Responsible Use of AI in Surveying Practice: A Small Firm's RICS Checklist

For each AI use that materially affects a service, a RICS-regulated firm must record why AI is the right tool, keep a written register, a responsible-use policy and a quarterly-reviewed risk register, vet suppliers in writing, have a named surveyor document output reliability, tell clients in writing beforehand, and train staff yearly. Give each duty one named owner.

The source is the RICS professional standard on the responsible use of artificial intelligence in surveying practice, 1st edition, effective from 9 March 2026. It applies to AI uses that have a material impact on delivering a surveying service. If you decide a use is material, the standard says you must record that decision and your reasoning. Items worded "must" are mandatory; items worded "should" are best practice.

Follow me on Instagram@sagnikteaches

I have read the standard itself and cite its section numbers. Nothing here is regulatory advice: RICS decides what compliance looks like, and its guidance says its Regulatory Tribunal has the last word on whether a particular use was material. The standard has no small-firm exemption and sets no sample sizes, so any number below is my suggestion, labelled as one.

Connect on LinkedInSagnik Bhattacharya

The checklist assumes a six-person practice: a principal, two building surveyors, a residential surveyor, an office manager and a graduate. Swap the titles for yours. What matters is that every duty has one name beside it, because a duty owned by "the firm" is owned by nobody when a client asks about it.

Subscribe on YouTube@sagnikteaches

Decide first which AI uses count as material

Section 1.2 says whether an output has a material impact depends on whether it is capable of influencing how the service is delivered and on the nature of that influence. It gives three examples: summarising documents that are then relied on when writing a report, composing all or significant parts of an opinion, and recommending which part of a building to investigate for a fault. RICS's guidance calls the decision largely one of professional judgement. Write your reasoning down, because the reasoning is what you will be asked to show.

The email row shows why judgement matters. RICS's guidance and FAQ appear to pull in different directions, and the dividing line seems to be client-facing content that shapes how the service is delivered, although RICS doesn't state that outright. For borderline tools, my suggestion is a one-line "considered, not material, because..." note, dated and kept with the register. For the everyday AI jobs a practice might run through this test, see using AI in surveying for quotes, reports and client updates.

Named owners for a six-person practice

Every duty in the standard appears below, with an owner, a rhythm and the evidence to keep. The section numbers are the standard's. Where the standard gives a frequency, I use it; where it doesn't, I say the rhythm is my suggestion.

Notice the split. The principal owns the decisions the firm is accountable for, the office manager holds the register, training log and data rules, which are administrative by nature, and a surveyor holds anything that needs professional judgement. Also notice section 2. Every member who uses AI to deliver services must keep a basic understanding of how it works, where it fails, bias and data risk, so that duty sits with each person, not with the training log. I have left out section 5, which applies to firms that develop their own AI systems; most small practices buy tools instead.

The register: four fields and three filled-in rows

Section 3.2 says firms must keep a written register of any AI system used that has a material impact, the purpose for which it is used, the date it was first used, and the date its use will next be reviewed. Four columns. Three sample rows show the level of detail that is enough.

The standard gives no review interval, so the next-review dates are your decision. I would set shorter intervals for tools that talk to clients, and diary each date as a task for the register's owner. RICS's FAQ says a record doesn't mean printing and filing everything; the firm decides how and in what form to keep records, provided they are enough to show compliance. A shared spreadsheet with a change history is a reasonable form for it; what matters is that the content shows compliance.

The written assessment: seven things to weigh

Before using an AI system that will have a material impact, a regulated firm must have carried out, and recorded in writing, an assessment of whether AI is the most appropriate tool. Section 3.2 lists seven things to consider at minimum.

1. The surveying services the firm provides.
2. The nature of the task or process for which AI could be used.
3. Available alternative tools for doing the task.
4. Environmental impact information for all tools considered.
5. Stakeholder impact information for all tools considered.
6. Data risks.
7. The risk of erroneous output and of bias in the system, and the consequences if they materialise.

