The RICS AI standard: a practical guide for property firms
If your firm is regulated by RICS and anyone uses AI in a way that affects the advice you give, a new professional standard now applies to you. It has been mandatory since 9 March 2026. Most firms we speak to have not started.
This guide sets out what the standard requires, what firms are doing about it, and the steps you can take this month. It is written for partners, heads of practice and operations leads, not lawyers. For anything that matters, read the standard itself (linked at the end).
Summary
In short, regulated firms need a written register of AI systems, a risk register reviewed at least quarterly, written due diligence on AI suppliers, a named surveyor deciding whether AI outputs are reliable, written disclosure to clients before AI is used, and training at least once a year.
Buying the tool doesn't transfer the obligation. If you use a supplier's AI, you still own the checks.
Who it applies to
The standard applies to RICS members and RICS-regulated firms in every jurisdiction (section 1.2). It covers AI whose output has a material impact on the surveying service you deliver: a valuation, a measurement, a building survey, advice to a client.
You decide what counts as "material", but you must record that decision and your reasons. RICS gives examples: AI summarising documents that are then relied on in a report, AI composing all or a significant part of an opinion, or AI recommending which part of a building to investigate for a fault. A firm that uses AI only to draft internal emails may conclude little is in scope. A firm using AI to extract lease terms that feed a valuation will not. RICS publishes supporting information to help with this judgement.
AI doesn't have to be a standalone tool to count. AI features built into software you already use, such as a property management system, a valuation package or Microsoft Copilot, are in scope if their output materially affects the work.
Members and firms have different duties
Many requirements fall on RICS-regulated firms rather than on individual members. That matters if you're an RICS member working somewhere that isn't regulated by RICS, such as an investment manager or a lender. If that's you, read our guide for individual members.
| Requirement | RICS members | RICS-regulated firms |
|---|---|---|
| Baseline knowledge of AI (section 2) | Yes | Yes, through their members |
| Data governance, AI register, policies, risk register (sections 3.1 to 3.3) | No | Yes |
| Supplier due diligence (section 4.1) | No | Yes |
| Written decision on whether outputs are reliable (section 4.2) | Yes | Yes |
| Telling clients in writing before using AI (section 4.3) | Yes | Yes |
| Explaining AI use to clients on request (section 4.4) | No | Yes |
| Extra duties when developing AI (section 5) | Yes | Yes |
Where the standard conflicts with the law (it names the EU AI Act as an example), the law wins, but you must record the conflict and report it to RICS.
What the standard requires
These are "must" requirements, not guidance.
Knowledge
Members need a baseline understanding of AI: the main types, their limits, how they fail, the risk of wrong outputs, bias and data risks. In practice that means training, and being able to show it happened.
Data
- Store data securely and limit who can access it.
- Train staff with access to data at least once a year.
- Anonymise data where you can.
- Don't upload private or confidential data to AI without express written consent, in advance, from the people affected, plus a reasonable risk check.
A tenancy schedule pasted into a personal AI account is exactly what this is aimed at.
Systems
- Record in writing why AI is the right tool, considering alternatives, environmental and stakeholder impact, data risks, and the risk of errors and bias. A periodically reviewed policy can cover this.
- Keep a written register of AI systems that materially affect your services: system, purpose, date first used, next review date.
- Have written policies on responsible use and on buying AI, covering roles and liabilities, at least annual training, human oversight (such as dip sampling) and spotting risks. These can be added to your existing IT, data protection or client engagement policies.
Risk register
Cover at least bias, wrong outputs, limited information about how a system was built or trained, and what happens to the data you put in. For each risk: description, likelihood and impact, mitigation, risk appetite, status and a red, amber or green rating. The people who make decisions about the firm's use of AI must review it at least every quarter.
Buying AI
Before buying an AI system, including AI built into a wider product, ask the supplier in writing (and follow up in writing) about environmental impact, who developed the system, data and confidentiality compliance, permissions for personal data, training data quality and bias, and their liability. Record the answers and how far you tested the system. Log anything they can't answer as a risk.
