Intelligent Risk Identification in Construction Projects: A Case Study of an AI-Based Framework

Abstract

Risk management in large-scale construction projects is a critical yet complex process influenced by financial, safety, environmental, scheduling, and regulatory uncertainties. Effective risk management contributes directly to project optimization by minimizing disruptions, controlling costs, and enhancing decision-making efficiency. Early identification and mitigation of risks allow resources to be allocated where they have the greatest effect, thereby optimizing overall project outcomes. However, conventional methods such as expert judgment and probabilistic modeling often struggle to process extensive datasets and complex interdependencies among risk factors. This study explores the potential of an AI-based framework for risk identification, utilizing artificial intelligence to analyze project documentation and generate a preliminary set of identified risks. The proposed methodology is implemented on the ‘Trg pravde’ judicial infrastructure project in Zagreb, Croatia, applying AI models (GPT-5, Gemini 2.5, Sonnet 4.5) to identify phase-specific risks throughout the project lifecycle. The approach aims to improve the efficiency of risk identification, reduce human bias, and align with established project management methodologies such as PM². Initial findings suggest that the use of AI may broaden the range of identified risks and support more structured risk analysis, indicating its potential value as a complementary tool in risk management processes. However, human expertise remains crucial for prioritization, contextual interpretation, and mitigation. The study demonstrates that AI augments, rather than replaces, traditional risk management practices, enabling more proactive and data-driven decision-making in construction projects.

1. Introduction

Modern construction projects are inherently complex and characterized by a multitude of interconnected activities, stakeholders, and external factors, making them prone to various risks [1].

These risks can be broadly categorized to include [1]

• Financial risks, encompassing budget overruns due to inaccurate cost estimations, inflation, or unforeseen expenses;
• Safety risks arising from hazardous working conditions, equipment malfunctions, and human error, potentially leading to accidents and injuries;
• Environmental risks stemming from pollution, habitat destruction, and non-compliance with environmental regulations, resulting in ecological damage and legal repercussions;
• Scheduling risks, involving delays caused by poor planning, resource constraints, or external disruptions such as weather conditions, impacting project timelines and overall efficiency;
• Regulatory risks pertaining to changes in building codes, permit approvals, and other legal and compliance-related issues, potentially causing project disruptions and increased costs.

Ineffective risk management in complex construction projects can lead to significant cost escalations, prolonged delays, and compromised quality standards, jeopardizing project success. Research by Ivić and Cerić [2] highlights that information asymmetry among project participants introduces risks that adversely affect project outcomes. Similarly, Lovrenčić Butković [3] emphasizes the importance of identifying critical success factors in international construction projects to mitigate such risks. These studies underscore the necessity for robust risk management strategies to ensure the successful completion and overall value of construction projects.

Traditional risk assessment methods commonly employed in the construction industry include [4]

• Expert judgment, relying on the experience and intuition of industry professionals to identify and evaluate potential risks.
• The use of risk registers, which are time-consuming to compile and maintain.
• Probabilistic modeling, employing statistical techniques to quantify the likelihood and impact of various risks.

However, these conventional approaches have inherent limitations [1,5]. Expert judgment can be subjective and prone to biases, risk registers are often time-consuming to compile and maintain, and probabilistic modeling can struggle with the complexities of large datasets and may not adequately capture the interdependencies between different risk factors [4]. Furthermore, these methods often require significant manual effort and may not be scalable to handle the vast amounts of data generated in modern construction projects [6].

Recent systematic reviews underline that artificial intelligence is increasingly applied to construction risk management but also reveal notable gaps, such as insufficient integration of diverse data sources and digital platforms into risk processes [7]. While AI tools enhance risk identification, integration with project data platforms remains underexplored, highlighting a need for more advanced integrated approaches. Similarly, Afzal et al. [8] reviewed current AI-driven cost-risk methods, emphasizing challenges in capturing complex interdependencies among risks, particularly cost overruns. These findings reinforce the need for advanced AI-based risk management solutions.

To overcome these challenges and enhance the effectiveness of risk management, artificial intelligence (AI) offers a promising avenue for improving risk identification, assessment, and mitigation in construction projects [4,9]. AI technologies can analyze vast amounts of project data, extract meaningful insights, and automate the generation of documentation, providing project managers with valuable tools to proactively address potential risks [9,10]. AI can assist in areas such as safety and predictive maintenance [6], and AI algorithms can handle the complexity of construction projects, with current applications ranging from large language models to computer vision and sensor-based classification techniques deployed across different project phases [10].

Other reviews also reinforce this trend: Costa et al. [11] conducted a systematic review of AI in project management, identifying its potential for improving forecasting, decision support, and automation, while Regona et al. [12] highlighted adoption barriers such as data fragmentation and limited standardization. Similarly, Chen et al. [13] emphasized the transformative potential of AI in infrastructure construction, particularly in enhancing safety monitoring, quality control, and process optimization. The integration of AI techniques across project management functions, such as schedule optimization, resource allocation, and safety monitoring, marks a paradigm shift in construction engineering and management [14]. Mentioned reviews highlight advancements in predictive analytics for scheduling and risk forecasting, along with emerging trends like deeper integration with Building Information Modelling (BIM) and Internet of Things (IoT), suggesting AI integration is essential for managing complex modern infrastructure projects.

Traditional risk analysis methods each have limitations in capturing project uncertainties comprehensively. Khodabakhshian et al. [15] systematically compared deterministic and probabilistic risk management methods, concluding that no single approach fully addresses uncertainty. Their findings support adopting hybrid or AI-augmented frameworks, motivating this study’s integration of AI-driven risk analysis methods. However, relying on AI introduces additional potential risks, such as algorithmic biases, over-reliance on automated outputs, and interpretability challenges, all of which necessitate careful validation and continuous human oversight to ensure reliability and accuracy in risk assessments [16]. Aladağ [17] recently assessed the performance of ChatGPT for construction risk management and found that while AI-generated risks were generally relevant and comprehensive, their prioritization consistency and contextual interpretation were limited, further underscoring the need for hybrid human–AI validation frameworks.

The methodological approach presented in this study is consistent with current European initiatives aimed at accelerating digitalization, automation, and the green transition in the construction sector. Within this context, the framework aligns with research directions pursued in the Automated Construction Site Progress Monitoring for Green Transition in Construction (AutoGreenTraC) project, where data-driven decision support is essential for improving quality, productivity, and sustainability outcomes across the project lifecycle.

