AI Compliance and Governance for Plumbing Small Businesses

AI compliance for a plumbing shop is not a CMMC problem and it is not a HIPAA problem. It is a customer-data, call-recording, licensure, and vendor-contract problem. The good news: the governance work that protects a plumbing business fits on a single page, signed by the owner, kept in the safe with the EIN paperwork. The bad news: most shops we audit have done none of it.

This is the practical version. Where the actual exposure is, what the AI policy document needs to say, and how to run vendor due diligence without hiring a compliance officer.

The five exposure surfaces

1. Call recording and two-party consent

Eleven states require two-party consent for call recording: California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, and Washington. If your AI receptionist is recording calls for QA, training, or AI training purposes — and most do — the disclosure has to be on every recorded call, every time.

The standard disclosure: "This call may be recorded for quality and training purposes." Played as the AI greets the customer. Verify your vendor defaults to this on for all states; some vendors only enable it on detection of a regulated state, which is the wrong default.

Retention policy matters too. Most states require 1–7 years. Federal Communications Commission rules and state UCC analogues can push retention to 7 years on disputed transactions. Default to 7 years and document the retention period in the policy.

2. Customer PII and payment data

The AI receptionist captures customer name, address, phone, sometimes credit-card information. The dispatch overlay reads service history. The bookkeeping AI sees AR and bank deposits. The vendor contracts must cover:

• Data ownership. You own the data. Verify in contract.
• Data export rights. You can export everything on termination, within 30 days, in a usable format.
• Sub-processors. The vendor lists every third party that touches your data. Most plumbing AI vendors use Twilio, OpenAI, Anthropic, or AWS as sub-processors; you need the list.
• Breach notification. Vendor notifies you within 72 hours of any breach affecting your data.
• PCI scope. Any vendor handling card data is PCI-DSS compliant. Most route payments to Stripe or Authorize.net to stay out of PCI scope; verify.

3. State plumbing-board licensure

Most state boards require:

• Any quote or proposal sent to a customer reference the license number of the contractor.
• Permitted work be supervised by a licensed plumber.
• Specific scope-of-work limits for journeymen vs masters.
• Disciplinary actions for unlicensed work, even when done by AI-recommended tech.

The AI dispatcher must enforce license-tied scope rules as hard blocks, not soft warnings. The AI estimator must include the license field on every proposal template. Audit the templates quarterly to confirm.

4. OSHA and PHMSA

• OSHA confined-space and excavation. Federal rules require trained personnel for confined-space entry and trench/excavation work over 5 feet. AI cannot recommend a non-certified tech for these jobs.
• PHMSA for gas work. Anyone touching a fuel-gas line holds the jurisdictional certification. The dispatch board enforces this; the licensed person is still responsible regardless of AI recommendation.

Make these hard rules in the dispatch engine. Document the rule set in the AI policy.

5. Marketing and review compliance

• FTC endorsement guides. Reviews must be from real customers. AI cannot generate fake reviews. AI can draft owner replies to real reviews; that is fine.
• TCPA for SMS dunning. SMS dunning requires prior express consent. Build the consent capture into the AI receptionist intake or your standard intake form.
• State debt-collection rules. Some states regulate dunning tone, frequency, and timing. Configure the dunning cadence to respect state-specific rules.

The one-page AI policy

What goes on the page, in this order:

1. Approved tools. List the AI vendors you have approved (Numa, Goodcall, ServiceTitan AI, Microsoft 365 Copilot, etc.). Anything not on the list is not approved.
2. Forbidden actions. No fake reviews. No pasting customer PII into unapproved consumer AI tools (ChatGPT free, Gemini consumer). No AI-generated proposals without human review before send.
3. Data handling. Where customer data lives, retention period, breach response.
4. Call recording disclosure. Standard disclosure script and verification cadence.
5. License and certification rules. AI cannot override scope-of-work limits or certification requirements.
6. Vendor due diligence. Who reviews and approves new AI vendors before adoption.
7. Audit cadence. Owner reviews policy and approved-tool list quarterly.

Sign it, date it, file it. Update once a year or when a major vendor changes.

Vendor due diligence checklist

Five questions to ask every plumbing AI vendor before signing:

1. Where is the customer data stored, and which sub-processors touch it?
2. What is the data-export and termination policy?
3. What is the breach notification timeline?
4. Does the call recording disclosure default to on for all states?
5. What is the indemnification clause if your AI causes a regulatory issue?

If the vendor cannot answer in writing, walk.

Common compliance failures

No call-recording disclosure. The most common audit finding. Vendor defaults are inconsistent; verify in writing.

Stale approved-tool list. Office staff start using a new tool, never get it approved, customer data leaks to a vendor outside the policy. Audit quarterly.

No tech sign-off on AI dispatch recommendations. AI recommends; tech executes. The licensed tech is still responsible. If the tech does not document the acceptance, the audit trail is broken.

License number missing from AI-drafted proposals. Common after a template update. Audit quarterly.

No breach playbook. If the vendor has a breach, what do you tell your customers? Have the playbook written before you need it.

How it fits the broader stack

Compliance is not a workflow — it is the governance layer that runs across all six AI workflows. Without it, the lift is real but the exposure is real too. The shops that do this right run the rollout and the governance in parallel; the shops that fight it end up retrofitting under pressure.

For the full picture of how the six workflows sequence, the 2026 plumbing AI playbook covers it end to end.

FAQ

Q: Do I need a lawyer to draft the AI policy? A: Not for the one-page version. For shops over $10M revenue or shops with municipal/commercial contracts, having counsel review is worth the $1,500–$3,000 spend.

Q: What if my AI receptionist is in a different state than my customers? A: Two-party consent follows the most restrictive jurisdiction on the call. If the customer is in California and the AI is in Texas, treat it as California.

Q: Does AI dispatching create licensing exposure? A: Only if it recommends a tech who is not licensed for the work and the tech actually performs the work. Hard-block license-mismatched assignments in the rule set and document it.

Q: What about my insurance carrier? A: General liability and E&O carriers have started asking about AI use on renewal questionnaires. Have the policy ready; underwriters look favorably on documented governance.

Q: Is there a federal AI regulation I should worry about? A: As of 2026, no federal AI regulation specifically targets plumbing shops. State-level rules around data privacy (CCPA in California, similar laws in 18 other states) do apply. The one-page policy covers the practical compliance for those.

Q: How does this fit with AI enablement overall? A: Compliance is the governance backbone. Without it, the operational lift is at risk. The one-page approach makes it tractable for any plumbing shop, not just enterprise operators.

---

If you want a one-page AI policy template scoped to your shop's state, FSM, and vendor stack — reach out. Or see the full engagement on the AI for plumbers page.

SOURCES

Cited and consulted.

1. 01ACCA Industry Research — Compliance and Governanceacca.org · accessed May 8, 2026
2. 02MCAA — Compliance and Best Practices Resourcesmcaa.org · accessed May 8, 2026
3. 03Plumbing & Mechanical Magazine — Regulations Coveragepmmag.com · accessed May 8, 2026
4. 04ServiceTitan Blog — Trade Business Complianceservicetitan.com · accessed May 8, 2026