Aipedia: Quantity surveyors

AI tools and tender price confidentiality for quantity surveyors

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

A quantity surveyor in an RICS-regulated setting must not upload confidential tender prices, contractor rates or client budgets to an AI tool without express prior written consent. A leak of commercially sensitive pricing can breach tender terms and appointments, and PI and cyber cover respond to different parts of the loss.

Part of: AI in quantity surveying

In short

QSs handle some of the most commercially sensitive data in construction: tender returns, contractor rates, client budgets and claims material. Uploading it to an AI tool to analyse tenders or benchmark rates is tempting. RICS AI standard 3.1 forbids uploading private and confidential data to AI systems without express prior written consent and requires at least annual staff training. Tender documents and appointments often add their own confidentiality terms. If pricing leaks, claims may fall partly under PI and partly under cyber cover, because the RICS minimum wording excludes cyber acts and data protection breaches.

Where AI meets tender data

Tender analysis is an obvious use for AI. A QS can upload several tender returns and ask a tool to normalise them, flag anomalies, compare rates with a cost database and draft a tender report. Contractor-side QSs may upload subcontract quotations and the client's budget to prepare a bid. Claims and benchmarking work involves similar data.

The question is where that data goes. Some AI tools retain uploaded content, use it to improve their models or process it outside the firm's control. Rates and budgets that leak can affect a live competition, damage a contractor's competitive position or reveal a client's affordability limit.

The duties that apply

The relevant duties are:

RICS AI standard 3.1: no uploading of private and confidential data to AI systems without express prior written consent; at least annual staff training.
4.1: written due diligence questions to the supplier about data retention, training use and security, with recorded answers.
3.2 and 3.3: a procurement policy and AI register, and a risk register reviewed at least quarterly that should include data leakage.
Tender and appointment terms: invitations to tender and QS appointments often contain confidentiality obligations that apply whatever the RICS position.
Data protection: where tender data includes personal data, such as sole trader subcontractors, UK GDPR applies. The Data (Use and Access) Act 2025 added safeguards on solely automated significant decisions about individuals, in force from 5 February 2026.

Whose consent?

Standard 3.1 requires express prior written consent. In tender work, the data may belong to more than one party: the client owns its budget, but each contractor's rates are its own confidential information, often submitted under tender conditions. Consent from the client may not cover a contractor's pricing. The safest approach is to agree in the appointment which AI tools may be used and for what, and to check the tender conditions before uploading any return.

What can go wrong

Illustrative: a QS uploads all tender returns for a competitive project into a general generative AI chatbot to produce a comparison. The tool's terms allow it to retain inputs. Later a tenderer complains that its pricing has been exposed, and the client's procurement is challenged. The client and the tenderer both look to the QS for their losses.

Other routes include staff using personal AI accounts, sharing prompts that contain rates, or AI tools connected to email or document systems with wider access than intended. Leaks are not always discovered quickly. A tenderer may only suspect its rates were exposed when a competitor's later bid looks unusually informed, which makes records of what was uploaded, by whom and under what consent important.

PI or cyber?

The RICS Approved Minimum Wording includes the IUA 04-017 endorsement, which excludes losses arising from cyber acts and system failure (clause 3) and from the insured's breach of data protection law (clause 5). A claim for breach of confidence, for example by a client whose budget was disclosed, may still fall under PI, subject to the terms, while regulatory and notification costs from a data breach usually need cyber cover. Most leaks produce a mix of both. See cyber insurance for surveyors and does QS PI cover AI cost errors?

Practical controls

Useful controls include:

Approve specific AI tools for tender data, with contractual commitments on retention and training.
Block personal AI accounts for client work.
Obtain written consent and check tender conditions before upload.
Anonymise tenderers where the analysis allows.
Train staff at least annually, as 3.1 requires.

How Apex helps

Apex arranges PI for quantity surveyors, and a broker can review how your PI wording treats a data leak. Related: the RICS AI standard for QS work, AI contract amendment review and the QS AI hub.

Sources

Frequently asked

Can I upload tender returns to an AI tool if my client agrees?

The client's written consent is needed under standard 3.1, but contractors' rates are also their confidential information and tender conditions may restrict use. Check the tender terms and agree approved tools in the appointment before uploading.

Is an enterprise AI tool safer than a public chatbot?

Often, because enterprise terms can restrict retention and training use. It does not remove the consent requirement in standard 3.1. Record your due diligence questions and the supplier's answers under standard 4.1.

Will PI cover a claim if tender prices leak through an AI tool?

Partly, possibly. A breach of confidence claim may fall under PI, subject to the terms, but the RICS minimum wording excludes cyber acts and the insured's data protection breaches, so cyber cover is usually needed for the rest.

What should we do if confidential pricing has already been uploaded?

Find out what the tool's terms say about retention and deletion, ask the supplier to delete the data, and record what happened on the AI risk register. Tell your broker promptly, as late notification can affect both PI and cyber cover, and take advice on whether the client or tenderers must be told.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.