Aipedia: Building services engineers

AI analytics in BMS and smart buildings

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

AI analytics can optimise building management systems, but the engineer who designs, specifies or tunes them takes on data, cyber and control risks. A smart building fault can affect comfort, safety and personal data at the same time, and several insurance policies may be involved.

Part of: AI in building services engineering

In short

Building services engineers design, specify and advise on AI that optimises BMS setpoints, schedules and plant using sensor and occupancy data. Risks include control strategies that fail, personal data collected without a lawful basis, and connected systems exposed to cyber attack. CIBSE Code clause 3.6, the Engineering Council Statement of Ethical Principles (Principles 2 and 5), Engineering Council security guidance and CIBSE DE6.1 all apply. PI usually covers negligent advice and design, while a cyber event affecting your own systems or data usually sits with cyber insurance, depending on the wordings.

How AI is used in building management

AI layers on BMS platforms learn from temperature, CO2, occupancy and energy data, then adjust setpoints, start times, ventilation rates and plant sequencing. Some act autonomously within limits set by the engineer. Building services consultants specify these systems, write the control philosophy, set the limits and analyse the results for clients.

The data involved often includes occupancy counts, access control records, Wi-Fi presence or desk sensors, which can identify individuals.

The duties that apply

Statement of Ethical Principles: Principle 5 covers AI and "technologies with autonomous or semi-autonomous capabilities"; Principle 2 covers physical and cyber security and data protection. Statement of Ethical Principles.
CIBSE Code clause 3.6: respect privacy and personal data and protect confidential information. CIBSE Code.
Engineering Council security guidance and CIBSE DE6.1 Cyber security in building services design (2019), listed on the CIBSE digital engineering portal.
UK GDPR Articles 22A to 22D: inserted by section 80 of the Data (Use and Access) Act 2025 and in force since 5 February 2026, these apply to solely automated decisions with significant effects on individuals. Most comfort controls will not reach that threshold, but systems that act on identified individuals deserve a check.

What can go wrong

An AI optimiser can reduce ventilation to save energy while CO2 rises, override frost protection, or learn from faulty sensors. Connecting a BMS to cloud analytics can open a route for attackers into plant controls. Occupancy analytics can collect more personal data than the client realises.

Illustrative scenario: a consultant specifies an AI optimisation layer for an office BMS and sets the limits. A sensor fault leads the system to cut ventilation in occupied areas for several weeks. Staff complain of stuffiness and headaches. The client claims for investigation, recommissioning and lost productivity, alleging the limits and fallback modes in the consultant's control philosophy were inadequate.

Where the engineer's role ends

Disputes over AI-enabled buildings can turn on who was responsible for what after handover. The consultant may have written the control philosophy, the controls contractor installed and configured it, an analytics provider runs the AI layer and the facilities team acts on its alerts. If the appointment includes ongoing optimisation or monitoring, the consultant may be giving advice for years after practical completion. Set out in writing which limits you set, who can change them, who monitors performance and how long your involvement lasts. Where you advise on a system that learns and changes its own behaviour, say clearly that its later decisions depend on data and settings outside your control.

How PI usually responds

A claim that your design, specification or control philosophy was negligent usually falls under PI, subject to the policy terms. Some PI policies contain cyber or data exclusions, so losses caused by a cyber attack, or by a data breach on your own systems, usually belong with cyber insurance instead. The line depends on the wordings. Our guides to cyber insurance for engineers and the cyber exclusion in PI explain the split.

Practical controls

Set hard limits and safe fallback modes the AI cannot override, especially for ventilation and frost protection.
Define who monitors the system after handover and how alerts are acted on.
Apply DE6.1 principles to connections between the BMS and cloud services.
Map what personal data the system uses and who is the controller.
Record the control philosophy and every change to the AI limits.

How Apex helps

Apex arranges PI for building services engineers. A broker reviews your cover and how your policy treats AI-enabled BMS advice, alongside cyber cover for your own systems.

Sources

Frequently asked

Is BMS occupancy data personal data?

It can be. Occupancy, access control or presence data that identifies individuals is personal data, and CIBSE Code clause 3.6 asks engineers to respect privacy. The building owner is usually the controller, but your design choices shape what is collected.

Do the UK GDPR automated decision rules apply to smart buildings?

Articles 22A to 22D, in force since 5 February 2026, apply to solely automated decisions with significant effects on individuals. Most comfort controls are unlikely to qualify, but systems acting on identified people should be checked.

Does PI or cyber insurance cover a hacked BMS?

It depends on the cause and the wordings. Negligent design or advice usually falls under PI, while an attack on your own systems usually sits with cyber cover. Some PI policies contain cyber exclusions.

What guidance covers cyber security in building services?

CIBSE DE6.1 Cyber security in building services design (2019) and the Engineering Council security guidance. Principle 2 of the Statement of Ethical Principles also asks engineers to recognise cyber security.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.