FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Building services engineers
Building services engineers should not put client drawings, BMS data or occupant data into AI tools without checking confidentiality, security and data protection first. Building data can be commercially sensitive, security sensitive and personal, sometimes all at once.
Part of: AI in building services engineering
In short
MEP engineers handle drawings, models, BMS exports, meter data, access control and occupancy data. Putting these into AI tools can disclose confidential information, expose security-sensitive details and process personal data. CIBSE Code clause 3.6 requires respect for privacy and no disclosure of confidential information without legitimate cause or authority. The Statement of Ethical Principles (Principles 1 and 2), Engineering Council security guidance and CIBSE DE6.1 also apply, and UK GDPR Articles 22A to 22D cover solely automated significant decisions. Data incidents usually fall to cyber insurance rather than PI, depending on the wordings.
Engineers paste specification text into chatbots, upload drawings and models for AI analysis, feed BMS and meter exports into analytics tools and use AI to summarise client reports. Smart building projects can involve occupancy counts, access control logs, desk sensor data or Wi-Fi presence, which may identify individuals.
Some of this information is security sensitive: plant room locations, access routes, security system layouts and fire strategies for occupied buildings, including higher-risk residential buildings.
On higher-risk buildings, regulation 31 of SI 2023/909 also requires golden thread information to be secure from unauthorised access.
A short written policy helps more than a long one nobody reads. It should say which AI tools are approved, what categories of information may go into each, who can approve exceptions and how staff should anonymise or strip out sensitive details before using a tool. It should cover drawings and models, client reports, BMS and meter data, and any personal data. IStructE guidance suggests sharing AI policies with MEP engineers and other stakeholders, so expect clients and design team partners to ask for yours. Review it when tools or their terms change, and record training so you can show staff understood it. A policy also helps answer insurer questions about AI and data handling at renewal.
Illustrative scenario: an engineer uploads a full drawing set and BMS points list for a client's headquarters into a public AI tool to speed up a controls review. The client's security team later finds the information was processed outside the agreed environment, in breach of the appointment's confidentiality terms. The client suspends the engineer, commissions a security review and claims its costs.
Claims alleging breach of professional confidentiality in the course of your services may fall under PI, depending on the wording, but some PI policies exclude data breach and cyber losses, which usually sit with cyber insurance. Regulatory fines raise separate insurability questions. Read cyber insurance and AI risks, cyber insurance for engineers and cyber exclusions in PI policies for how the policies fit together.
Related: AI in BMS, MEP PI and AI errors and AI and the golden thread. Back to AI in building services engineering.
Apex arranges PI for building services engineers. A broker reviews how your policies treat confidentiality and data incidents involving AI tools.
Only if your contract allows it and you have checked how the tool handles data. CIBSE Code clause 3.6 prohibits disclosing confidential information without legitimate cause or authority.
It can be, where it identifies individuals, such as access control logs or desk sensor data linked to people. The building owner is often the controller, but engineers shape what is collected.
CIBSE DE6.1 Cyber security in building services design (2019) and the Engineering Council security guidance. Principle 2 of the Statement of Ethical Principles also covers cyber security and data protection.
Possibly not, because some PI policies exclude cyber and data breach losses, which usually sit with cyber insurance. Breach of professional confidentiality may be covered under PI depending on the wording.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
