A practical AI procurement guide for surveyors

Technology has been reshaping and improving surveying for years, but with the advent of artificial intelligence (AI), the pace of change has accelerated and the questions that RICS members are asking are different.

This article is the first in a series of practical content aimed at giving RICS members and RICS-regulated firms ways of using technology, data and AI in their professional practice.

Insights from the recent Shaping the Future Roadshow found that RICS members and RICS-regulated firms are no longer asking what AI is or whether it matters. 

Instead, they want to know how to use it effectively in their practice. The conversation has moved from AI being considered as something interesting to it being essential.

RICS data highlights this shift. The AI in commercial property and construction report 2026 found that around two-thirds of construction respondents now use AI in some form – up from just over half a year earlier. Most firms are no longer debating whether to use AI; they are trying to understand how to best use it.

This change makes it even more important for surveyors to buy technology and AI systems responsibly. Choosing these tools is now a professional responsibility, not just an IT or procurement task.

The same careful judgement surveyors use for valuations, building surveys, land appraisals, lease renewals or cost plans should also guide their technology choices.

On 9 March 2026, RICS' Responsible use of artificial intelligence in surveying practice professional standard came into effect, underlining this point. 

In that context, this article examines how to choose and procure AI tools responsibly. The aim is to help members and firms carefully evaluate and procure AI systems by asking the right questions.

The article is structured around five key questions to consider before making a technology procurement decision.

• What problem are you solving?
• How will the tool handle and store data?
• How does the AI tool work and where might it fail?
• Who owns the work inside the firm?
• What if the supplier disappears?

The standard covers AI outputs that have a material impact on the delivery of a surveying service; typically those that affect how the surveyor's work is rendered meaningful (section 1.2).

If this applies, RICS members and RICS-regulated firms must make a record of that determination and the reasoning behind it.

Where an AI output never feeds into the service itself, e.g. internal scheduling, formatting a document or drafting an internal email, the standard's requirements are not triggered, although data protection and confidentiality duties still apply to anything uploaded to an AI system. 

This assessment serves as the first gateway in the decision process; if the impact is material, the full requirements of the standard must be met by RICS members and RICS-regulated firms.

Being able to define the problem in a single sentence and name the exact part of the work to be improved is a sign that members are ready to invest in a solution rather than a capability they have not yet scoped.

There might be multiple areas of their work that they wish to undertake, and they should be outlined clearly. 

Deciding whether AI is the right tool at all, or whether a simpler, non-AI option would do the job cannot be assumed.

Before using AI that has a material impact on the delivery of a surveying service, RICS-regulated firms must carry out, and record in writing, an assessment of whether AI is the most appropriate tool (section 3.2).

That assessment must consider at least:

• the surveying services the firm provides
• the nature of the task or process in question
• available alternative tools
• environmental and stakeholder impact information
• data risks and the risk of erroneous output and inherent bias together with the consequences if those risks materialise.

Answering this first question is the start of that assessment.

The standard also requires that requests for information from suppliers are made in writing, and that a record is kept of the extent to which an AI system has been tested for fitness for purpose before procurement, as part of due diligence (section 4.1).

RICS members and RICS-regulated firms need to establish what data the tool needs, where it is stored and who can access it.

Under section 3.1, RICS-regulated firms that use AI systems must safeguard the private and confidential data they hold by:

• storing it securely (for example, encrypted and backed up) 
• restricting access to staff who strictly need it 
• training those staff at least annually on the privacy and confidentiality risks of AI
• preparing data for use in a way that protects privacy, such as anonymising it.

Firms must also refrain from uploading private or confidential data to a supplier's AI system unless there is express written consent in advance from the affected stakeholders (which may include client organisations, not only individuals) and the firm has taken reasonable steps to satisfy itself that the upload does not pose an unacceptable risk.

RICS-regulated firms must request documented evidence, not just assurances or marketing materials from suppliers. The standard requires that information is requested from the supplier in writing, followed up in writing where necessary, and recorded (section 4.1).

In addition, the standard requires written requests to suppliers regarding compliance with applicable data and confidentiality laws, and confirmation of necessary permissions for any personal data used, and details of the accuracy, relevance and diversity of the datasets used to train the system, including any known gaps and known risks of bias.

They must also request environmental impact information regarding the AI system and the tools provided.

