A dispute lands on the enterprise legal desk: an owner's facilities team has discovered that a load-bearing detail in the as-built model, a framed opening that a downstream contractor relied on, was never authored by any human. It was generated by an AI design assistant during a late coordination push, accepted into the federated model without a Model Element Author recorded against it, and carried forward into construction. Now the opening does not match the field condition, the owner wants to know who is responsible, and the answer the project team gives is the most expensive answer in construction: nobody. No author, no responsible charge, no clear owner of the geometry, the data that trained the assistant, or the prompt that produced it. The existing model-governance framework (IFC 4.3, COBie, the Common Data Environment under ISO 19650, the Model Element Author table in AIA E203 and G202) was built to prevent exactly this, but it was built before AI could generate geometry that no person drew. This lesson is for the leader who governs data and models across the enterprise, and it answers the new ownership questions AI raises by mapping them onto the instruments that already exist, ending in the artifact that closes the gap: the CDE plus an AI data-governance addendum that assigns ownership of the model, the training data, the prompts, and the AI-generated geometry, and that puts a responsible author against every element. This is informational, not legal advice.

The Element No One Authored

Start with the concrete failure, because it is the whole lesson in one scene. A framed opening appears in the federated model. It is geometrically plausible, carries the right parameters, passes the clash check, and flows into the construction documents and then the field. When the field condition does not match, the team pulls the model history to find the author and finds an AI assistant's session, not a person. The Model Element Author (MEA) field, which in a disciplined BIM workflow names the party responsible for developing each element to its stated level of development, is blank or points to a tool. There is no responsible charge to call, no licensed professional who reviewed and adopted the element, no contractual party who owns the consequence. The geometry exists, it was relied upon, and it has no author. That is the expensive moment, and it is new only in its mechanism, not its category: construction has always known that unowned work is dangerous work, which is why the MEA exists in the first place.

This is worth a leader's attention because the failure is structural, not accidental. AI assistants generate content that looks authored because it is well formed, and a model-governance framework that assumes every element was drawn by a person will silently accept AI-generated geometry as if it carried the same authorship guarantee, when it does not. The guarantee the MEA encodes (a named party developed this element, to this level of development, and is responsible for it) is exactly what AI breaks unless the framework is extended to re-establish it. So the leader's job is not to ban the assistant or to trust it, but to ensure that every element it touches still has a human author of record who reviewed and adopted it, so the model never again contains geometry that no one owns.

The controlling analogy is the chain of custody. In a disciplined evidence chain, every item is logged, every transfer is signed, and at no point is there a gap where the item exists but no one is accountable for it, because a gap in custody destroys the item's value. The model is a chain of custody for design intent: each element passes from author to reviewer to relier, and the MEA is the signature at each transfer. AI does not break the chain because it is untrustworthy; it breaks the chain because it can deposit an item into the model without signing for it. Governance closes that gap by requiring AI-generated content to be signed into custody by a human author before it is relied upon, so the chain is never broken by an unauthored element.

The Existing Model-Governance Framework

The leader does not start from a blank page, because AEC already has a mature framework for governing models and data, and the AI questions must be answered inside it rather than alongside it. IFC 4.3 (ISO 16739) is the open, vendor-neutral schema that defines what a model element is and what data it carries, so that an element authored in one tool can be read, federated, and relied upon in another. COBie is the structured handover format that carries the asset data (the Facility, Floor, Space, Type, Component, System, Spare, Resource, and Job records) from the model to the owner's facilities systems, so that the model's data becomes the building's operating record. The Common Data Environment (CDE), defined by ISO 19650, is the single source of truth through which all project information flows, with its states (work in progress, shared, published, archived) and its access controls governing who can see and change what, when.

On top of these data and process instruments sit the contractual ones. AIA E203 is the BIM and Digital Data Exhibit, the agreement that establishes the project's protocols for creating, transmitting, and relying on digital data and models. AIA G202 is the Project BIM Protocol Form, which is where the project actually records, element by element and model by model, the level of development at each project milestone and the Model Element Author responsible for developing each element to that level. Together E203 and G202 answer, contractually, the questions of who authors what, to what level, when, and who may rely on it. This is the framework that already assigns model authorship and reliance, and it is the framework the AI addendum must extend rather than replace.

The leader's first move is therefore to recognize that the new AI questions are not new in kind. The framework already answers "who owns the model" (the parties to E203 and the authors recorded in G202), "who may rely on an element" (the parties for whom the element is developed to the stated level), and "how data flows and who controls it" (the CDE under ISO 19650). What it does not yet answer is what happens when an AI assistant participates in authoring, when training data and prompts become inputs to the model, and when geometry is generated rather than drawn. Those are the gaps, and they are gaps in instruments that otherwise work, so the addendum is a targeted extension, not a new regime.

The New Ownership Questions AI Introduces

AI introduces four ownership questions that the existing framework does not cleanly answer, and naming them precisely is half the governance work. First, who owns the AI-generated geometry: when an assistant generates an element, the model now contains content whose authorship is ambiguous, and the framework's assumption that every element has a human MEA is violated unless a human is assigned. Second, who owns the training data: if a vendor's model was trained on the firm's prior projects, or on a particular owner's standards, then the firm's and the owner's data has become an input to the tool, raising questions of whose data it is, what rights the vendor acquired, and whether confidential or owner-supplied program data was used in ways E203 never contemplated.