The standard accepts a periodically reviewed written policy or standing statement that sets out each service, the purposes AI is used for within it, and why AI is the most appropriate tool, with explicit reference to those considerations. For a small practice that means one page per service line, not one per tool. A filled-in line for building surveys might read: "Pre-inspection summaries of document packs. Alternative: surveyor reads all pages unaided, about 90 minutes. Environmental and stakeholder impact: supplier asked, see due diligence file. Data risk: documents contain personal data, so used only on anonymised copies. Erroneous output risk: medium; mitigated by checking the summary against the originals for roof, drainage and damp sections. Conclusion: acceptable as a planning aid, not as report text." That is five lines of judgement, written once and reviewed yearly. The related policy side is covered in an AI acceptable use policy for a small professional firm.

The risk register: four themes, rated red, amber or green

Section 3.3 requires a risk register for firms using AI with a material impact. It must document four overarching risks: bias in the system and its outputs; erroneous outputs; limits on the quantity and quality of information about the system and its training data; and retention or use of the data your firm puts in. For each risk it needs a description, likelihood and impact, a mitigation plan, the firm's risk appetite, regular status updates, and a red, amber, green rating or similar. The people who decide how the firm uses AI must review and update it at least quarterly.

RICS publishes a blank sample with scales: likelihood from Remote to Expected, impact from Insignificant to Extreme, and appetite from Averse to Ambitious. Four rows from a small practice's register show it filled in, using those scales.

Put the quarterly review in everyone's diary on the same day each quarter, and keep a dated note of what you changed, even if the answer is "nothing". A register with no updates looks like paperwork done once.

Supplier due diligence: six written requests

Section 4.1 requires detailed due diligence before buying an AI system from a third party that will have a material impact, including embedded AI. It must involve written requests, written follow-ups, recording and assessing what you receive, and a record of how far you tested the system for fitness for purpose. At minimum you must ask in writing about six things. Adapt this email.

Subject: Written due diligence questions for [AI product name]

Hello [supplier contact],

We are considering [product] for [purpose] in our surveying practice and need the following in writing before we decide. Please answer each point or tell us it is not available.

1. The environmental impact of the system, including any published assessment.
2. The stakeholders involved in developing the system.
3. How the system complies with applicable data and confidentiality laws, and where our data is stored and processed.
4. The permissions obtained where data about individuals was used to build or train it.
5. The accuracy, relevance and diversity of the datasets used to train it, including known gaps and known risks of bias.
6. The type and extent of your liability to us if the system produces an erroneous output.

Please reply by [date]. If we have not heard from you we will follow up in writing and record any gaps as risks in our risk register.

Kind regards,
[your name], [firm]

Keep the sent email, the follow-up and the reply together in one folder per tool. If the supplier gives no or limited information, the standard says you must identify the risks that creates and record them in the risk register. The standard only asks you to record the extent of the practical testing you carried out, so I suggest a small, honest test: run the tool on ten past jobs where you already know the right answers, note what it missed, and save the notes. The supplier's silence counts as a finding as much as its answers do.

Confidential data: when a client's report must not be pasted in

Section 3.1 is the rule that bites hardest in daily work. Regulated firms must safeguard private and confidential data, which includes personal data and may include commercially sensitive data. The standard lists five actions: store the data securely, for example with encryption or back-ups; restrict access to staff who strictly need it; train staff with access at least annually; prepare data for AI use in a way that protects privacy, such as anonymising it; and refrain from uploading private and confidential data to AI systems unless two conditions are met. Those conditions are express written consent in advance from the affected stakeholders, and reasonable steps taken to satisfy the firm that the upload poses no unacceptable risk.

In practice, take a survey report with the client's name, the property address and a tenant's phone number in it. Before it goes anywhere near an assistant, replace the names with "[client]", the address with "[property]" and delete contact details. Then summarise the cleaned copy. If you need the original details processed, get the consent first, in writing, and write down the checks you made on the tool. RICS's FAQ adds that insurers increasingly require business versions of AI tools, so a free personal account is a poor home for anything with a client's details in it. The data rules also bind your colleagues' habits, so ask every member of staff in week one which tools they actually use, including free ones on personal phones, and offer a no-blame answer so the list is honest. The client-data angle for building surveyors is covered in client data basics for building surveyors.