The application of AI models presented in this paper is expected to demonstrate several contributions to project risk management. First, it shows how automation can tackle the labor-intensive aspects of risk identification, potentially identifying a broader range of risks in a shorter time. This is particularly valuable given that human-led risk identification is often constrained by cognitive biases and limited bandwidth-experts may overlook certain risks due to optimism bias or familiarity with routine issues [18]. Second, this study evaluates how well an AI-generated risk structure aligns with an established methodology (PM²); this offers insights into the integration of AI with standard project management practices. Notably, PM² prescribes maintaining a Risk Log and regularly updating it with new risks and responses [19], but it does not specify how risks should be identified beyond involving the project team. The proposed framework fills this gap by introducing a novel approach designed to perform risk identification in alignment with the PM² process steps. It is anticipated that the AI can produce a comprehensive baseline of risks, which project managers can then review and refine. This human-in-the-loop model reflects a hybrid approach: AI provides broad initial coverage, and human experts validate feasibility and implement specific mitigation measures. In contrast to prior AI-in-construction risk studies that mainly provide conceptual reviews, this research operationalizes a phase-based prompting framework explicitly mapped to the PM² lifecycle structure, performs a systematic cross-model comparison of OpenAI GPT-5, Google Gemini 2.5 Pro, and Anthropic Claude Sonnet 4.5, and introduces a four-layer validation protocol. To the authors’ knowledge, this is the first study to combine lifecycle-aligned AI prompting, multi-model triangulation, and expert validation into a single reproducible framework for public-sector construction risk identification.

The following sections detail the methodology, present the results, and discuss the comparison between AI and human risk management performance, and the conclusion presents key findings.

2. Materials and Methods

2.1. Data Collection and Project Selection

This paper presents an initial exploration of an AI-based framework for risk management specifically tailored for construction projects, addressing the unique challenges and complexities associated with this type of development. The effectiveness of this framework is evaluated through a case study on the ‘Trg pravde’ judicial infrastructure project in Zagreb, Croatia [20].

The selected project involves the construction of a centralized judicial complex intended to consolidate multiple courts and legal institutions within a single urban location. The project data was sourced from the Croatian Electronic Public Procurement Bulletin Board, where the official technical specification document was obtained from the tendering documentation [20]. The documentation consists of a comprehensive technical specification package comprising approximately 606 pages and 225,826 words, including a combination of textual descriptions, tabular specifications, and embedded figures. These documents span multiple project phases, covering regulatory requirements, technical design descriptions, contractual obligations, and implementation constraints. This project was selected for its inherent complexity, multi-phase structure, and the availability of comprehensive, structured documentation. As a public-sector and EU-funded initiative, it presents significant regulatory, financial, and operational risks, making it an ideal candidate for evaluating AI-driven risk identification. Moreover, its governance context and funding origin make it well-suited for applying the European Commission’s PM² project management methodology [19].

2.2. Project Segmentation

To facilitate a structured approach to risk management, the project was divided into four key phases, following established project lifecycle frameworks [19].

The phases defined for this project are

• Initiating Phase—covering feasibility studies, initial regulatory approvals, initial assessments, and early planning decisions;
• Planning Phase—covering the development of detailed design documentation, permitting processes (e.g., location and construction permits), stakeholder approvals, and refined cost estimation;
• Executing Phase—covering the main construction activities, including procurement of materials, on-site construction work, workforce management, and quality control measures;
• Closing Phase—covering testing and commissioning of the building, final inspections, compliance verification, permit finalization, and formal project handover to the client/operator.

Segmenting the project into these four phases enabled phase-specific risk assessment, ensuring that AI-generated insights were aligned with the particular objectives and challenges of each stage of the project’s lifecycle. This phase breakdown is consistent with the PM² Project Management Methodology, which defines a project lifecycle comprising four sequential phases: Initiating, Planning, Executing, and Closing [19]. In PM², each phase is characterized by a dominant set of activities (e.g., initiating activities in the first phase, execution in the third, etc.), and a project advances to the next phase once the goals of the current phase are achieved and formally approved.

2.3. Research Design

In this investigation, the potential of an AI-driven risk identification framework was explored in alignment with the project’s phases. The core objective was to examine whether AI could be used to automate risk identification and preliminary analysis across the project lifecycle. This focus on AI-based risk identification is motivated by the recognition that effective risk management begins with comprehensive and continuous risk identification [19]. According to the PM² methodology, new risks can arise at any point during a project and should be promptly identified and documented in the Risk Log [19].

This study adopts an initial research design to evaluate the potential of general-purpose AI models for risk identification in construction projects. The objective was to determine whether publicly accessible models, specifically GPT-5, Gemini 2.5 Pro, and Claude Sonnet 4.5, can extract relevant risk-related information from technical project documentation through structured prompt-based interaction. Importantly, no domain-specific training or fine-tuning was applied to either model. This approach was intentionally selected to reflect a realistic application scenario, in which industry professionals utilize commercially available AI models without the need for specialized machine learning expertise or access to construction-specific datasets.

To initiate the AI-driven risk management framework, AI models were tasked with analyzing the project’s technical specification document, which was originally in the Croatian language. The models were instructed to process the document in the English language, ensuring that all risk-related aspects were identified and categorized. No preprocessing steps, such as language normalization, content filtering, or anonymization, were applied prior to the analysis, as only publicly available documentation was used, and the documents were submitted in their original form. This step enabled the models to extract relevant project risks across all phases and organize them into a structured assessment format. The same procedure was applied using GPT-5, Gemini 2.5 Pro, and Claude Sonnet 4.5 to enable comparison of performance in terms of assessment consistency, coverage, and interpretability in risk identification.

For each model, a new chat session was initiated, and the models were prompted in an iterative, phase-by-phase manner to extract relevant risk information from the project documentation. For each project phase, specific prompts were crafted instructing AI models to list potential risks, their causes or sources, the areas of the project they might affect, and any relevant categorization (e.g., regulatory, technical, financial). It was ensured that the AI’s risk outputs were aligned with industry-standard risk management terminology, so that they could be easily compared to or integrated with conventional risk registers. For example, the prompts guided AI models to present each risk in a cause–risk–effect format, consistent with the PM² guideline of formulating risk descriptions as Cause–Risk–Effect [19]. Additionally, the AI was asked to categorize each risk (e.g., as technical, legal, financial, etc.), similar to the Category field in PM²’s Risk Log template, which ties each risk to an affected area or domain (business, technical, legal, etc.) [19]. By designing the AI interaction in this way, it was ensured that AI’s outputs could be directly mapped to a traditional risk log structure.

