Physical Security and Access Control for AI Companies

A company building or deploying AI systems often holds things other people want: model weights, training data, customer data, prototype hardware. Customers and enterprise buyers ask how those are protected, and part of the answer is physical. Who can walk into the office, who can reach the room where equipment sits, and who would know afterward.

In a building you own, you decide all of that. In a leased suite, you share the decision with a landlord who operates the lobby, employs or contracts the security staff, holds keys to your space and has a lease right to enter it. A security program written without reading the lease can promise controls the building does not allow.

This guide covers the real estate side. It is not a security standard. Your security lead, your auditor and your customers’ contracts define what you actually need.

Many technology companies go through a security attestation or certification, and enterprise customers send security questionnaires. The specific requirements differ and depend on how your auditor scopes the review, so confirm them with whoever is running yours. In general terms, the physical security portions tend to ask whether you can show the following.

• Entry to the office is restricted to authorized people, by a credential assigned to an individual.
• Entries are logged, and the logs are kept and can be reviewed.
• Access is granted when someone joins, changed when their role changes and removed promptly when they leave.
• Visitors are identified, recorded and accompanied where appropriate.
• Rooms holding sensitive equipment or data have tighter access than the general office.
• Someone reviews who has access on a regular basis.

Each of these has a real estate dependency. If the only door control is a system the landlord owns, can you get the logs? If building staff hold a master key to your server room, is access really restricted? If the landlord issues and cancels credentials, how quickly does a departed employee’s card stop working? The answers come from the building and the lease.

Think of the route from the street to your most sensitive room as a series of doors, and ask who operates each one.

• Building perimeter and lobby: landlord. Staffed desk or unattended, turnstiles or open elevators, hours of coverage, cameras.
• Elevators and stairwells: landlord. Whether elevators require a credential for your floor, and whether stair doors allow re-entry onto your floor.
• Common corridor on a multi-tenant floor: landlord. Anyone visiting your neighbors can reach your front door.
• Suite entry: usually tenant, sometimes on the building’s card system.
• Interior secure rooms: tenant. Server room, lab, storage for hardware and devices.
• Loading dock, freight elevator and mail room: landlord. The route equipment and packages take, often with less oversight than the lobby.
• Garage: landlord or a parking operator.

A full floor gives you control of the elevator lobby and removes the shared corridor, which is why security-conscious teams often prefer one even at somewhat more space than they need. On a shared floor, pay attention to construction details. Ask your architect whether the walls separating you from neighbors and corridors run all the way up to the structure above or stop at the ceiling, since a wall that ends at the ceiling tiles is a visual barrier and little more.

• ✓Is the lobby staffed at all hours, during business hours only, or not at all?
• ✓How do visitors register, are they screened against identification, and are they sent up unescorted?
• ✓Do elevators require a credential to reach our floor during and after business hours?
• ✓Can we install our own access control on the suite entry and interior doors, independent of the building system?
• ✓If we must use the building’s system, can we get our own door logs on request, and who can issue or revoke our credentials?
• ✓Can one credential work for both the building and our suite, if we want that convenience?
• ✓Where are building cameras, how long is footage kept, and can we obtain footage after an incident?
• ✓May we install our own cameras inside the suite and at our entry?
• ✓Who holds keys or master credentials to our space, and how are they controlled?
• ✓What background screening does the landlord require of its janitorial, security and engineering staff and contractors?
• ✓How are deliveries received and held, and who has access to the dock and freight elevator after hours?
• ✓Has the building had security incidents the manager is willing to describe?

Visit outside business hours as well. Observe whether the lobby desk is occupied, whether a door is propped open at the dock, and whether you can ride to the floor without a card. What the building does at night is the security you will actually have.

The standard lease lets the landlord enter your premises to inspect, make repairs, provide services, and show the space to lenders, buyers and prospective tenants. Forms often allow this at any reasonable time with little or no notice. For a company with secure areas, that clause needs editing.

• Advance notice for non-emergency entry, in writing or by an agreed method, with a stated minimum.
• Entry during business hours, or at times you agree to, with your representative present.
• Designated secured areas shown on a plan, where entry requires your escort except in a true emergency.
• Compliance with your reasonable security and confidentiality procedures, including sign-in.
• Prompt notice to you after any emergency entry, with a description of who entered and why.
• Limits on showing the space to prospective tenants, such as only near the end of the term.
• Janitorial service on a schedule you set, or excluded from secure rooms, with screened and consistent crews.
• No photography of your premises without consent.

Landlords accept most of this from tenants who explain the reason. They will keep emergency access, because life safety and building codes require it. A sealed key or lock box that shows when it has been opened is a common way to satisfy both sides.

If a customer contract or audit requires that no one enter a room unescorted, give that sentence to your attorney and broker before the lease is drafted. It is much easier to match the lease to the requirement than the reverse.

Installing access control, cameras and alarm systems is an alteration, so the lease has to allow it.

1. List the systems you intend to install and show secure rooms on the plan submitted with the proposal.
2. Get the right to install and operate them in the lease, including any connection to building doors, elevators or fire alarm that the systems need.
3. Confirm you own the equipment and the data it records, and that the landlord has no right to your logs or footage.
4. Agree how the landlord gets emergency access without holding a routine credential.
5. Settle whether readers, cameras and wiring must be removed at the end of the term.
6. Ask about building signage. Some teams prefer not to be listed on the lobby directory, and that is usually easy to arrange.
7. Coordinate with the fire alarm system so that secured doors release as code requires, and have your architect confirm the design.

Tenant Advisory Group represents tenants and buyers, and for technology companies with security requirements we ask about building security operations and entry rights in the request for proposal, so that a building’s practices are known before it reaches the shortlist. Your security lead and attorney should confirm that the final lease supports your policies.