Reliability decisions: the record a named surveyor signs

Section 4.2 says a firm must apply professional judgement to decide whether each material output is reliable, and must document that decision in writing. Professional judgement means knowledge, skills, experience and professional scepticism. The written decision must cover any assumptions made, key areas of concern about reliability (including underlying datasets), the reason for each concern, whether anything could lessen it, and the impact of the concerns on overall reliability, ending with a statement of whether the output can reasonably be used for its intended purpose. It must be prepared by, or under the supervision of, an appropriately qualified and named surveyor who accepts responsibility for its use. If you decide an output can't reasonably be used, you must tell the client in writing, with your reasoning or a summary.

Take the AI summary of a 40-page disclosure pack for a pre-purchase survey of a 1960s two-storey house, and the record a surveyor might sign for it.

Writing that for every output would swamp a small firm, and the standard acknowledges this. Where AI automates an output or series of outputs, or produces a high volume, it is generally neither necessary nor proportionate to scrutinise each one and write a decision. You must instead take randomised dip samples at regular intervals, and you remain accountable for every output. The standard sets no sample size. My suggestion for a small firm: five outputs a month, chosen by a random draw rather than by the person who ran them, each compared with its source and logged as pass or fail, with any serious error triggering a review of that tool's register entry. For the practical drafting side, see site notes and photos to a draft report.

Client notice: what your engagement terms must now say

Section 4.3 says firms using AI with a material impact must make clear to clients, in writing and in advance of using it, when and for what purpose AI is to be used. The terms of engagement and other client documents must detail six things: when AI will be involved, which parts of the process it is involved in, the extent of professional indemnity cover for AI use if available, the internal process to contest AI use, the process for seeking redress if a client feels adversely affected, and how a client can opt out, if at all. Sample wording for a schedule to your terms follows; have your own adviser check it before it goes into a contract.

USE OF AI IN THIS SERVICE
We use AI systems in these parts of the service: [for example, summarising documents you provide to plan the inspection]. A named surveyor takes responsibility for deciding whether each AI output can be relied on. We do not use AI to form [the valuation or the opinion].
Professional indemnity: [state the extent of cover for our use of AI systems, if available].
If you want to contest our use of AI, write to [named owner], who will reply within [number] working days.
If you believe you have been adversely affected by our use of AI, our complaints process is [summary or link].
Opting out: [you may ask us not to use AI on your instruction; this will affect fee and timescale as follows / AI use is integral to this service and cannot be switched off].
On request we will give you written information on the type of AI system used, its limits, the checks we made before using it, how we manage its risks, and our decisions on the reliability of its output.

The last paragraph of that clause is section 4.4. A regulated firm must be able to provide, on request, written information on the type of AI system used, its basic ways of working and limitations, the due diligence carried out, how its risks are identified and managed, and the decisions made about output reliability. The easy way to meet that is a one-page pack per tool, built from your register entry, due diligence file and risk register rows, kept ready. If you build the pack once, a client query costs ten minutes rather than a week.

Training and baseline knowledge: the annual record

Training appears three times: staff with access to confidential data (3.1), everyone involved in buying or using AI under the policy (3.2), and the baseline knowledge members need (section 2). A single annual session with a log can satisfy all three, as long as its content covers what the standard names. A one-hour agenda that does so would run as follows (my suggestion, not RICS's).

• Ten minutes: the types of AI the firm uses and how each works at a basic level.
• Fifteen minutes: how outputs go wrong, using one live example from the firm's own tools, and where bias comes from.
• Fifteen minutes: the data rules in section 3.1, with the consent and anonymising steps walked through on a real report.
• Ten minutes: the register, the risk register and who owns what.
• Ten minutes: a short quiz or discussion, and the sign-off sheet.

Log the date, attendees, content and who delivered it. New joiners need the same session before they use any tool, not at next year's date.

The evidence calendar: what each owner files, and when

Once the documents exist, the work becomes a rhythm. The standard fixes three frequencies: the risk register is reviewed at least quarterly (3.3), training happens at least annually (3.1 and 3.2), and automated or high-volume outputs get randomised dip samples at regular intervals (4.2). Everything else runs on a trigger, such as a new instruction, a new tool or a client's request. The calendar below puts both kinds on one page for the six-person practice; the items marked as my suggestion are not RICS rules.