Following the initial identification of risks, an additional prompting stage was introduced in which the models were instructed to reorganize the previously extracted risks according to predefined filters. The grouping criteria included (1) risk category (e.g., financial, regulatory) and (2) stakeholder affected (e.g., Investor, General Contractor). For a project of this nature, these two categories and stakeholder roles were selected as representative examples due to their significant impact on project financing, execution, and decision-making. This step was not intended to generate new risks, but to examine whether the models could restructure and reframe existing information in response to analytical needs. This procedure allowed the framework to simulate a common workflow in professional risk management, where comprehensive risk lists are subsequently refined into targeted summaries for different project roles.

Throughout this implementation process, the quality and relevance of the AI-generated risks were monitored. The prompting was performed in the same chat session to maintain context, which allowed AI models to “remember” details from earlier phase outputs while analyzing later phases. This approach emulates a knowledgeable risk analyst who becomes increasingly informed about the project as they progress through its lifecycle.

Finally, the operational workflow of the proposed framework can be summarized as follows:

First, the available technical specification document is submitted directly to the AI models without preprocessing. Second, identical phase-based prompts aligned with the PM² lifecycle are applied across GPT-5, Gemini 2.5 Pro, and Claude Sonnet 4.5. Third, the AI generates risks in a structured cause–risk–effect format and assigns them to standard risk categories compatible with PM² Risk Log fields. Fourth, the resulting risks are reorganized using predefined labels such as category and affected stakeholder to produce targeted summaries for different project roles and analytical purposes. Fifth, human intervention is applied during validation and interpretation, where experts review and contextualize the AI-generated outputs.

2.4. Validation

A risk register for the “Trg pravde” project was not available at the time of the study, so no ground-truth document existed for direct comparison. As a result, verification relied on a structured, four-layer validation strategy:

• First, cross-model triangulation was performed by comparing outputs from the three AI models to confirm the consistency of identified risks across systems.
• Second, all identified risks were examined against patterns reported in established construction risk literature to ensure alignment with previously documented findings.
• Third, each risk was internally validated against verifiable evidence in the project’s technical documentation, confirming factual grounding and ensuring that every identified item was directly supported by the project data.
• Fourth, external expert validation was conducted. A targeted search identified three experts with substantial experience in construction risk management, representing academia and industry, and covering local (Croatia), European (Germany), and global (United States) perspectives. After selection, a 30-item questionnaire was administered (see Supplementary Material S5). Each participant received the publicly available technical specification document (identical to that used in the AI analysis), a summary document providing a condensed overview, along with a link to the questionnaire. The questionnaire itself utilized a mixed format of multiple-selection rating scales (e.g., star ratings), multiple-choice questions and open-ended text boxes for qualitative feedback. The expert responses were assessed through cross-comparison between respondents, alignment of their feedback with the comparative table of model-specific output characteristics developed in this study, and, where applicable, verification against evidence reported in the existing construction risk management literature. All documents were provided in both Croatian and English to ensure clarity, and the collected responses were analyzed to evaluate the accuracy and plausibility of the AI-identified risks.

Overall, this four-layer process ensured that the AI-identified risks were rigorously checked from multiple angles. Internal steps verified consistency, literature alignment, and support in project documentation, while external expert review added an additional layer of credibility. Together, these measures provide a reliable basis for interpreting the study’s findings.

3. Results

The results demonstrate how AI models identified phase-specific risks across the project lifecycle, highlighting their potential to support structured and efficient risk analysis.

Below is the initial prompt used to provide project-specific context to the AI models, submitted together with the technical specification document.

Initial prompt used:

“You will be acting as a risk management analyst for a public-sector judicial infrastructure project. I have provided you with a technical specification document (in Croatian) for the project: “Construction of the southern building and underground garage on Trg pravde.”

Your task is to thoroughly read and analyze the provided project document. While the document is in Croatian, you are to process and understand its content in English.

Crucially, please be aware that in our future interactions, we will be extracting specific data from the project document to perform various risk management tasks. Therefore, your understanding of the document’s details is essential.”

Following this initial context setting, the sections below present the AI-generated risk identification results together with the corresponding prompts, organized by project phase, risk category, and stakeholder responsibility.

Financial and Regulatory risks were selected due to their critical influence on project viability and compliance, while the Investor and General Contractor were chosen as key stakeholders responsible for managing these high-impact risk areas. The filtering and grouping were performed using only GPT-5, with the understanding that the same procedure can be reproduced with the other models without introducing methodological differences.

3.1. Initiating Phase

Prompts used:

“Please structure a Risk Identification Table. I want it to be focused on the Initiating Phase (Pre-construction) of the public-sector judicial infrastructure project provided:

‘Construction of the southern building and underground garage on Trg Pravde’.

The table should have 7 columns: Code, Risk Source, Cause/Driver, Risk (delivery, event, occurrence), Affected Area, Risk Category, and Risk Bearer.

-

Keep in mind the important documentation present in this phase: Pre-Investment study, Feasibility study, Conceptual solution, Environmental study…

-

Consider the following stakeholders for this phase: Investor, Government, Designer, Project Manager, Regulatory bodies…”

GPT-5 exported the results as a downloadable Excel file, Gemini generated the output in Google Sheets, and Claude displayed the results in its built-in table viewer. The generated risk identification tables for the Initiating Phase are provided in Supplementary Material S1.

When asked to explain the identified risks, differences were observed among the models in terms of scope, depth, and presentation:

• GPT-5 produced a concise and well-balanced risk list covering regulatory, environmental, geotechnical, and stakeholder-related risks. Its output emphasized breadth and alignment with standard risk register practice, identifying foundational risks such as unclear functional requirements, early-stage design quality issues, funding uncertainty, permitting delays, and stakeholder misalignment.
• Gemini 2.5 Pro provided a narrative-style explanation addressing risks connected to project viability, EU NPOO funding conditions, and constraints arising from the project’s historical context. The output included risks related to phased construction assumptions, operational continuity of judicial facilities, transformer station relocation, and regulatory feasibility within a protected urban environment.
• Claude Sonnet 4.5 generated the most detailed and granular output, producing an extensive set of initiating-phase risks with explicit contextual explanations, numerical references, and policy-level implications. Its analysis strongly emphasized financial feasibility, cost estimation uncertainty, and EU funding conditionality.

The complete AI-generated explanatory outputs for this phase are provided in Appendix A, with the results from GPT-5, Gemini 2.5 Pro, and Claude Sonnet 4.5 presented in Appendix A.1, Appendix A.2 and Appendix A.3, respectively.

3.2. Planning Phase

Prompts used:

“Please structure a Risk Identification Table. I want it to be focused on the Planning Phase (Pre-construction) of the public-sector judicial infrastructure project provided—‘Construction of the southern building and underground garage on Trg Pravde’.

