The RICS AI standard: what surveying firms must do.
Since 9 March 2026, every RICS member and RICS-regulated firm whose use of AI materially affects a surveying service has had to meet the RICS professional standard on the responsible use of AI in surveying practice. In short: understand how the tools fail, keep a written AI register and a risk register, question suppliers in writing, have a named surveyor record a judgement on the reliability of outputs, and tell clients in writing before AI is used. AssumeAI builds the governance and training that put this in place, and has done it against the standard for Hillbreak.
- Longest gap between risk register reviews
- 3 months
- Longest gap between AI training for staff
- 12 months
- New provisions we found in one firm's policy
- 12
- Documents in the governance pack we prepared
- 9
Firms we have built with
What is the RICS standard on responsible use of AI?
Responsible use of artificial intelligence in surveying practice is the first global RICS professional standard on AI. RICS published the first edition in September 2025, and it has been effective since 9 March 2026 for RICS members and RICS-regulated firms in all jurisdictions. It is a conduct standard, so it does not tell a valuer which model to use or how to configure it. It sets out how firms govern AI, how they decide whether to rely on what it produces, and what they tell clients.
Like other RICS professional standards, it separates mandatory requirements, which use the word must, from recommended best practice, which uses should. RICS says it will take relevant professional standards into account in regulatory or disciplinary proceedings when deciding whether a member or firm acted with reasonable competence, and that a judge or adjudicator is also likely to take them into account. The law firm CMS makes the same point in its commentary: the standard will inform how professional negligence claims against surveyors are assessed.
The standard sits alongside the law rather than above it. Members and firms must comply with any relevant legislation, and the standard names the EU AI Act (EU Regulation 2024/1689) as an example. Where the standard conflicts with legislation in a jurisdiction, the legislation takes precedence, but the firm must record the conflict and report it to RICS.
RICS is clear that it supports the use of AI. Its stated approach is to put the skill and experience of the professional surveyor at the core of the requirements, while guarding against complacency about the technology.
- 1st edition, September 2025
- Effective from 9 March 2026
- Members and regulated firms, worldwide
- Mandatory wherever it says must
Which uses of AI does the RICS standard cover?
The standard applies to the outputs of AI systems that have a material impact on the delivery of a surveying service. Whether an output has a material impact depends on whether it is capable of influencing the service and, if it is, how much influence it has. RICS gives three examples: an output summarising documents that are then relied on when writing a report, an output composing all or a significant part of an opinion, and an output recommending which part of a building to investigate for a fault.
General-purpose tools are therefore in scope when they are used in that way. A surveyor who uses ChatGPT, Copilot or Claude to summarise a document pack that then informs a report is likely to be relying on an output with a material impact, even though nobody in the firm built the tool. AI used for work that is incidental or unrelated to the service, such as tidying an internal meeting note, is likely to fall outside it.
If a member or firm decides that its use of AI will have a material impact, it must record that determination and the reasoning behind it. Most firms will use AI built by third parties, and the standard concentrates on that; firms directly involved in developing AI systems take on further duties, covered below.
What must a surveying firm put in place before using AI?
Sections 2 and 3 of the standard set the baseline. Every member who uses AI to deliver surveying services must have at least a basic understanding of the different types of AI system and how they work, their limitations and failure modes, the risk of erroneous output, the inherent risk of bias, and data usage and data risks. On top of that, RICS-regulated firms need four things in place.
Data governance
Private and confidential data must be stored securely, access must be restricted to the staff who strictly need it, and those staff must be trained at least annually on the privacy risks AI poses. Data must be prepared in a way that protects privacy, for example by anonymising it. It must not be uploaded to an AI system unless the people affected have given express written consent in advance and the firm has taken reasonable steps to satisfy itself that the risk is acceptable.
A written assessment and an AI register
Before using an AI system with a material impact, the firm must record in writing why AI is the most appropriate tool, having considered the service, the task, the alternative tools, environmental and stakeholder impact, data risks, and the risk of error and bias. A periodically reviewed written policy can serve as this assessment. The firm must also keep a register of each such system, its purpose, the date it was first used and the date its use will next be reviewed.
A responsible use policy
Firms must have policies on procuring and using AI responsibly, informed by the risk register and covering both internal and third-party systems. As a minimum they must set out roles, responsibilities and liabilities, at least annual training for everyone involved, how human judgement interacts with the AI (for example through monitoring or dip samples), and guidance on identifying and mitigating risks.