Third, who owns the prompts: the prompts an authoring team writes are themselves intellectual work, often encoding the firm's methods, standards, and design logic, and a prompt submitted to a vendor's system may be retained, used to improve the vendor's product, or exposed, so the prompt is both an asset to protect and a potential leak of confidential approach. Fourth, who is the responsible author of generated content: separate from who owns the geometry as property, someone must be the MEA of record, the responsible party who developed (or reviewed and adopted) the element to its stated level of development and who stands behind it. These four questions (geometry, training data, prompts, authorship) are the load-bearing structure of the addendum, and they connect directly to two earlier lessons.

The connection to the L1 IP and confidentiality lesson is direct: that lesson established that owner data, NDA-protected scopes, and BIM model rights under E203 and G202 must not be pasted into systems that do not protect them, and the training-data and prompt questions carry that same concern into the enterprise model-governance layer. The connection to the L4 security and contract diligence lesson is equally direct: that lesson established the diligence checklist for an enterprise AI contract (SOC 2 Type II, ISO 27001, data residency, model-training opt-out, NIST AI RMF alignment), and the training-data and prompt-retention answers here are where that diligence becomes binding contract terms in E203's digital-data protocols. Governance does not invent these concerns; it consolidates them into the instruments that make them enforceable across the enterprise.

Authorship Is What Assigns Responsibility

The central principle is that governance assigns ownership and authorship so that AI-generated content has a responsible author, the mechanism by which the model stays trustworthy. The MEA field is not merely a record of who did the work; it is the assignment of responsible charge, the named party who stands behind the element's development to its stated level and who can be relied upon, contractually and professionally. When an AI assistant generates an element, the element does not thereby acquire an author. Authorship is conferred by a human's review and adoption, the same act that confers a stamp's authority: a licensed professional or responsible party examines the generated element, confirms it meets the design intent and the stated level of development, and adopts it as their authored work, recording themselves as the MEA.

This is why the addendum's rule is that AI may generate, but a human must author. The assistant produces a proposal; the proposal becomes a model element only when a named MEA reviews and adopts it, so the MEA field is never blank and never points to a tool. This re-establishes the guarantee the framework depends on (every element has a responsible author) without pretending the AI did not participate, because the addendum also records that the element was AI-assisted: the provenance is honest and the responsibility is clear, AI-assisted in generation, human in authorship. The chain of custody is preserved because the human signs the element into the model, and the AI's contribution is logged as a transfer within the chain, not as a gap in it.

AI can generate geometry, but it cannot author it. Authorship is the human act of review and adoption that places a responsible party behind the element, so the rule that governs every AI-touched model is simple: the assistant may generate, but the Model Element Author field names a person, never a tool, and that person stands behind the work.

Data, Prompts, and the IP That Flows Through the Model

Beyond the geometry sit the data and prompts, and the leader must govern these because they are where the enterprise's confidential value leaks and where contested ownership accumulates. The training data question is governed by deciding, and recording in the addendum, what data may be used to train or fine-tune any AI tool, whose consent is required, and what the vendor may retain. Owner-supplied program data, confidential plan sets, and a particular project's models are the firm's and the owner's information, so the addendum must state that they are not used to train a vendor's general model without explicit permission, the model-training opt-out from the L4 diligence checklist made into a standing enterprise rule and reflected in the E203 digital-data protocols.

The prompt question is governed similarly. Prompts encode method and can carry confidential content, so the addendum must state who owns the prompts the firm authors (the firm, as work product), whether prompts may be submitted to systems that retain them, and what classes of content (owner data, NDA-protected scopes, unreleased design) may never enter a prompt to an external system. This is the L1 confidentiality discipline at the enterprise governance layer: not a request to individuals to be careful, but a rule recorded in the CDE's governing documents about what may flow where. The CDE, with its access states and controls under ISO 19650, is the natural place to enforce this, because it already governs who may see and change what, so the addendum extends those controls to cover AI inputs and outputs.

The ownership of the AI-generated geometry as property is the third strand, settled in E203 and G202 alongside the existing model-rights terms. The default position the addendum should establish is that AI-assisted elements, once authored and adopted by a project party, carry the same ownership and license terms as any other model element that party authored, so the AI's involvement does not create a new, unowned category of intellectual property floating in the model. The geometry belongs to whoever the model-rights terms already assign it to, the authorship belongs to the MEA who adopted it, and the addendum makes both explicit so the "no one owns it" outcome from the opening scene becomes impossible.

Enforcing Governance Through the CDE

A policy that lives only in a contract is weak; a policy enforced by the environment through which all information flows is strong, which is why the CDE is the leader's enforcement instrument. The CDE under ISO 19650 already controls the states of information (work in progress, shared, published, archived) and the gates between them, so it is the place to require that an element cannot move from work in progress to shared without a recorded MEA, and that an AI-assisted element cannot be published without a human author of record and an AI-assisted provenance flag. The gate is not a mood or a reminder; it is a control the environment enforces, the same gate-not-mood discipline the program teaches applied to model governance.