The table should have 7 columns: Code, Risk Source, Cause/Driver, Risk (delivery, event, occurrence), Affected Area, Risk Category, and Risk Bearer.

-

Keep in mind the important documentation present in this phase: Location permit, Design documentation, Master (Main) design…

-

Consider the following stakeholders for this phase: Investor, Government, Designer, Project Manager, Regulatory bodies…”

The generated risk identification tables for the Planning Phase are provided in Supplementary Material S2.

When asked to explain the identified risks, differences were observed among the models in terms of scope, depth, and presentation:

• GPT-5 generated a structured explanation focusing on risks related to design documentation completeness, permitting procedures, late requirement changes, interdisciplinary coordination, regulatory changes, geotechnical integration, and stakeholder involvement. The output addressed risks affecting project readiness, schedule reliability, and technical completeness prior to procurement and construction.
• Gemini 2.5 Pro provided a detailed narrative explanation structured around regulatory, schedule, technical, and stakeholder-related risks. The output addressed risks associated with regulatory non-compliance of the Main Design, utility approval processes, procurement delays linked to fixed EU NPOO deadlines, alternative design options triggering redesign, BIM coordination failures, new geotechnical findings, and operational constraints related to uninterrupted judicial activities.
• Claude Sonnet 4.5 produced an extensive explanation emphasizing design development risks, BIM coordination challenges, adaptation of legacy architectural concepts to current regulatory requirements, structural assumptions related to phased construction, and compliance with nZEB energy performance criteria. The output addressed technical, regulatory, and performance-related risks that may propagate into later project phases if not resolved during planning.

The complete AI-generated explanatory outputs for this phase are provided in Appendix B, with the results from GPT-5, Gemini 2.5 Pro, and Claude Sonnet 4.5 presented in Appendix B.1, Appendix B.2 and Appendix B.3, respectively.

3.3. Executing Phase

Prompts used:

“Please structure a Risk Identification Table. I want it to be focused on the Executing Phase (Construction Phase) of the public-sector judicial infrastructure project provided—‘Construction of the southern building and underground garage on Trg Pravde’.

The table should have 7 columns: Code, Risk Source, Cause/Driver, Risk (delivery, event, occurrence), Affected Area, Risk Category, and Risk Bearer.

-

Consider the following stakeholders for this phase: Investor, Government, General Contractor, and Site Engineer…”

The generated risk identification tables for the Executing Phase are provided in Supplementary Material S3.

When asked to explain the identified risks, the models responded as follows:

• GPT-5 generated a structured explanation addressing operational, financial, regulatory, and environmental risks associated with on-site execution. The output covered issues related to labor and subcontractor availability, site supervision and quality control, cash flow and payment delays, unforeseen site and ground conditions, regulatory and safety compliance, construction planning and sequencing, and environmental disruptions affecting excavation and structural works.
• Gemini 2.5 Pro provided a detailed explanation focused on execution stage constraints linked to EU NPOO funding requirements and the responsibility of the General Contractor. The output addressed risks related to failure to obtain the Use Permit within the required timeframe, geotechnical and groundwater conditions during deep excavation, critical construction quality defects, and other execution-related compliance and coordination risks.
• Claude Sonnet 4.5 produced an extensive explanation concentrating on geotechnical and site-related risks during construction. The output addressed ground condition variability, groundwater management challenges, excavation pit support performance, and potential settlement impacts on adjacent heritage and operational buildings. These risks were described in relation to construction safety, structural stability, schedule reliability, cost escalation, and third-party impacts.

The complete AI-generated explanatory outputs for this phase are provided in Appendix C, with the results from GPT-5, Gemini 2.5 Pro, and Claude Sonnet 4.5 presented in Appendix C.1, Appendix C.2 and Appendix C.3, respectively.

3.4. Closing Phase

Prompts used:

“Please structure me a Risk Identification Table. I want it to be focused on the Closing Phase of the public-sector judicial infrastructure project provided—“Construction of the southern building and underground garage on Trg Pravde”.

The table should have 7 columns: Code, Risk Source, Cause/Driver, Risk (delivery, event, occurrence), Affected Area, Risk Category, and Risk Bearer.

Focus on the general risk caused by the delay of Occupancy/Usage Permit issuance.

-

Consider the following stakeholders for this phase: Investor, Regulatory Body…”

The outputs for the Closing phase are provided in Supplementary Material S4.

When asked to explain the identified risks, the models produced the following outputs:

• GPT-5 generated a structured explanation focusing on risks affecting commissioning, handover, and operational readiness. The output addressed issues related to incomplete or non-compliant permit documentation, delays in final technical and safety inspections, unresolved non-conformities and punch list items, administrative delays within permitting authorities, and gaps in digital as-built documentation, including BIM-based Asset Information Models.
• Gemini 2.5 Pro provided a detailed explanation emphasizing regulatory, financial, and contractual risks associated with meeting the fixed EU NPOO deadline for the Use Permit. The output addressed risks related to potential withdrawal of EU funding due to permit delays, regulatory refusal of the Use Permit, prolonged correction and re-inspection cycles, major defects triggering immediate corrective obligations, contractual handover disputes, operational readiness and training deficiencies, and political or administrative interference in the permitting process.
• Claude Sonnet 4.5 produced an extensive explanation concentrating on technical inspection and compliance risks during project closeout. The output addressed risks related to deficiencies in technical inspection documentation, incomplete commissioning of building systems, fire safety compliance failures, and airtightness testing deficiencies affecting nZEB certification. These risks were described in relation to permit approval delays, schedule overruns, cost escalation, and reputational impacts.

The complete AI-generated explanatory outputs for this phase are provided in Appendix D, with the results from GPT-5, Gemini 2.5 Pro, and Claude Sonnet 4.5 presented in Appendix D.1, Appendix D.2 and Appendix D.3, respectively.

3.5. Risk Analysis by Category

Prompt used:

“Filter the risks from the existing Initiating, Planning, Executing, and Closing Risk Identification Tables.

Create two new tables displaying only risks belonging to the ‘Financial’ or ‘Regulatory’ Risk Categories. So, one table for each category.

The table must include the following columns: Code, Risk Source, Cause/Driver, Risk (delivery, event, occurrence), Affected Area, Risk Category, Risk Bearer. Also add an extra column named ‘Phase’ before column ‘Code’ to know which risks belong to what phase.”

Table 1. Filtered financial risks (generated using GPT-5).

Phase	Code	Risk Source	Cause/Driver	Risk (Delivery, Event, or Impact)	Affected Area	Risk Category	Risk Bearer
Initiating	RCP-03	Government/Funding Body	Delays in budget approval or EU fund allocation	Postponement of procurement and mobilization	Schedule	Financial Risk	Investor
Executing	RCP-17	Investor	Late payments or disruptions in funding flow	Suspension of works or contractor claims	Cash Flow, Schedule	Financial Risk	Investor

and

Table 2. Filtered regulatory risks (generated using GPT-5).