The trigger small practices miss most often is the software update that adds AI to a tool they already pay for. Picture the practice's report-writing app gaining an "AI summary of site notes" button in a routine release, and the graduate using it on two jobs before anyone notices. Nobody bought anything, so no supplier email went out and the register doesn't list it. Yet section 4.1 covers AI bought from a third party "whether embedded in a broader technological solution or not", and the register covers any AI system with a material impact, so the new button needs the same paperwork as a new purchase. A standing rule closes the gap: whoever reads release notes (the office manager here) raises any new AI feature at the next weekly meeting, and nobody uses it on client work until the principal has written the materiality note.

Cover matters as much as ownership. In a six-person practice someone is always on leave or on site, so give every duty a deputy and write the deputy's name beside the owner's: the senior building surveyor holds the quarterly review if the principal is away, and the residential surveyor runs a month's dip sample when the tool's named surveyor is on holiday. A quarter missed because its owner was away is still a missed quarter, and the dated notes will show it.

A 90-day rollout and a mock audit

The standard sets no timetable beyond its effective date, so this order is my suggestion. It puts decisions first, because every other document depends on knowing which uses are material.

Then hold the mock audit, with the principal answering as if RICS had asked. Can you show these ten things within five minutes each?

1. Your list of AI uses considered, with which you judged material and why.
2. The register, with a next-review date on every entry.
3. The written assessment for each service line.
4. The risk register and the date of its last quarterly update.
5. The written questions and answers for one supplier.
6. One written reliability decision and the name of the surveyor who accepted responsibility.
7. The last dip-sample log.
8. The engagement letter that tells a client about AI, and the date it started going out.
9. The last training log, with attendees.
10. A consent for any upload of client data, or the anonymised copy that avoided needing one.

Any answer that takes more than five minutes shows where the paperwork is thin. Fix that before RICS or a client finds it. If you want templates for the register, assessment and client notice from another angle, the RICS AI standard for small firms covers them, and rolling out an AI policy so staff follow it deals with the people side. RICS also publishes supporting material, including a client information note, FAQs and a blank risk management sample.

Questions small surveying firms ask about the RICS AI standard

Does the standard apply to a firm that isn't RICS-regulated?

It binds RICS members and RICS-regulated firms. Section 3 (practice management), 4.1 (due diligence) and 4.4 (explainability) are written for regulated firms, but sections 2, 4.2 and 4.3 also bind individual members. A member working in an unregulated firm still owes the baseline knowledge, the written reliability decisions and the advance client notice. If you are unsure of your status, ask RICS.

Do I have to list every AI tool in the register?

No. The register covers AI systems that have a material impact on delivering a surveying service, and RICS's guidance doesn't require a list of every tool. A one-line note that you considered a borderline tool and judged it not material is still sensible, because you may need to explain that call later.

Can I use a free chatbot on survey notes?

The standard says firms must safeguard private and confidential data and must not upload it to AI systems unless affected stakeholders gave express written consent in advance and the firm has taken reasonable steps to check the risk. RICS's FAQ adds that insurers increasingly require business versions of AI. Anonymise first, or use a business plan with consent.

What if an AI supplier won't answer my due diligence questions?

The standard says that where a supplier gives no or limited information, the firm must identify the risks the missing information creates and record them in its risk register. A refusal is therefore a recorded risk, and it may be enough on its own to decide that you shouldn't buy the product.

Further reads

• AI for Building Surveying: A Worked Fee Quote and Enquiry Reply — A worked fee quote and reply that mention AI honestly.
• AI Policy for Architects: A Ready-to-Use Checklist and Clauses — Policy clauses from a neighbouring profession.
• Best AI for Quantity Surveyors: Five Tool Types Compared by Job — Takeoff software, spreadsheet AI, chat assistants, contract review and site capture, scored per quantity surveying job with prices and checks.
• AI in Land Surveying: Proposals, Field Notes and Client Updates — A land surveying firm's admin workflow: AI drafts the proposal, the field log and the client update, while the surveyor owns every figure and the sign-off.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: RICS professional standard, Responsible use of artificial intelligence in surveying practice, 1st edition, September 2025, effective from 9 March 2026 (sections 1 to 5); RICS supporting pages on the responsible use of AI, including the client information note, risk management sample and FAQs; RICS news items on the standard. Read on 29 October 2026.