Way 1: Control vs. Service
Federal agencies approach AI through control— compliance frameworks, security gates, and "unbiased AI" expectations— while cities approach it through service, chasing fast, visible wins like shorter permit waits. Both are rational. The contrast is what you have to design around.
Federal AI runs at governed scale. In 2025, 41 agencies logged more than 3,600 AI use cases, a 69% jump over 20242. The appetite is clearly there; the machinery around it just moves deliberately. Frameworks like FedRAMP, Authorization to Operate (ATO), and the Federal Acquisition Regulation (FAR) were "designed with more static software offerings in mind"2, so dynamic AI clears them slowly.
Municipal clients optimize for the visible win. Honolulu cut building-permit waits from six months to just days with an AI prescreening tool4. California, under Governor Newsom, launched an AI pilot aimed at taking permit timelines from months down to days4. Boston saw a 75% jump in online permit payments after modernizing its permitting4.
| Federal client | City client | |
|---|---|---|
| Optimizes for | Control, compliance | Visible service wins |
| Mechanism | FedRAMP, ATO, FAR | Fast pilots, off-the-shelf tools |
| 2026 proof point | 3,600+ governed use cases | Honolulu: 6 months → days |
For the firm in the middle, one posture won't carry both. This is the moment to build an AI strategy that adapts to each client, not a single playbook you reuse everywhere.
That difference shows up most sharply in one place: who walks away owning the data and the model.
Way 2: Who Owns the Data and the AI Output
On federal work, under the GSA's proposed AI clause, the government owns all project data and any custom AI developments— and you can't reuse that data to train or improve a model for any other client3. On city work, the risk runs the other direction: vendor-supplied tools and decades of siloed records fed into shared AI systems.
The federal terms are specific. The proposed clause (GSAR 552.239-7001— still a draft rule, not enacted law) gives the government ownership of all "Government Data" and "Custom Developments," and it requires "American AI systems," meaning tools developed in the U.S. without prohibited foreign components3. A model you fine-tuned on one client's data may be contractually off-limits on the next federal job.
Cities sit at the other pole. By 2027, IDC forecasts that 65% of cities worldwide will run AI agents— autonomous tools that orchestrate workflows across systems5. Many are built on commercial platforms, fed by records that have lived in protected, siloed systems for decades.
On a federal job, you typically can't:
- Reuse client data to improve a model for anyone else
- Bring any AI tool you like— it has to qualify as an American system
- Treat the outputs as your IP— the government owns the custom developments
On a city job, the exposure flips. The tool is usually the vendor's, and your client's data flows into a system you don't control. That's the same problem your firm's AI governance has to answer before you pitch either side.
Ownership rules are slow to satisfy. That's the next divergence: how fast each client can actually buy and deploy.
Way 3: Procurement Speed
Federal procurement was built for static software, so dynamic AI meets friction at every gate— authorization, accreditation, and acquisition rules2. Cities run quick pilots, which buys speed, though often shallow, vendor-locked speed.
Here's the nuance the headlines miss: a fast permit pilot is not a mature, governed AI program. City speed is real— Honolulu and California both compressed permit timelines from months toward days4— but it tends to arrive through a single vendor and one narrow use case.
| Federal timeline | City timeline | |
|---|---|---|
| Reality | Deliberate; ATO/FAR gating | Fast pilots, months not years |
| Hidden cost | Long runway, compliance budget | Vendor lock-in, data sprawl |
| What your firm does | Budget patience and compliance | Guard against lock-in and siloed data |
For the firm, the implication splits cleanly. Federal timelines ask for patience and a real compliance line in your budget. City timelines ask you to protect the engagement against vendor lock-in and data sprawl before the pilot quietly becomes the system of record.
Speed and ownership both scale with the size of the program— and that's where federal and city accountability part ways.
Way 4: Scale and Accountability
Federal AI runs at governed scale— thousands of catalogued use cases, formal high-impact designations, and nonpartisan-tool expectations. City AI is narrower and constituent-facing, which makes it visible in a more local, political way.
The federal numbers show what "documented" looks like in practice. Of the 3,600+ federal AI use cases catalogued in 2025, 445 were formally classified as high-impact2.
About 12.3% of federal AI use cases carry a formal high-impact designation— accountability that is written down, inventoried, and auditable.
City accountability works differently. It's local, fast, and personal. A permitting tool that misfires doesn't land in an inventory— it lands in a council meeting and the local news. The application set is smaller (permits, service workflows, constituent requests), but each one is something a resident touches directly.