Phase	Code	Risk Source	Cause/Driver	Risk (Delivery, Event, or Impact)	Affected Area	Risk Category	Risk Bearer
Initiating	RCP-04	Regulatory Bodies	Prolonged permitting or location permit issuance	Delays in start of procurement phase	Schedule	Regulatory Risk	Regulatory Authorities
Planning	RCP-09	Regulatory Bodies	Delays in issuing location or building permits	Delayed start of construction and procurement processes	Schedule	Regulatory Risk	Investor/Government
Planning	RCP-12	Government/Legal Framework	Changes in construction or procurement regulations	Required redesign or re-tendering	Schedule, Compliance	Regulatory Risk	Investor
Executing	RCP-19	Government/Regulatory Bodies	Unannounced inspections or changes in safety standards	Temporary halts or rework to comply with regulations	Schedule, Compliance	Regulatory Risk	General Contractor
Closing	RCP-22	Regulatory Body	Incomplete or non-compliant documentation submitted for usage permit	Delay in issuance of Occupancy Permit	Handover, Operational Readiness	Regulatory Risk	Investor

present the Financial and Regulatory risks filtered by GPT-5, respectively.

When prompted to provide insights on category-based grouping, GPT-5 responded as follows:

“Financial Risks (RCP-03, RCP-17)

Financial risks in the Trg Pravde project arise mainly from funding flow uncertainties and cash management challenges:

• Delayed public or EU funding approval can stall the initiation of procurement and early works, jeopardizing alignment with the National Recovery and Resilience Plan (NRRP) timelines.
• Interruptions in payment from the investor during construction can trigger claims, slow down on-site activities, or lead to suspension of works, affecting both schedule and contractor relations.

These risks highlight the importance of financial planning, timely fund allocation, and robust payment mechanisms to maintain project momentum and prevent contractual disputes.

Regulatory Risks (RCP-04, RCP-09, RCP-12, RCP-19, RCP-22)

Regulatory risks span the entire project lifecycle and are especially prominent in the Trg Pravde project due to its urban location, protected cultural context, and public-sector oversight:

• Permitting delays during concept and design phases (e.g., location/building permits) can push back procurement and construction schedules, especially when cultural heritage or environmental approvals are involved.
• Regulatory changes during the design phase (such as shifts in procurement or technical standards) may require documentation revisions or even re-tendering, adding administrative burden and timeline risk.
• On-site inspections or compliance shifts during execution can result in temporary work stoppages, especially if new safety or environmental measures are introduced.
• Incomplete documentation at closing can delay the issuance of the usage permit, directly impacting handover and operational readiness.

These risks underscore the need for early regulatory engagement, continuous legal monitoring, and proactive coordination with authorities to secure timely approvals and ensure compliance throughout.”

3.6. Risk Analysis by Stakeholder Responsibility

Prompt used:

“Filter the risks from the existing Initiating, Planning, Executing, and Closing Risk Identification Tables.

Create two new tables displaying only risks that are affecting the ‘Investor’ and ‘General Contractor’. So, one table for each stakeholder.

The table must include the following columns: Code, Risk Source, Cause/Driver, Risk (delivery, event, occurrence), Affected Area, Risk Category, Risk Bearer. Also add an extra column named ‘Phase’ before column ‘Code’ to know which risks belong to what phase.”

Table 3. Stakeholder-grouped risks: Investor (generated using GPT-5).

Phase	Code	Risk Source	Cause/Driver	Risk (Delivery, Event, or Impact)	Affected Area	Risk Category	Risk Bearer
Initiating	RCP-01	Investor	Inadequate definition of functional requirements in the pre-investment phase	Misalignment between final facility design and judicial operational needs	Project Scope and Quality	Requirements Risk	Investor
Initiating	RCP-03	Government/Funding Body	Delays in budget approval or EU fund allocation	Postponement of procurement and mobilization	Schedule	Financial Risk	Investor
Initiating	RCP-05	Environmental Constraints	Presence of protected trees and heritage-listed buildings	Constraints on design or need for redesign	Design, Scope, Schedule	Environmental Risk	Designer/Investor
Initiating	RCP-06	Geotechnical Conditions	Uncertainties in subsoil and groundwater conditions	Unforeseen foundation design changes or cost increases	Cost, Design	Technical Risk	Designer/Investor
Initiating	RCP-07	Stakeholder Engagement	Insufficient consultation with future building users	Misalignment of space planning and user needs	Functionality, Quality	Stakeholder Risk	Investor/Project Manager
Planning	RCP-09	Regulatory Bodies	Delays in issuing location or building permits	Delayed start of construction and procurement processes	Schedule	Regulatory Risk	Investor/Government
Planning	RCP-10	Investor	Late changes in project requirements or program scope	Design changes and cost escalation	Scope, Cost	Change Management Risk	Investor
Planning	RCP-12	Government/Legal Framework	Changes in construction or procurement regulations	Required redesign or re-tendering	Schedule, Compliance	Regulatory Risk	Investor
Planning	RCP-13	Designer	Insufficient incorporation of site-specific geotechnical conditions	Inaccurate design assumptions or foundation issues	Safety, Cost	Technical Risk	Designer/Investor
Planning	RCP-14	Stakeholder (Judicial Institutions)	Inadequate involvement of end-users during design finalization	Mismatch between facility layout and functional needs	Functionality, Satisfaction	Stakeholder Risk	Investor
Executing	RCP-17	Investor	Late payments or disruptions in funding flow	Suspension of works or contractor claims	Cash Flow, Schedule	Financial Risk	Investor
Executing	RCP-21	Environmental Conditions	Adverse weather or environmental incidents	Delays or damages to construction works	Schedule, Safety	Environmental Risk	General Contractor/Investor
Closing	RCP-22	Regulatory Body	Non-compliant documentation submitted for permit	Delay in issuance of occupancy permit	Handover, Operational Readiness	Regulatory Risk	Investor
Closing	RCP-23	Investor	Delays in final inspections and approvals	Extended project closeout timeline	Schedule, Commissioning	Management Risk	Investor
Closing	RCP-24	Investor	Outstanding non-conformities or punch list items	Regulatory body withholds usage permit	Quality, Compliance	Quality Control Risk	Investor/Contractor
Closing	RCP-26	Investor	Failure to submit updated BIM-based as-built documentation	Permit cannot be processed or approval delayed	Documentation, Commissioning	Digital Compliance Risk	Investor

and

Table 4. Stakeholder-grouped risks: General Contractor (generated using GPT-5).

