Aipedia: Building control approvers

AI, applicant data and confidentiality

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Uploading drawings, fire strategies or applicant details to a third-party AI tool engages building control confidentiality duties and data protection law. For higher-risk buildings, some information is also security-sensitive.

Part of: AI in building control approvers

In short

RBI code 5.5 and RBCA rule 5.6 require applicant information to be kept confidential, disclosed only in limited circumstances such as with express written consent or where required by law. Commercial data must be stored appropriately (RBI code 2.12, RBCA rule 2.20), and RBCAs need a written data protection policy (2.10). HRB information includes security-sensitive and golden thread material under the 2023 HRB procedures regulations. UK GDPR applies to personal data, and automated decision safeguards apply from 5 February 2026. Data breaches are often treated differently from negligence under PI.

What goes into AI tools

Building control files contain drawings, specifications, structural calculations, fire strategies, site photos, names and addresses of householders, contractor details and correspondence. AI tools used for plans assessment, summarising, transcription and drafting may process this material on external servers. Some suppliers may retain data or use it to improve their models unless that is switched off or excluded by contract.

The duties that apply

These duties apply whether or not AI is involved:

RBI code 5.5: treat applicant information as confidential and disclose it only in legal proceedings, with express written consent, when required or authorised by law, or to report a crime or breach of building control regulations.
RBI code 5.6: tell applicants their information may be shared with regulators.
RBCA rule 5.6: confidentiality.
RBI code 2.12 and RBCA rule 2.20: store commercial data appropriately.
RBCA rule 2.10: a written data protection policy.
Annex 2: terms of engagement describe how the applicant's information will be used.
OSR 1.8: records storage that allows electronic sharing and transfer.

See the RBI code of conduct and RBCA professional conduct rules. For RICS members, the RICS AI standard (section 3.1) also bars uploading private and confidential client data to AI systems without express prior written consent.

Higher-risk buildings and the golden thread

Applications for higher-risk buildings contain detailed information about structure, fire safety systems and building layout. The Building (Higher-Risk Buildings Procedures) (England) Regulations 2023 (SI 2023/909), including regulation 31, deal with golden thread and security-sensitive information. Uploading HRB documents to a general-purpose AI tool without checking where data goes and who can access it risks breaching those requirements as well as confidentiality duties.

UK GDPR and automated decisions

Householder applications contain personal data, so UK GDPR applies to processing by AI tools, including the need for a lawful basis, appropriate contracts with processors and security. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D, in force from 5 February 2026. These safeguards are relevant if a building control decision affecting an individual, such as a householder, were taken solely by automated means.

Illustrative: an inspector pastes extracts of a fire strategy and the applicant's contact details into a free generative AI chatbot to produce a summary. The service retains inputs by default. The applicant later learns of this and complains that confidential design information was shared without consent. The complaint raises regulatory, data protection and contractual issues, even though no harm has yet been shown.

How PI usually responds

PI is designed for negligence in professional services. Claims arising from data breaches, and regulatory fines, may be limited or excluded, with cover sitting instead under a cyber policy, depending on the wording. A confidentiality breach that causes financial loss to an applicant may fall in a grey area between the two. See GDPR and data breach cover within PI and cyber exclusions in PI wordings. Keeping a record of approved tools and settings supports both defence and renewal; see what to document about AI use.

Practical controls

These steps reduce the risk:

Approve specific AI tools for applicant data, and ban the rest for that purpose.
Check supplier terms on retention, training use, hosting location and sub-processors.
Remove personal data before uploading where the task allows it.
Never upload HRB documents to a tool not cleared for security-sensitive information.
Update terms of engagement to explain how applicant information may be processed.
Include AI in your data protection policy and staff training.

Related: AI review of Gateway 2 applications, AI in fire service consultations and AI chatbots for applicants. Apex arranges PI for building control professionals, and a broker can check how your policy treats AI-related data incidents. See the AI in building control hub.

Sources

Frequently asked

Can I upload applicant drawings to an AI tool?

Only with care. RBI code 5.5 and RBCA rule 5.6 require applicant information to be kept confidential, and commercial data must be stored appropriately. Use tools your organisation has approved, check supplier terms on retention and training, and consider whether consent is needed.

Is HRB information more sensitive?

Yes. Higher-risk building applications can contain security-sensitive information, and the 2023 HRB procedures regulations, including regulation 31, deal with golden thread and security-sensitive information. Do not upload it to tools not cleared for that material.

Does PI cover a data breach caused by an AI tool?

Often not in full. PI policies may limit or exclude data breach claims and fines, with cover sitting under a cyber policy instead. A confidentiality breach causing financial loss may fall between the two, depending on the wording.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.