For the firm, the two demand different proof. On federal work, you document and defend governance— inventories, impact ratings, audit trails. On city work, you manage visibility and constituent trust, because the failure mode goes public before it goes procedural.
All four differences converge on one question every principal should be asking: when these two clients pull in opposite directions, where does the risk actually land?
Way 5: Where the Risk Actually Sits— For Your Firm
When a federal client and a city client pull in opposite directions, the risk lands on you— the firm in the middle. Federal rules push obligations down to the contractor. City speed leaves you holding fragmented, siloed data.
On the federal side, the proposed GSA clause makes the contractor responsible, including a strict 72-hour security-incident reporting deadline with daily updates until the incident is resolved3. A firm can't say "AI policy is the client's job." On federal work, the duty flows down to you.
What flows down to you on a federal job:
- A 72-hour window to report any security incident, then daily updates until it's closed
- Proof that every AI tool in scope qualifies as an American system
- Data-handling discipline— no reuse of government data to improve a model elsewhere
- Ownership handoff of all custom developments to the government
On the city side, the exposure is quieter but just as real. When a fast pilot feeds siloed records into a vendor's shared system, your firm absorbs the data risk of a program nobody fully governs5. Speed hid the obligation. It didn't remove it.
So before you take on either, it's worth deciding whether to build that capability in-house or bring in help— because the obligation arrives whether or not you're ready for it.
You can't govern AI per client until you've governed it inside your own firm first. That's where most AEC firms are exposed.
What This Means for Your Firm— and Where to Start
You can't tailor AI governance to each public client until your own firm's AI is governed— and that's exactly where the gap sits. About 75% of AEC firms now use AI, but only 29% are confident in the data behind those tools1. You can't govern AI per client on a foundation you don't trust.
The fix runs in one direction: strategy before tools. A per-client posture— federal control on one side, city service on the other— starts with your own data as a single source of truth and a clear rule for which tools are allowed where. Get that right internally, and tailoring it per client becomes a configuration choice instead of a scramble.
This is the kind of work an implementation partner can map with you. An AI strategy audit that becomes an implementation plan gives you a decision framework for where AI pays off and a posture for each client type— without locking you to any one vendor. You own the plan. You can build it in-house or map the right AI posture to your workflows with help. Either way, the judgment stays with your firm— AI amplifies it, not replaces it.
A few questions come up every time a firm starts segmenting its public clients this way.
FAQ
Do federal clients let AEC firms use any AI tool?
No. The GSA's proposed AI clause requires American-made AI systems and gives the government ownership of all data and custom developments, and it bars reusing that data to train models for other clients3. Treat it as direction-of-travel— it's a proposed rule, not yet final— but build your tool-selection rules as if it's coming.
Are cities faster than the federal government at adopting AI?
On visible service tasks, often yes. Honolulu cut permit waits from six months to days4, and IDC forecasts that 65% of cities will run AI agents by 20275. But city AI tends to be vendor-dependent and built on siloed records, so fast isn't the same as governed.
How many AEC firms actually use AI?
About 75% as of 2026, up roughly 20 points year-over-year1. Only 29% are confident in the data behind those tools1— the readiness gap hiding inside the adoption number. Adoption estimates vary by survey, but every read points the same way.
References
- Unanet / Construction Owners Association, "Unanet Releases 2026 AEC Inspire Report Revealing AI Adoption Surge While Data Confidence Lags" (2026) — https://www.constructionowners.com/press-release/unanet-releases-2026-aec-inspire-report-revealing-ai-adoption-surge-while-data-confidence-lags
- The Brookings Institution, "Assessing the state of AI adoption across the federal government" (2026) — https://www.brookings.edu/articles/assessing-the-state-of-ai-adoption-across-the-federal-government/
- Holland & Knight LLP, "GSA's Proposed AI Clause: A Deep Dive into New Requirements for Government Contractors" (2026) — https://www.hklaw.com/en/insights/publications/2026/03/gsas-proposed-ai-clause-a-deep-dive
- Stateside Associates, "Navigating Local Government: AI Meets Building Permits" (2025) — https://www.stateside.com/blog/navigating-local-government-ai-meets-building-permits
- Smart Cities Dive (citing IDC 2026 FutureScape), "How cities are using AI in 2026" (2026) — https://www.smartcitiesdive.com/news/how-cities-using-ai-2026/810905/