The CDE is also where the data and prompt rules become operational. Access controls determine which systems may pull data from the CDE and on what terms, so an AI tool's access to project information is governed by the same controls as any other consumer of the CDE, and the addendum specifies that an AI tool granted access is subject to the training-data and retention terms before it may read. The provenance of every element (authored, reviewed, AI-assisted or not) is recorded in the CDE's element data, so the model carries its own custody log, and a future dispute can be resolved by reading the record rather than reconstructing a session. The CDE turns the addendum's rules from aspirations into enforced states, which makes the governance real across the enterprise rather than dependent on individual diligence.

This also resolves the federation problem. On a multi-discipline project, models from many authors federate in the CDE, and if one discipline's model contains AI-generated elements with no MEA, that gap propagates into every other discipline's reliance, exactly as it did in the opening scene. By requiring the MEA and the AI-assisted flag as a condition of sharing into the federated environment, the CDE prevents an unauthored element from ever entering the shared model, so the federation a downstream party relies upon is one in which every element has an author. The enterprise leader's governance is thus not advice to project teams but a property of the environment they must work through, the only level at which model governance holds at scale.

The Applied Problem: Produce the CDE Plus AI Data-Governance Addendum

Here is the exercise. Produce the CDE plus AI data-governance addendum: the document that sits with the project's E203 and G202 and extends the Common Data Environment's governing rules to cover AI, settling ownership of the model, the training data, the prompts, and the AI-generated geometry, and assigning the Model Element Author for AI-assisted content. The deliverable is the artifact the opening scene needed and did not have, the instrument that makes an unauthored element impossible, built by extending the existing framework rather than inventing a parallel one.

Structure the addendum around the four ownership questions and the enforcement environment. First, authorship and the MEA: state that AI may generate but a human must author, that the MEA field names a person and never a tool, that an AI-assisted element is adopted only by a named party's review, and that the AI-assisted provenance is recorded against the element. Second, training data: state what project and owner data may be used to train or fine-tune any tool, that owner-supplied and confidential data is not used to train a vendor's general model without explicit permission, and that the vendor's retention is bounded, tying these to the E203 digital-data protocols and the L4 diligence terms. Third, prompts: state that the firm owns the prompts it authors, what classes of content may never enter an external prompt, and which systems may retain prompts. Fourth, geometry as property: state that authored AI-assisted elements carry the same ownership and license as any other element the authoring party produced, so no unowned IP category exists in the model.

Then specify the CDE enforcement: the gates that prevent an element from being shared or published without a recorded MEA and provenance flag, the access controls that bind an AI tool to the data and retention terms before it may read the CDE, and the federation rule that no unauthored element enters the shared model. The lasting product is a governed environment in which every model element, AI-assisted or not, has a responsible author of record, the firm's and the owner's data and prompts are protected by enforced controls rather than individual care, and the ownership of the geometry is settled in the contract instruments, so that the question "who owns the element no one authored" can never again be answered with "no one." Keep in mind throughout that this is informational governance design, not legal advice; the binding terms must be settled by the parties and their counsel in the actual E203, G202, and CDE documents.

Key Takeaways

• The expensive failure is the model element no one authored: an AI assistant can deposit well-formed geometry into the model with a blank or tool-named Model Element Author field, so the element is relied upon yet has no responsible charge, which is the most costly answer in construction.
• AEC already has a mature model-governance framework, and the AI questions must be answered inside it: IFC 4.3 defines the element and its data, COBie carries the asset data to the owner, the CDE under ISO 19650 is the single source of truth with controlled states, and AIA E203 and G202 record who authors and may rely on each element.
• AI introduces four ownership questions the framework does not cleanly answer: who owns the AI-generated geometry, the training data, the prompts, and who is the responsible author of generated content, and naming them precisely is half the governance work.
• Governance assigns ownership and authorship so AI-generated content has a responsible author: AI may generate, but a human must author by reviewing and adopting the element, so the MEA field names a person and never a tool, and the AI-assisted provenance is recorded candidly alongside the human authorship.
• The training-data and prompt questions are the L1 IP and confidentiality discipline and the L4 security and diligence checklist carried into the enterprise model-governance layer, where model-training opt-out, retention limits, and content-class rules become enforced terms in the E203 digital-data protocols rather than requests to individuals.
• AI-generated geometry is settled as property in E203 and G202: an authored, adopted AI-assisted element carries the same ownership and license as any other element the authoring party produced, so no new unowned IP category floats in the model and the "no one owns it" outcome becomes impossible.
• The CDE is the enforcement instrument: gates prevent an element from being shared or published without a recorded MEA and provenance flag, access controls bind an AI tool to the data and retention terms before it may read, and the federation rule keeps unauthored elements out of the shared model, which is gate-not-mood applied to model governance.
• The named artifact is the CDE plus AI data-governance addendum, an extension of the existing instruments that settles ownership of the model, training data, prompts, and geometry and assigns the MEA for AI-assisted content, producing a governed environment where every element has a responsible author. This is informational, not legal advice.