Phase	Code	Risk Source	Cause/Driver	Risk (Delivery, Event, or Impact)	Affected Area	Risk Category	Risk Bearer
Executing	RCP-15	General Contractor	Shortage of skilled labor or subcontractor performance issues	Delays in construction activities and schedule slippages	Schedule	Construction Risk	General Contractor
Executing	RCP-16	Site Engineer	Inadequate site supervision or quality control	Defective works or non-compliance with design specifications	Quality	Quality Assurance Risk	General Contractor/Site Engineer
Executing	RCP-18	Construction Site Conditions	Unexpected underground obstacles or groundwater levels	Work stoppages or design modifications	Schedule, Cost	Technical Risk	General Contractor/Designer
Executing	RCP-19	Government/Regulatory Bodies	Unannounced inspections or changes in safety standards	Temporary halts or rework to comply with regulations	Schedule, Compliance	Regulatory Risk	General Contractor
Executing	RCP-20	General Contractor	Poor planning or sequencing of construction works	Inefficient resource use and project delays	Cost, Schedule	Construction Risk	General Contractor
Executing	RCP-21	Environmental Conditions	Adverse weather or environmental incidents	Delays or damages to construction works	Schedule, Safety	Environmental Risk	General Contractor/Investor

present the stakeholder-grouped risks affecting the Investor and General Contractor, respectively, filtered using GPT-5.

When prompted to provide insights into stakeholder-based grouping, GPT-5 responded as follows:

“The stakeholder-based grouping clarifies how the identified risks translate into responsibilities and potential consequences for each project actor.

1. Investor

The risks associated with the Investor are primarily strategic and regulatory in nature. These include unclear project requirements, changes in scope, funding delays, and incomplete or non-compliant documentation. Such risks directly influence the Investor’s ability to secure financing, maintain project momentum, and ensure regulatory approval. When these risks materialize, the effects are typically seen in cost escalation, schedule delays, and reduced alignment with end-user needs, all of which undermine overall project viability. As the party accountable for project initiation, governance, and compliance, the Investor is the logical bearer of these risks.

2. General Contractor

The risks linked to the General Contractor arise mainly during the Executing phase and relate to construction performance and operational control. These include shortages of skilled labor, planning inefficiencies, unexpected site conditions, and regulatory inspections during construction. If these risks occur, the consequences are generally delays, rework, cost overruns, and quality deviations, directly affecting the contractor’s contractual obligations and ability to deliver the project as agreed. Because the General Contractor manages on-site execution and resource coordination, these risks naturally fall within their operational responsibility.

In summary, the grouping shows a practical alignment between risk type and stakeholder role:

• The Investor carries risks tied to strategic decisions and regulatory compliance,
• The General Contractor carries risks tied to executing efficiency and on-site performance.

This distribution reflects typical accountability structures in construction project management and reinforces that the AI-generated grouping is consistent with industry practice.”

3.7. Questionnaire

The questionnaire was used to support the validation of the AI-generated risk identification outputs.

Table 5. Summary of expert questionnaire results (n = 3).

Question	Focus	Observed Responses
Q11	Missing or misclassified risks	All experts provided qualitative feedback, reporting no missing risks but noting that some risks were defined too broadly and could be specified more precisely.
Q22	Usefulness of AI for initial risk identification	Rated Very useful (2/3) and Extremely useful (1/3).
Q23	Trust in AI-generated risk lists	Rated Moderately trustful by all experts (3/3).
Q24	Main limitation of AI-generated outputs	Responses varied, highlighting overgeneralization, dependence on provided project context, and missing critical constraints.
Q25	Effectiveness of a hybrid human–AI approach	All experts answered Yes, definitely (3/3).
Q27	Most accurate overall AI model	Claude Sonnet 4.5 (2/3), GPT-5 (1/3).
Q28	Clearest explanations of risk analysis output	GPT-5 selected by all experts (3/3).
Q29	Best understanding of project constraints	Claude Sonnet 4.5 (2/3), Gemini 2.5 Pro (1/3).
Q30	Chosen AI model as primary reference	GPT-5 selected by all experts (3/3).

summarizes selected questionnaire items relevant to perceived usefulness, trust, limitations, and comparative performance of the evaluated AI models. Full questionnaire results are provided in Supplementary Material S5.

4. Discussion

The use of AI models for risk identification in this case study provides an interesting point of comparison between AI-generated risk outputs and human expert risk management. Overall, the AI demonstrated an ability to rapidly produce a broad set of risks that are relevant to the project, many of which align closely with what experienced project managers might identify. For example, classic construction risks such as permit delays, design errors, or equipment failures appeared in the AI’s output just as they would likely feature in a human-generated risk register. This suggests that AI models (with appropriate prompting) can leverage their training on vast textual data (including likely project management and engineering knowledge) to emulate a seasoned expert’s brainstorming session. This claim of broad, relevant risk coverage is supported by a conducted expert survey (Supplementary Material S5). For example, Respondent 1 under Q11 noted that each AI tool “identified a large number of serious risks” across different approaches, indicating that AI indeed casts a wide net. In fact, recent research found that ChatGPT (GPT-4 model) was able to generate more comprehensive risk management plans than human experts on average, covering a wider range of risks and strategies [4]. In this study, AI models similarly cast a wide net, capturing multi-dimensional risks (technical, financial, legal, etc.) across all project phases without apparent bias toward one category. This comprehensive coverage is a notable strength as it addresses one of the known issues in human risk identification, where individuals might focus too much on familiar risk types and neglect others. The questionnaire feedback further supports this strength in coverage. All three experts rated AI’s overall usefulness for initial risk identification very highly (Q22: Very and extremely useful). Respondent 1 emphasized that the different AI outputs together reveal “more than enough” serious risks, confirming that AI tends to list diverse issues.

However, a clear difference emerged in terms of specificity and context awareness. Human risk experts bring deep contextual knowledge of the particular project environment and can incorporate tacit knowledge (like organizational politics, individual stakeholder personalities, or very project-specific technical nuances) into their risk assessments. In contrast, AI models might generically identify “stakeholder opposition” as a risk, but a human expert with local knowledge might specify this as “Opposition from Village X due to required relocation of utilities,” a nuance the AI wouldn’t know unless it was explicitly in the documents. Additionally, practical constraints and the “messy” real-world feasibility of responses are where human judgment excels. Experts strongly validated these points about AI’s limitations. Every respondent mentioned context or constraints as the main missing element in AI outputs (Q24 responses). For example, one noted that without human oversight, AI can produce very convincing but unverified suggestions. As Respondent 3 wrote, “it formulates the info in such a detailed/structured/convincing way it can be incredibly misleading” unless a human checks it. Likewise, Respondent 2 has stressed that the AI failed to flag potential conflicts between end-user requirements and funding authority limitations, a primary driver of early contractual disputes. Overall, all three experts agreed (Q25: “Yes, definitely”) that AI must be paired with human review. This was further supported in the mentioned study, where it was noted that while ChatGPT’s risk strategies were quantitatively abundant, they lacked practicality and specificity in some cases [4]. Human experts, conversely, tend to formulate more realistic and detailed action plans (e.g., exactly how to approach the local council for permits, or which subcontractor might help mitigate a delay).