Outputs
For each AI output you rely on, make a written decision on whether it's reliable: assumptions, concerns, how you dealt with them, your conclusion. A named, qualified surveyor makes or supervises it and accepts responsibility for its use. If an output can't reasonably be used, tell the client in writing with your reasoning. For automated or high-volume work, you don't need a decision on every output, but you must check randomised samples at regular intervals.
Clients
Tell clients in writing, before you use AI, when and why. Your terms of engagement must cover where AI is involved, which parts of the process, PI cover for AI use (if available), how to contest it, how to seek redress and whether they can opt out. If asked, explain in writing what the AI is, how it works, its limits and your checks.
Building your own AI
If you develop AI rather than buy it: record its purpose, risks, benefits and alternatives before deployment, assess its sustainability impact, involve a range of stakeholders and record who, document legal compliance, get written permission before using personal data, and have processes to check the quality and reliability of the data used to build it.
What firms are doing now
Most firms we speak to haven't started. Some assume the standard only applies to firms that build AI. It doesn't: buying a tool, or staff using one, is enough.
The firms getting it right are keeping it small: a short policy, a spreadsheet register, a risk register reviewed at the existing quarterly risk meeting, and a paragraph added to the terms of engagement. None of that needs a large programme. It does need someone to own it.
The hardest parts in practice:
Knowing what's in use
Staff use AI tools the firm hasn't approved, often on personal accounts. You can't register what you can't see.
Supplier questions
Many AI suppliers can't answer every question in section 4.1 yet. That's fine, as long as you log the gaps as risks.
Output checks at volume
Dip sampling needs a simple, repeatable routine, not a judgement made case by case.
What you can do this month
- Find out what's in use. Ask your teams which AI tools they use and for what. An anonymous survey gets more honest answers.
- Start the AI register. One row for each AI system that materially affects your services, including AI built into other software: name, purpose, date first used, next review date, owner.
- Start the risk register. Begin with the four risks the standard names, and add your own.
- Decide what's material. Write down which uses of AI affect the surveying service and why.
- Update your terms of engagement. Add a paragraph on AI use, contesting it, redress and opting out.
- Book the training. Annual, recorded, for everyone with access to client data.
- Put the quarterly review in the diary. Attach it to a meeting that already happens.
Want a hand putting this in place?
Jimmy King leads our work on the RICS AI standard. Call him on 07971 595815 or email james@tidebridge.co.uk.
Get in touchCommon questions
We only use Microsoft Copilot. Does this apply?
If Copilot's output has a material impact on the surveying service, yes. Buying or licensing a tool doesn't transfer the obligation.
Does AI built into our existing software count?
Yes, if its output materially affects your surveying services. The due diligence requirement applies to AI "whether embedded in a broader technological solution or not" (section 4.1).
I'm MRICS but my employer isn't RICS-regulated. What applies to me?
The duties on individual members: baseline knowledge (section 2), written decisions on whether AI outputs are reliable (section 4.2), and telling clients in writing before using AI (section 4.3). The registers, policies and supplier checks in sections 3 and 4.1 fall on regulated firms, though they're good practice anyway.
Do we need a separate policy for every tool?
No. One responsible-use policy and one procurement policy can cover all of them, and they can be added to your existing IT, data protection or client engagement policies. The register is where individual tools go.
What if a supplier won't answer our due diligence questions?
Record what you asked and what you received, and log the missing information as a risk in the register.
Does this replace UK GDPR or the EU AI Act?
No. Data protection law still applies. Where the standard conflicts with legislation, the law takes priority, and you record and report the conflict.
How often do we need to review all this?
The risk register at least quarterly. Training and policies at least annually. Each system in the register on its own review date.
Sources
- RICS, Responsible use of artificial intelligence in surveying practice, professional standard, 1st edition, September 2025, effective 9 March 2026.
This guide summarises the standard. It is not legal advice. Always check the standard itself for the exact wording.
