Aipedia: Energy assessors and retrofit coordinators

AI, home photos and occupant data in energy assessment

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Energy assessors and retrofit professionals who put home photos and occupant details into AI tools must comply with UK GDPR and scheme data rules. A leak from an AI or cloud provider can trigger complaints, notification duties and claims across both PI and cyber policies.

Part of: AI in energy assessors and retrofit coordinators

In short

Site visits capture photos, floor plans, occupancy and sometimes health or vulnerability data. Processing these through AI apps and cloud tools engages UK GDPR, while EPC data go on a public register under reg 27 and scheme systems and the TrustMark Data Warehouse have their own rules. Solely automated significant decisions, such as grant eligibility, attract safeguards under Articles 22A to 22D from 5 February 2026. If data leaks, cyber cover commonly handles incident costs while PI usually responds to negligence claims, subject to the wordings.

What data AI tools handle in energy assessment

An EPC or retrofit visit captures a lot about people's homes and lives. AI apps and cloud tools now process much of it. The data typically includes:

Photos of rooms, belongings, documents on display and sometimes occupants.
Floor plans and scans that show the layout of a home.
Occupancy details, such as how many people live there and how rooms are used.
Vulnerability information, such as health conditions or benefits, collected for retrofit or grant purposes.
Contact details and correspondence with homeowners, tenants and landlords.

Once uploaded to an AI tool, this data may be stored, processed or used by the provider in ways the assessor has not checked.

The rules that apply

Several layers of data rules apply to the same visit. The main ones are:

UK GDPR: photographs, floor plans and occupant information gathered on site, and any AI tools used to process them, engage UK GDPR. Health information is special category data.
The public register: EPC data are lodged on a public register under reg 27 of the EPB Regulations 2012, so what goes into the certificate becomes publicly available.
Scheme and TrustMark data rules: scheme lodgement systems and the TrustMark Data Warehouse have their own data rules; the TrustMark scheme requirements also require records kept as PAS 2035 specifies.
Automated decisions: where tools make significant decisions about individuals solely by automated means, such as grant eligibility, Articles 22A to 22D of UK GDPR apply, inserted by section 80 of the Data (Use and Access) Act 2025 from 5 February 2026.

What can go wrong

Data problems with AI tend to come from convenience. Typical issues are:

Photos uploaded to a general AI assistant on a personal account, outside any agreement with the provider.
Vulnerability or health data processed without a clear lawful basis.
Images with personal details lodged as evidence or shared more widely than needed.
Data kept indefinitely in an app because nobody set a retention period.
A breach at an AI or cloud provider exposing images and occupant details.

Illustrative: a retrofit assessor uploads site photos and occupancy notes, including a tenant's health condition, to a free AI app to draft reports. The app's provider suffers a breach and the data is exposed. The tenant complains to the landlord and the assessor's firm, and the firm must deal with breach notification, the tenant's complaint and possible regulatory interest.

The PI and cyber split

When data leaks, the costs and claims can fall under different policies. A cyber policy commonly covers incident response, notification, forensic and restoration costs, and may include liability to affected individuals, subject to its terms. PI usually covers claims arising from professional services, and some PI wordings include limited data protection cover, while others exclude cyber events. Fines are often uninsurable. Our guides on GDPR and data breach cover within PI, data breach liability for professional firms and cyber insurance explain the differences. Recording which tools process client data also helps at renewal; see what to document about AI use.

Practical controls

Treat site data as sensitive by default. Practical steps:

Use AI tools under a business agreement that sets out how the provider stores and uses data.
Avoid capturing people and unnecessary personal items in photos.
Collect vulnerability data only when needed and record the lawful basis.
Set retention periods for photos, scans and notes in every app you use.
Check what will appear on the public register before lodging.
Offer human review where automated tools influence grant decisions; see AI grant eligibility checks.

Photo handling is also covered in AI photo evidence and site data capture.

How Apex helps

Apex arranges PI and cyber cover for energy assessors and retrofit firms. A broker reviews where data incidents fall between the two and how AI tools affect the picture. See the AI in energy assessment hub.

Sources

Frequently asked

Can I upload site photos to an AI app?

Only with care. Photos of homes and occupants are personal data under UK GDPR. Use tools under a business agreement that sets out storage and use, avoid unnecessary personal details and set retention periods.

Is EPC data public?

Yes. EPC data are lodged on a public register under reg 27 of the 2012 Regulations. Check what will appear before lodging, and keep personal information that is not needed out of lodged material.

Does PI or cyber cover a data breach from an AI tool?

It depends on the wordings. Cyber policies commonly cover incident response and notification costs, while PI usually covers professional negligence claims and may include limited data protection cover. Fines are often uninsurable.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.