Another area of comparison is bias and consistency, as humans are subject to cognitive biases. Optimism bias may lead them to underestimate the likelihood of delays, or anchoring might cause them to fixate on certain known risks while overlooking new ones [18]. The AI, not having emotions or personal stakes, provided an unbiased look at the scenario based purely on the information given and its generalized knowledge. This means it dutifully listed even those risks that project teams sometimes downplay (e.g., significant schedule delays or budget overruns) due to organizational pressure or optimism. On the other hand, AI systems have their own limitations: they might over-generalize or include risks that are theoretically possible but less relevant in context. It was observed that the tested AI models did not introduce any completely implausible risks, likely because the prompt was grounded in the actual project document. But if an AI were working with limited context, it might list extraneous items. Humans are better at filtering such irrelevancies using common sense and context knowledge.

In comparing the three AI models examined in this study (GPT-5, Gemini 2.5 Pro, and Claude Sonnet 4.5), clear differences emerge in output format, level of detail, and focus in risk identification.

Table 6. AI model comparison for risk identification.

Aspect	GPT-5	Gemini 2.5 Pro	Claude Sonnet 4.5
Output format & size	Exported a table (Excel) with 26 risks total; brief text summary.	Provided a table in Google Sheets with 28 risks total; structured narrative explanation in a few thematic groups.	In-chat table with ~240 detailed risks total; extensive written analysis for each risk item.
Depth of explanation	Concise: Summarized broad risk categories in a few bullet points (focused on key issues like requirements, design, funding, etc.).	Moderate: Grouped risks into key clusters (e.g., viability, design, etc.) with clear bullet explanations highlighting causes and impacts.	High: Elaborated on each risk with context (e.g., specific data, regulations) and detailed implications; essentially a mini-report for every risk.
Coverage of categories	Broad but shallow: Touched on major domains (strategic, design, financial, etc.) with roughly one risk example each.	Focused breadth: Covered critical phase-specific domains (financial, technical/design, etc.) but not every possible category; prioritized the most pressing areas identified.	Comprehensive: Systematically addressed all domains, often listing multiple distinct risks per category for thorough coverage.
Practical usefulness	Quick overview: Easy to scan and kickstart discussion, but would need further detail from human experts for mitigation planning.	Targeted insight: Highlights top high-impact issues across the project phases, aiding prioritization; less overwhelming and context-rich, though some categories (e.g., quality, market conditions) are not explicitly covered.	In-depth resource: Very rich detail supports thorough risk planning and understanding, though the volume of information may require time for a team to digest and filter for relevance.
Notable strengths	Efficient broad-strokes identification; output aligns with typical high-level risk checklists a human might start with.	Balanced context-specific details with structured grouping, making the output digestible and directly relevant to the project’s situation.	Extremely detailed and context-aware, capturing nuances (e.g., funding conditions, technical specs, site history) that others omit—similar to an expert’s comprehensive report.

summarizes the key distinctions in how each model captured and presented risks across all phases of the project.

From this comparison, all three models captured many relevant risks, but with varying specificity and volume. GPT-5 and Gemini 2.5 Pro tended to highlight the most salient points in a concise format, whereas Claude Sonnet 4.5 offered an exhaustive list covering virtually every conceivable risk. The experts’ model preferences largely align with these observations. All three respondents chose GPT-5 to produce the clearest risk analyses (Q28) and would rely on its output as a primary reference if managing the project from the study (Q30). By contrast, Respondent 2 and Respondent 3 found Claude Sonnet 4.5 to be the most accurate overall (Q27), while Respondent 1 and 2 noted that it best understood the project constraints (Q29). In other words, the experts saw GPT-5 as quick and clear and Claude Sonnet 4.5 as most comprehensive. In practical terms, a human project team might use GPT’s or Gemini’s output as a quick starting checklist or to focus attention on critical issues (e.g., the hard funding deadline or major design flaws), while Claude’s output could serve as a comprehensive reference to ensure no category is overlooked. Notably, none of the AI-generated lists included implausible or irrelevant risks, as each model stayed on target given the prompt context. This suggests that with proper context, AI can reliably surface pertinent risks across technical, financial, legal, and other domains, leveraging its broad training knowledge. Overall, each AI model demonstrated strengths that could augment human risk management efforts: one provides brevity and speed, another offers structured insights on key threats, and the third delivers depth and thoroughness. A project manager could choose the AI output that best fits their needs or even combine them, such as using a quick broad list together with a more detailed deep dive, and then apply contextual judgment to validate, prioritize, and develop actionable plans for the identified risks. The AI-generated risks are intended to function as an initial baseline for the project Risk Log rather than as finalized decisions. Prioritization in terms of likelihood and impact is therefore envisaged as a step performed by project managers and designated risk owners, while future developments may enable AI systems to provide more advanced support for this task. Responsibility for monitoring and updating risks is assumed to remain with the project team in accordance with standardized project management methodologies, with AI support positioned as an assistive input that may be revisited at regular project control points.

Regarding risk prioritization, which is a crucial next step after identification, humans often apply intuition and experience to rank risks by significance. The AI in this exercise mainly performed identification and classification; prioritization would require either additional prompting or human input. Literature suggests that AI can assist with quantitative risk assessment (for example, using data to predict probabilities), but when it comes to nuanced judgment calls, human expertise is still key. A recent study assessing ChatGPT for risk management in construction noted that the AI’s performance was less effective in the consistency of risk assessment and prioritization [17]. This might be because prioritizing risks often requires subjective trade-offs and organizational value judgments (e.g., is a safety risk with low probability more critical than a cost risk with high probability?), which AI cannot easily make without clear criteria provided. The questionnaire results reinforce that expert judgment is crucial for prioritization. All respondents rated their trust in AI’s lists as only “Moderately trustful” (Q23), indicating they would not blindly follow AI rankings.

