Construction AI: NG Bailey puts a chief AI officer in the boardroom, and the data centre becomes a cyber-security problem

Here's a fact worth sitting with. NG Bailey, the Yorkshire-based engineering and services group that turned over £706.7m in the year to 27 February 2026 and lifted pre-tax profit 47% to £26m, has decided AI needs a seat at the top table. As part of its 2030 strategy, reported at the start of July, it's creating a chief AI officer role. Chief executive Jonathan Stockton called it an "important step" in providing "clear" leadership, so the group can "identify, develop and implement AI opportunities in a structured, responsible and secure way".

Read past the corporate phrasing and there's a genuine shift underneath. Most contractors have AI happening to them: someone in preconstruction is quietly using a model to write a method statement, someone in the bid team is running documents through a chatbot, and nobody's decided whether that's allowed, where the data goes, or who's accountable if it's wrong. What a chief AI officer does, at least in theory, is put one person's name against those decisions with the authority to stop a bad one. That's the bit that matters. Not the acronym, the accountability.

I'd offer one honest caveat. A new C-suite title can be real governance or it can be a press release with a job description attached. The test is whether the person can actually veto a tool the sales team loves, and whether they own the boring stuff, data residency, model choice, the audit trail, rather than just the innovation showreel. But the direction is right, and the signal to everyone smaller is clear. If a £700m business has concluded that AI adoption needs a named owner, the mid-tier firm running the same tools with nobody in charge is carrying that risk without knowing it.

For your board pack: name the person in your business who owns AI decisions, and give them the authority to say no. If you can't name them today, that's the appointment to make, and it doesn't need a new salary line, it needs a clear remit and a mandate.

For two years the data centre story in these briefs has been about demand, grid and the squeeze on trades. There's a quieter shift happening in parallel, and it changes what clients will ask of the people who build and fit out these things. The Cyber Security and Resilience Bill, currently moving through Parliament with Royal Assent expected later in 2026, makes data centre services an "essential service" in their own right, inside a new data infrastructure subsector. Colocation sites above 1MW of IT load, and enterprise sites above 10MW, become Operators of Essential Services, with duties around cyber risk, operational continuity and incident reporting. Crucially, the Bill brings supply-chain suppliers into scope too.

That was underlined by a cluster of government digital and energy policy updates published on 7 July, covering cyber resilience, the governance of the Digital Markets Unit and the Great Britain Corporate Power Purchase Agreement market. Taken together, they point at a more regulated, more closely scrutinised digital infrastructure economy. A data centre is no longer just a power-hungry, MEP-heavy building. It's a power-secured, cyber-sensitive, digitally regulated asset, and that reframes what a client expects from the contractor, the designer and the specialist subcontractor.

So, what does it mean on the ground? If you build, fit out, commission or supply data centres, the due diligence you face is about to widen. Expect questions about your own cyber posture and, more awkwardly, your subcontractors', because the regulation follows the chain. The comparison only goes so far, but it rhymes with what CDM did years ago: a duty landed at the top and the evidence requirement rippled all the way down to the smallest supplier. The firms that treat this as an IT problem for someone else will find it's a procurement problem for them.

The procurement filter: if data centre work is in your pipeline, ask your commercial lead one question this week. When a client's next tender asks us to evidence supply-chain cyber controls, can we answer, and can our key subcontractors? If the answer is a shrug, that's the gap to close before the tender lands, not after.

Google's Gemini 3.5 Pro is being lined up for a 17 July release, according to a steady run of reporting through early July. The headline number is the context window: a reported two million tokens, roughly double what most rivals handle in one pass, alongside a "Deep Think" reasoning layer aimed at multi-step logic and maths, and autonomous workflow features. The overhaul is a full rebuild of the 2.5 Pro architecture, positioned to compete with OpenAI's GPT-5.6 and Anthropic's Fable 5.

Set aside the benchmark race for a second, because the context window is the part that earns its place on a construction desk. Two million tokens is enough to hold an entire building contract, its schedules and appendices, and a full technical specification in a single prompt. What you can then ask is the sort of thing that eats a QS's afternoon: where does the spec contradict the contract, which clauses in this sub-contract don't flow down from the main contract, where are the gaps between the employer's requirements and the contractor's proposals. That's not a demo trick, it's a real, dull, valuable job that models are getting genuinely good at.

Here's the honest part. As of 7 July, the public Gemini API listed only gemini-3.5-flash and gemini-3.1-pro-preview. There's no model card, no confirmed pricing, no official benchmark, and 17 July is a widely reported target rather than a launch Google has stood behind. I'm not sure that date survives contact with reality, given the model has already slipped once. So treat this as capability planning, not a buying decision. Know what a two-million-token window would let you do, line up the document-review use case, and wait for the thing to actually ship before you build a process on top of it.

A practical step: pick the one document-checking task on your projects that's most painful and most repeatable, the contract-versus-spec cross-check is the usual winner, and write down exactly how you'd hand it to a large-context model. When a capable one lands, confirmed and priced, you'll be ready to test in an afternoon instead of a fortnight.

Put the three items next to each other and a single point falls out. The capability is racing ahead, and the discipline to use it safely is what separates the firms that benefit from the firms that get burnt. NG Bailey is buying that discipline with a board appointment. The data centre rules are forcing it up the supply chain whether firms want it or not. And the next frontier model, if it ships, hands you more power in one prompt than most teams know how to govern.

The evidence says the appetite is already there. Houzz's inaugural UK State of AI in Construction and Design report, drawn from over 145 professionals, found 46% already using AI, saving an average of more than three hours a week, which the report puts at over £23,000 in annual productivity gains per business. But the single biggest concern, cited by roughly a third of users, was reliability and accuracy. That's the whole tension in one survey: people are using these tools and getting time back, and they don't fully trust the output. The answer to that isn't more enthusiasm, it's the boring governance NG Bailey just put a name against, a person who owns the checking. That's what it's about. The tool gives you the afternoon back; someone still has to be accountable for what it produced.

Today's action: take the one AI task already happening in your business without permission, and give it a named owner and a verification step this week. You're not slowing anyone down. You're making sure the three hours saved don't become a mistake nobody caught.