantage when it is used to process your actual historical project data. Exactly. And according to Smart Business Automator's Market Intelligence Report, safe AI implementation works by entirely mitigating external hallucination risks through closed -loop systems. closed loop system yeah purpose -built platforms do not act as an open search engine they act as a project -aware analytical engine tied exclusively to your firm's internal data Let's translate that into how it actually functions on a site, because this is where the jargon gets dense, but the value gets real. We're talking about API integrations
that connect the AI directly to your existing ERP systems like Viewpoint, CMCU, or Procore. By siloing the data, you essentially gate the AI. Exactly. When the AI is gated, it can't hallucinate an outside building code because it isn't looking outside. It doesn't even know outside exists. Exactly. It's looking at smart document organization. The AI automatically tags and sorts your actual site photos, your RFIs, and your submittals. That saves so much time. It really does. It can ingest a rambling hour -long voice memo from a superintendent and instantly structure into a formal daily log with clear action items assigned to specific subs. And it changes how you handle risk. Think about change order impact analysis. Oh, that's a huge one. Right. Instead of the AI guessing at material costs, it uses API hooks
to look at your specific budget, your real -time labor rates, and your actual master schedule to see exactly how a change order cascades through the entire project ecosystem. And because there is no manual data entry required, you eliminate human error. Plus, the risk of the AI hallucinating external facts is virtually zero. because it is confined to the reality of your servers. So to borrow a concept from the site itself, you don't ban the pneumatic nail gun because it has the power to cause severe injuries. No, you'd never get anything built. Right. You mandate safety glasses, you require operational training, and you ensure the sequential trip mechanisms are engaged before anyone pulls the trigger. Exactly. AI requires the exact same operational discipline. You don't throw the tool away, you
engage the safety mechanisms. Well said. When you restrict the AI to your controlled environment, your nail gun, your lumber, it becomes an incredible accelerator. You get the speed of automation without the devastating risk of fabrication. So what does this all mean for you, the business owner listening right now? The race to scale using AI in the construction industry is officially on. It's happening whether you're ready or not. Yeah. But speed without safety isn't an advantage. It is just a fast track to an uninsurable liability claim. So here's your immediate homework today policy and check for AI exclusions. Call your broker. Yes, call your broker. And tomorrow morning, you need to implement a strict trust but verify rule, complete with an audit trail, for every
single document hitting a project file. Because the technological landscape is shifting underneath our boots, and being highly proactive is your only real defense. Absolutely. Before we go, I want to leave you with a final, slightly mind -bending question to chew on. Oh boy. Let's say an AI generates a completely flawless, hyper -efficient structural design for a massive new commercial building. The engineering math is perfect. It could save millions in materials. Okay, sounds great so far. But it accidentally hallucinated the local zoning laws, making the plans completely unbuildable on that specific site. Who actually owns the copyright to those useless but perfectly engineered plans? Is it the software company that trained the massive language model? Is it the engineer who typed the prompt into the interface? Or does a machine
-generated hallucination mean nobody owns it at all? That really exposes a massive gap in our intellectual property framework, doesn't it? Yeah. It's a question the courts are going to be aggressively wrestling with for the next decade. It really is. Remember that Confident Intern is working in your office right now. Make sure you check their work. Please make sure to subscribe, rate, and review the show. Share this deep dive with your team so everyone is on the exact same page. And visit smartbusinessautomator .com. Thanks for joining us.