When considering human responses in risk management, it is important to note how risk identification is traditionally performed: often through workshops, checklists, previous project reviews, and expert knowledge. Human teams excel at discussing and debating risks, which can lead to creative insights or the discovery of risks that a single individual might miss. However, group dynamics can also introduce biases like groupthink, where certain risks might be dismissed too quickly if they challenge the group’s assumptions. There is evidence that major project failures are sometimes traced back to “unknown unknowns” or risks that were not identified at all or seriously underestimated by project teams (often due to cognitive biases or lack of information) [18]. Here, AI could complement human teams by ensuring a baseline of due diligence: the AI can act as a tireless assistant, bringing up an array of considerations (drawn from global knowledge and similar projects) that humans can then confirm or reject. This changes the typical workflow: instead of humans compiling the initial list and maybe missing some items, the AI compiles a broad list, and humans curate it. Moreover, all interviewed experts agreed that the best use of AI is as an assistant. They found AI very useful (Q22) for flagging issues across numerous domains, providing a comprehensive starting checklist. But they also insisted on human curation: one wrote that without an expert’s review, AI’s convincing narratives can be misleading.

The consensus that a hybrid model is most promising, combining AI processing with human judgment, is also strongly discussed in the reviewed studies [4,17]. AI models demonstrated speed, breadth, and adherence to formal structures (like including cause and effect, categories, etc.). Human experts bring depth, realism, and ethical judgment. For example, the AI might flag a risk like “contractor delay leads to penalty,” but a human project manager will gauge the actual likelihood based on the contractor’s track record and maybe decide it is medium priority rather than high. Conversely, the AI might catch a regulatory nuance (if it was in the documents) that a human overlooked in hundreds of pages of specs. The literature review reveals a consensus that AI is not here to replace human risk managers, but to augment them. AI tools can process enormous information and provide analytical insights (monitoring project data for early signs of risks, as suggested in the mentioned study), freeing human managers to focus on decision-making and communication [17]. Moreover, AI’s suggestions can challenge human planners to reconsider assumptions. For instance, if an AI lists a very bad-case scenario that the team assumed wouldn’t happen, it forces a healthy discussion: “Could this really happen? Do we have a contingency just in case?”.

In direct comparison to this case study, had a human team performed a risk register for the Trg Pravde project, they would likely have identified many of the same major risks (the overlap is encouraging). They might have also identified some hyper-specific local risks (like “risk of encountering unexploded ordnance from past conflicts”). The AI might have listed some general risks that in reality are either very low in this context or already managed (for example, it might mention “currency exchange risk” which is negligible if the project currency is stable or contracts are in local currency). In practice, the human team would prune those out. Essentially, AI provides quantity and coverage, humans provide quality control and nuanced judgment. Broader evaluations of AI in construction management highlight similar patterns observed in this study. Researchers found that AI significantly enhances early project planning through accurate forecasting and risk identification, but also identified adoption barriers such as data fragmentation [12]. Others highlight AI’s significant role in enhancing safety monitoring and process management in infrastructure construction [13].

In terms of performance, AI can generate in seconds what might otherwise require days of human workshops, yet without expert interpretation, its output remains a preliminary list that may omit context-specific constraints, introduce hallucinated issues, or be shaped by the structure of the input documentation. The project manager must still devise and execute appropriate responses for each risk, as human factors such as leadership, accountability, and team communication ultimately determine whether risks are effectively mitigated. AI does not handle these responsibilities; it does not convene coordination meetings, assess organizational dynamics, or negotiate with stakeholders. The survey results and prior studies consistently indicate that the most effective outcomes arise from a combination of AI support and human expertise [4,17]. In this study, these considerations are reflected through the application of the validation measures and review procedures described earlier in the methodology, which aim to moderate the limitations inherent in AI-generated risk identification.

5. Conclusions

This study demonstrates that an AI-based framework can support structured and efficient risk identification in complex construction projects by rapidly generating a broad set of phase-specific risks directly from technical documentation, and its application to a large public-sector judicial infrastructure project showed that AI models can interpret extensive tendering materials and translate them into risks aligned with typical patterns found in public construction. By structuring the analysis around the PM² lifecycle, the framework enabled these AI-generated risks to be captured in a format directly compatible with PM² artifacts such as the Risk Log, using a cause–risk–effect formulation and stakeholder-based accountability to ensure alignment with PM²’s emphasis on clarity, traceability, and continuous updating. Across all phases, the outputs were consistent with established construction risk patterns, and the validation process confirmed both their internal coherence and external credibility. The expert survey further indicated that the identified risks were comprehensive and useful as a baseline, while also highlighting the continued need for human judgment to interpret context, assess feasibility, and prioritize mitigation actions. These findings mirror trends reported in the recent literature, which similarly conclude that AI models can broaden early risk identification but still rely on human oversight for contextual interpretation and practical decision-making.

Comparative analysis showed that different AI models offer distinct advantages: some provide concise and actionable overviews suitable for early management decision-making, while others deliver highly detailed, context-rich risk descriptions that support comprehensive review. Used together, they form a robust foundation that human practitioners can refine to match local constraints, policy requirements, and institutional expectations. The findings suggest that AI does not replace expert-driven risk management but meaningfully enhances it by improving coverage, reducing initial effort, and mitigating common cognitive biases in early-stage identification. In public projects where delays, funding conditions, and regulatory compliance carry significant consequences, this ability to rapidly surface critical risks is particularly valuable.

Moreover, in comparable research contexts such as the AutoGreenTraC project, data-driven approaches are being explored to support improved construction safety, delivery reliability, and quality, while targeting reductions in inefficiencies and environmental impacts. By enabling earlier identification of execution, regulatory, and coordination risks, the framework presented in this study can strengthen decision-making and performance monitoring across the project lifecycle and further illustrate the role of AI as an enabling technology for sustainable and digitally integrated construction practices.

Overall, the results indicate that AI-driven risk identification can be a strong complement to established project management methodologies. Further development of the framework should extend it beyond risk identification into a more comprehensive, data-driven risk management system, including AI-supported risk prioritization, probabilistic assessment of likelihood and impact, and the automated generation of mitigation strategies to form complete risk registers rather than initial lists. Additional investigation is also needed into how AI-generated outputs can be systematically mapped to standard PM² Risk Log fields to support structured integration into existing workflows and how the framework performs across methodologies such as PMBOK, PRINCE2, and AACE TCM to enable broader applicability. Moreover, future studies should examine how the framework is expected to scale with increasing volumes of project documentation, including associated time and cost implications, and how it can be sustainably implemented in practice while ensuring document confidentiality and ethical use of AI tools. Such developments would move AI from a supportive tool to an integral component of construction risk governance, improving the reliability and consistency of project decision-making.