Your biggest clients are getting their own Chatbots. Announced in June 2026, this City of Tucson RFP for an AI Chatbot made total sense. It initially looked like a software consultant was needed to guide the city in best practices to eventually host and develop a chatbot support solution in house, potentially working through the infrastructure needed to deploy a sophisticated AI support system for over 5,000 staff.
The post said they are excited to see this go from “idea to reality”.
But it’s far more than that…
The entire security and compliance program needs to be conceptualized and delivered by the vendor.
The use case is there, the need is there, the secure and stable foundation for the solution…is not.
How can true experts exist on this contract delivery without substantial deployment experience? At least one prior 3-5 year contract doing the same thing, when it was commercially released 5 years ago?
This technology is barely a few years old. It’s the age old resume issue – must have X years experience – eventually brave employers are left to give chances to those recent grads who don’t have the years put in. Turns out right now those brave employers are our government officials and the new hires with “potential” are today’s emerging software experts.
This is why over 130 vendors have downloaded the documents. As of July 1, 136 companies were (somewhat sure) they were the right fit for this. Everything from small, local network security consultants to Dell.
For contractors, this should be a huge market signal to slow down, whatever you are doing, and perform a Cyber Risk Assessment. Every municipality you work with, and therefore every architect and developer they are in constant interaction with, will begin interacting with AI automation to communicate support needs and potentially automate their role in critical path items.
How will you know when a human did something vs a bot?
And how long until legal AI tools flag your contracts for invalid compliance to their data storage demands. In the future, awarded contracts may be periodically or annually scrutinized for alignment with evolving laws. Some contracts last longer than election cycles. The language that will lengthen RFP’s when technology compliance is more articulated is going to matter in scoring. In the near future, you can’t expect to look up this language, implement quick changes, and fly in your response – you’ll need something like a quick API connection to prove this happens in real time.
Integrating your technology leadership into marketing, case study collection, technology security plans for projects and more is the fastest way to stand out among your competition in RFP responses.
Your municipal clients at the highest levels are already requiring this type of clarity and compliance for themselves, they are going to require it from you (here’s a sample from the City of Tucson Chatbot RFP):
The platform shall provide measurable reporting on:
i. Self-service resolution rate
ii. Human escalation rate
iii. First-contact resolution rate
iv. Customer satisfaction scores
v. Platform adoption rates
vi. Authentication success and failure rates
vii. Accuracy and response reliability rate
viii. Error and hallucination rate
ix. Multilingual interaction success rates
x. ADA accessibility issue tracking
xi. Channel utilization trends across web, chat, and voice
xii. Campaign delivery and success metrics for outbound communications
xiii. Department-specific operational KPI reporting
Are you currently asking these questions of yourself? Because the City of Tucson is certain that these are the basics of expectation from their provider, if they use AI, for years to come. Yes even you, the small Claude-wrangling design firm. Everyone.
You might be thinking, “Well I’m a contractor, not a software provider.” Sure. This is true. But RFP’s that are trailblazing in nature signal what’s to come for interactivity – if the City of Tucson does it successfully, they will impose the same data tracking and network security expectation on vendors, suppliers, and everyone they interact with moving forward.
This technology revolution doesn’t happen overnight, but it does happen in marked cycles, as quickly as five year blocks from 2000 – from on-site everything to structured prefabrication, from printed plans to VDC and digital twins, from coiled proposal books to fully digital submissions, and now from human-activated processes to AI-activated processes.
If they plan to spend the next 3-5 years committed to AI adaptation, (they do, the RFP is here), they are committing to the burden of technology growing pains, new audits, and still needing to account for the viability of every dollar spent to stakeholders.
This means the VERY LEAST they will require of the AEC industry is this:
- Digital Safety Plan – a roadmap on how you keep every internet connected work device secure around the clock
- Data Management Plan – a proven process for storing client data, retention periods, access policies, and user authentication levels
- Network Security Program – your active approach to Digital Safety which includes your IT Director or CTO, technicians, training and tenure. As important to have construction industry experience as a PM.
- Performance Rankings – network uptime, service request response speed, call back speed – yes these metrics matter to clients no matter what you do, and so do rankings like Microsoft Secure Score.
Spot Migration is 100% U.S. based, and with data compliance that matters. Do you know where your information is physically stored or where your support agents physically are? Here’s another piece of response requirement from this RFP:
Vendors must commit that data does not leave the Continental United States for support or storage as stated in Special Terms and Conditions Section under 8.8 Data Protection and Artificial Intelligence (AI)
This is just a small look into the broader, fast moving integration of technology for clients.
They want partners they can trust who understand AI compliance language, are careful and strategic about their own adaptations (and document everything) and building partners who know their data is like money that legally belongs in a local bank, not far offshore. That’s what it looks like when the basics of network security can’t be accounted for, and before the RFP for JOC, CMAR, or Professional Services comes out, have your Digital Safety Plan prepared and ready to go.