A risk register, reviewed quarterly
The register must cover inherent bias, erroneous outputs, limits on what is known about the system and its training data, and the retention or use of data the firm puts in. For each risk it records a description, likelihood and impact, the mitigation plan, the firm's risk appetite, status updates and a red, amber, green rating. It must be reviewed and updated at least quarterly by the people who make decisions about the firm's use of AI.
What does the standard require each time AI is used?
Section 4 governs the use of AI in practice, from buying a tool to explaining it to a client.
Supplier due diligence, in writing
Before procuring an AI system with a material impact, firms must request information from the supplier in writing, follow up in writing where needed, record and assess the answers, and record how far the system has been tested for fitness for purpose. The requests must cover, as a minimum, environmental impact, the stakeholders involved in development, compliance with data and confidentiality laws, permissions for personal data, the accuracy, relevance and diversity of the training data, and the supplier's liability. Where a supplier says little, the gaps go into the risk register.
A named surveyor's reliability decision
Members and firms must apply professional judgement, which the standard defines as knowledge, skills, experience and professional scepticism, and record in writing a decision on the reliability of each output with a material impact: the assumptions, the concerns and their reasons, what could lessen them, and whether the output can reasonably be used. It must be prepared by, or under the supervision of, an appropriately qualified and named surveyor who accepts responsibility for it. For automated or high-volume use, randomised dip samples at regular intervals replace checking every output.
Clients told in writing, in advance
Clients must be told in writing, before AI is used, when and for what purpose. Terms of engagement must state when AI will be involved, the parts of the process it touches, the extent of professional indemnity cover for AI if available, how to contest its use, how to seek redress and how a client can opt out, if at all. If an output is judged unfit for its purpose, the client must be told in writing, with the reasoning or a summary of it.
Explanations on request
Firms must be able to provide, on request, written information on the type of AI system used, how it works and where it falls short, the due diligence carried out before using it, how its risks are identified and managed, and the decisions made about the reliability of its outputs.
What if your firm develops its own AI tools?
Section 5 covers members and firms directly involved in developing AI systems, from establishing the project team to selecting the data used to train the system. The rest of the standard applies to the development process, and before general deployment the firm must record in writing the system's identifiable application, its potential risks and benefits for a specific task or process, and other possible approaches to that task. Developers must also:
- Carry out, and record in writing, a sustainability impact assessment of the proposed system
- Select a diverse range of stakeholders to be involved, and record everyone directly involved
- Document that the development complies with all applicable data and confidentiality laws
- Obtain written permission, in advance, from anyone whose personal data will be used in development
- Have policies and processes to assess the quality and reliability of the data used
If you commission a custom tool rather than build one yourself, it is worth agreeing at the outset who keeps these records. When we build for a client, the work ends with a handover and documentation, and the client owns the code, so the records sit with the firm rather than with us.
Where do existing AI policies fall short of the standard?
A first AI policy is often a page of principles: keep client data confidential, check what the tool produces, use approved tools. Those principles are sound, and the standard agrees with all of them. What it adds is specificity: named records, set review intervals and written client terms.
Measured against the standard, these are the gaps to look for. Is there a written record of which uses of AI have a material impact? Is there a register of tools with dates for review, and a risk register reviewed each quarter? Were the questions to suppliers put in writing? When outputs are checked, does a named surveyor record a written reliability decision, and is high-volume use dip sampled? And does the engagement letter say anything about AI, indemnity cover, redress or opting out?
None of these gaps is hard to close once it has been found. The work is in finding them all, and in writing the records so they fit how the firm actually uses AI, rather than adopting a template that describes some other firm.
- No record of where AI has a material impact
- No AI register, and no review dates
- Outputs relied on without a written check
- Engagement letters silent on AI
What does compliance with the RICS AI standard look like in a real firm?
Hillbreak is a specialist ESG and sustainability advisory firm for the real estate sector. Its existing AI policy was principles-based and a solid foundation, but the RICS standard introduced specific, documented obligations. We assessed the policy against the standard, identified twelve new provisions and prepared a nine-document pack, taking the updated policy from four rules to thirteen. The pack included:
- A gap analysis against the RICS standard
- An updated internal policy on the use of AI tools
- An externally facing AI policy
- An AI tool impact assessment template and an output reliability assessment template
- An AI risk register and an approved tools register
- Boilerplate AI clauses for client engagements and reports
A pack only works if people use it. Hillbreak's pack requires a written assessment of every AI tool before it is used, so we followed up with an impact assessment workshop: a live, recorded walkthrough and a worked example of all nine sections of the template, with seven risks rated before and after mitigation, so the team can carry out assessments themselves. We also ran three Claude Cowork workshops alongside the firm's pilot, which speaks to the other half of the standard: people who understand how the tools work and where they fail.