Some suppliers publish environmental disclosures such as energy use, data centre region and data centre size. This is sometimes presented in a model or system card, making it easier to evidence.

Where a supplier does not publish this information, note the gap: the standard requires that any risks arising from missing information are recorded in the risk register.

If available, members and RICS-regulated firms should consider the extent of PI cover for use of AI systems by the firm.

As a best practice, members must hold off signing agreements until they can demonstrate the full data flow.

Together, these form parts of the due diligence requests required by section 4.1 of the standard, and the answers feed into the assessment of whether AI is the right tool at all.

Members do not need to be software engineers, but they must be able to explain what they are purchasing.

All models fail differently; for example, a large language model may invent facts that do not exist, while a predictive valuation model may produce a precise value for an asset that appears reliable but is built on incomplete, outdated, or inappropriate data, such as limited comparable evidence or changing market conditions.

They should also be able to explain who was involved in developing the system, how personal or confidential data has been used, what permissions were obtained, the environmental impact of the solution, and the extent of their contractual liability. Difficulty obtaining clear answers in these areas should be treated as a warning sign.

Ultimately, responsibility for determining whether an output is reliable remains with a named, appropriately qualified surveyor, who must record that decision in writing.

Where AI is used at scale or in high-volume workflows, firms should also consider proportionate quality assurance measures, such as randomised dip sampling of outputs.

Therefore, vague answers from a supplier should be considered a warning.

RICS-regulated firms must separately record inherent bias in the system and its outputs on their risk register. This data must be reviewed at least quarterly by staff responsible for making decisions about the firm's use of AI (section 3.3).

Understanding how an AI tool works is only part of procurement. Surveyors also need to understand who built the tool, how it has been tested and where responsibility sits if something goes wrong. These questions often reveal more about a product's suitability than its marketing material ever will.

Some examples of these requirements are provided below.

• Liability: many suppliers cap their liability well below the PI exposure that firms carry. The standard requires a written request for the type and extent of the supplier's liability, so ask for the cap and any AI-specific exclusions to be stated in writing before signing a contract.
• Practical testing: the standard requires a record of the extent to which the system has been tested for fitness for purpose before it is procured. Members should record what was tested, what was found, and what has changed.
• Stakeholders in development: for example, a cost-estimation tool developed with input from only the main contractors may overlook how subcontractors and trades work. Members should ask who contributed to the training set to identify potential blind spots before they affect client reports.

RICS members and regulated firms should always keep in mind that the standard applies to them, not the AI system supplier. A supplier cannot make their product compliant on behalf of members.

The checklist below brings those requirements together alongside additional questions that many firms may find useful in practice.

Their policies must set out the roles, responsibilities and liabilities of everyone involved in procuring or using AI (section 3.2). In practice, that means naming who maintains the risk register and who handles client disclosure.

The risk register itself must be reviewed and updated at least quarterly by the staff responsible for decisions about the firm's use of AI (section 3.3).

Clients must be told in writing, and in advance, when and for what purpose AI with material impact will be used.

Terms of engagement and related client documentation must then detail in writing when AI will be involved; the parts of the process where it will be involved; the extent of PI cover for AI use if available; the internal processes to contest it; the redress process; and how a client can opt out if at all (section 4.3).

Other risk management tools, such as a SWOT or PESTEL analysis, can be used in addition to the register.

Anyone involved in procuring or using the tool must receive relevant training at least annually. This is a requirement of the standard, not simply good practice. 

Within RICS-regulated firms, ownership must be supported by procurement and responsible use policies.

These can be developed either as an additional, standalone document, or may be added to existing firm policies around IT use, data protection and client engagement.

The six documents the standard requires, their coverage and review cycles, are set out in the table below.

The real risk for most firms is not the cost of meeting the standard's requirements. It is the cost of staying still while the market moves on or uses AI irresponsibly.

Making purchasing decisions around AI isn't just commercial. It impacts the technical capability, ethics and professional accountability of RICS members and RICS-regulated firms.

This article has aimed to show that procurement is less about the best tool and more about the understanding of how such tools work, where there’s risk and whether it's appropriate for use.

RICS members and regulated firms should undertake purchasing decisions that are more informed and accountable. This reduces the risk regarding non-compliance while dealing with third parties.

As AI adoption grows across the natural and built environments, regulation and advice about its responsible use will continue to evolve. Maturity will be defined by how responsibly AI systems are integrated with professional standards.