Describe the defined business use case for this tool. What problem does it solve, and what outputs will it produce?
| Non-AI alternatives considered | |
|---|---|
| Why AI is more appropriate than alternatives | |
| Is this use of AI proportionate to the task? |
Governance pack · TemplateAI Tool Impact Assessment
Complete one per AI tool. Retain as a governance record.
| Tool name | |
|---|---|
| Vendor or provider | |
| Version or model | |
| Date of assessment | |
| Assessor | |
| Business owner | |
| Date of first use | |
| Next review date |
- Gap analysis against the RICS standard
- Internal and external AI policies
- Risk register and approved tools register
- AI clauses for engagements and reports
How can AssumeAI help your firm meet the RICS standard?
We are an AI consultancy, not a law firm or a regulator, and nothing on this page is legal advice. What we do is the practical work the standard creates: the documents, the registers, the client wording and the training, fitted to how your firm actually uses AI. If you would rather start on your own, the governance template we use with clients is free.
AI governance implementation
AI governance implementation produces internal and external AI policies, impact assessments, and audit trails including a risk register and an incident log, aligned with EU GDPR and the requirements of your chartered or professional body. For a surveying firm it starts with a gap analysis against the RICS standard, as it did for Hillbreak. It typically takes two to four weeks and starts from £3,000.
Tailored AI team training
The standard expects members to understand how AI systems work and fail, and firms to train staff at least annually. Tailored AI team training covers Claude, Cowork, Gemini and Prompt Engineering Fundamentals, built around your real work rather than generic demos, remotely or on site, from £5,000, and can run as a sustained programme on our own platform.
AI Strategy Review
If you are not yet sure where AI should have a material impact on your services, the AI Strategy Review finds and prioritises the opportunities first and hands you an AI risk assessment alongside the roadmap. It takes about six weeks, from £12,000; Hillbreak's focused review took three weeks and set out twenty-three initiatives. Our page on AI for professional services covers the wider picture.
Sources
This guide summarises the standard as published. Where it paraphrases a requirement, the standard's own wording governs. Last checked against the published standard on 21 October 2026.
- RICS, Responsible use of artificial intelligence in surveying practice, professional standard, global, 1st edition, September 2025, effective from 9 March 2026
- RICS, RICS launches landmark global standard on responsible use of AI in surveying, 10 September 2025
- RICS, RICS' first ever standard on responsible AI use now in effect, 18 March 2026
- CMS, RICS introduces mandatory AI standard for surveyors: what insurers and their clients need to know, 10 March 2026
- RPC, A new era for surveyors: RICS launches global standard on responsible use of AI
Questions
When did the RICS AI standard come into effect?
The RICS professional standard Responsible use of artificial intelligence in surveying practice was published as a first edition in September 2025 and has been effective since 9 March 2026. It applies to RICS members and RICS-regulated firms in every jurisdiction. Where it conflicts with local legislation, the legislation takes precedence, but the firm must record the conflict and report it to RICS.
Does the standard apply if we only use tools like ChatGPT or Copilot?
It can. The standard applies to AI outputs that have a material impact on the delivery of a surveying service, whoever built the tool. RICS gives examples such as an output summarising documents that are then relied on when writing a report, or an output composing all or a significant part of an opinion. If you decide your use has a material impact, you must record that decision and the reasoning behind it. AI used for work that is incidental or unrelated to the service is outside its scope.
Do we have to tell clients that we use AI?
Yes, where the AI has a material impact on the service. You must tell clients in writing, before the AI is used, when and for what purpose it will be used. Your terms of engagement must also set out where AI is involved, the extent of your professional indemnity cover for AI if that is available, how to contest its use, how to seek redress and how a client can opt out, if at all.
How often must the AI risk register be reviewed?
At least quarterly, by the people in the firm who make decisions about its use of AI. The register must cover inherent bias, erroneous outputs, limits on the information available about the system and its training data, and the retention or use of data the firm puts into it. For each risk it records a description, likelihood and impact, the mitigation plan, the firm's risk appetite, status updates and a red, amber, green rating.
Who can help a surveying firm comply with the RICS AI standard?
RICS publishes the standard and supporting material, and law firms such as RPC and CMS have published useful commentary. For the practical work, AssumeAI is a UK AI consultancy that builds the governance the standard calls for: a gap analysis against the standard, internal and external AI policies, impact and reliability assessment templates, a risk register, an approved tools register and AI clauses for client engagements, as we did for Hillbreak, where we found twelve new provisions. Governance work typically takes two to four weeks, from £3,000, and we train teams too. We are not lawyers, so take liability and insurance questions to your adviser or broker.