When AI Starts Acting for Surveyors, Who Is Really in Control?

AI agents, professional knowledge and data security: what surveyors need to know.

Imagine an AI system that can access your professional reporting library, retrieve inspection records, analyse photographs and prepare a building survey report.

Now imagine that the same system can also amend technical commentary, change condition ratings, delete records or issue reports on your behalf.

At what point does AI stop assisting the surveyor and start making decisions that should remain with the professional?

This question is becoming increasingly relevant as artificial intelligence moves beyond generating information towards performing actions through AI agents.

An AI agent may have legitimate access to a system yet still perform an action that nobody intended or authorised.

For surveyors, this raises three important questions:

1. Who owns the professional knowledge supplied to AI?
2. Who controls the information it can access
3. Who authorises the actions it performs?

From AI assistants to AI agents

Traditional AI-assisted reporting primarily involves processing inspection observations and preparing draft commentary for the surveyor to review.

AI agents go further. Depending on their configuration, they can retrieve information, interact with software, update records and carry out sequences of tasks.

For example, an AI agent preparing a Home Survey Level 3 might retrieve technical commentary, analyse inspection notes and populate relevant report sections.

However, should it also be permitted to overwrite existing commentary, change condition ratings or remove information it considers unnecessary?

The distinction is fundamental: permission to access information does not automatically mean authority to change it.

In cybersecurity, the principle of “least privilege” requires systems to have only the permissions necessary for their intended tasks.

An AI agent retrieving technical knowledge may require read-only access, but this should not automatically give it permission to amend or delete records, change condition ratings or issue a professional report.

Another concern is “prompt injection”, where misleading instructions embedded within documents or retrieved information attempt to influence an AI agent’s behaviour, potentially causing it to perform actions beyond those originally intended.

This highlights the importance of clearly defined permissions, appropriate safeguards and human oversight. Systems should distinguish between accessing information and making changes, maintain audit trails and require professional approval for significant actions.

These safeguards should be built into the software itself, ensuring that AI cannot make unauthorised changes, regardless of the instructions it receives.

Who owns the knowledge when AI writes the report?

A surveyor may have spent decades developing technical expertise, refining reporting language and building a valuable library of professional commentary.

When this knowledge is uploaded into AI-enabled software, important questions arise.

Does the provider acquire rights to use it? Can other users access it? Is it incorporated into AI training? Can the surveyor retrieve, amend or remove it?

These questions become particularly important when professional knowledge is combined with confidential client details, property addresses, photographs and inspection records.

Importantly, using AI does not necessarily mean training AI.

Information submitted to an AI model may simply be processed to generate a response without being incorporated into the model’s training data.

Another approach is “retrieval-augmented generation” (RAG), which allows professional knowledge to be stored separately and retrieved when required.

For example, a surveyor’s preferred commentary on condensation, structural movement or defective roof coverings can be retrieved to help prepare reports without retraining the underlying AI model.

However, RAG does not automatically guarantee ownership or confidentiality. Contractual protections, appropriate security, access controls and clear data management arrangements remain essential.

The question is not simply whether AI can use your knowledge, but whether you retain control over how it is stored, accessed and applied.

Data retention: what happens to your information?

Just because an AI provider confirms that your information will not be used to train its models does not necessarily mean that the information will not be stored elsewhere.

For example, when a surveyor uses AI-powered reporting software, their information may be stored within the application, passed to an external AI provider for processing or retained in system logs and backups. Each of these may have different rules about how long information is kept and when it is deleted.

OpenAI, for instance, states that information submitted through its API is not used to train its models by default. However, under its standard arrangements, certain information may still be retained for up to 30 days for security and misuse monitoring, subject to exceptions. Some services may also have different retention arrangements.
Surveyors should therefore know where their information goes, who has access to it, how long it is kept and what happens when they decide to delete it.

What does UK GDPR require?

The Information Commissioner’s Office (ICO) confirms that existing data protection obligations apply when AI systems process personal information.

These include lawful processing, transparency, data minimisation, security, accountability and appropriate retention arrangements.

UK GDPR does not set a fixed period for how long personal information can be kept. Instead, information should only be retained for as long as it is reasonably needed, taking account of any legal and professional obligations.
For surveyors, this is particularly important. Inspection records, photographs and correspondence may need to be kept for several years, particularly if a complaint arises, a professional indemnity insurance claim is made or allegations of professional negligence need to be addressed.

However, just because a surveying practice has good reasons to retain its records does not mean that external AI providers should be allowed to keep the same information indefinitely.

Understanding what happens to your information when you click ‘Delete’ is just as important as knowing what happens when you click ‘Upload’.

Professional judgement must remain with the surveyor

A building survey report is not simply a collection of technically accurate paragraphs. It represents a professional assessment based on inspection evidence, limitations, experience and judgement.

An AI system may retrieve information about stepped cracking, differential movement or foundation defects, but that does not establish whether structural movement is occurring at a particular property.

Likewise, AI should not independently change material condition ratings or approve recommendations without appropriate professional review.

AI can assist with recording observations, retrieving knowledge and preparing commentary. However, the surveyor remains responsible for verifying the evidence, interpreting defects and approving the final report.

AI-generated information, AI recommendations and AI-authorised actions are not the same thing.

Seven questions every surveyor should ask

Before using AI-enabled reporting software, consider:
1. AI training: Is my information being used to train AI models, including those belonging to third-party providers?
2. Data security: Where is my information actually stored, and who has access to it?
3. Data retention: How long is my information kept, including any copies held by external AI providers or in backups?
4. Ownership: Do I remain in control of my professional knowledge, and can I access, update, download or remove it whenever needed?
5. Deleting information: If I delete a report or close my account, what happens to my information? Is it permanently deleted or could copies remain elsewhere?
6. AI permissions: What exactly can AI agents do with my information? Can they simply read and prepare reports, or can they also change or delete existing records?
7. Professional control: Do I have the final say over important changes and decisions, and is there a record of any actions carried out by AI?

Responsible software providers should be able to explain these matters clearly.

MyReport® and Report Genius®: keeping surveyors in control

These considerations have been central to the development of MyReport®, a UK-based cloud reporting platform designed specifically for professional surveyors, with an emphasis on data security, confidentiality and control over professional knowledge.

MyReport® brings together inspection records, photographs, voice recordings and personalised reporting knowledge within a structured reporting environment.

Its AI-assisted reporting feature, Report Genius®, uses knowledge retrieval to prepare draft commentary based on inspection observations and the surveyor’s personalised reporting library.

Professional knowledge is maintained separately from the underlying AI model, and customer information is not used to train public AI models.

AI assistance is also optional, allowing surveyors to continue using MyReport® without AI-generated commentary.

The objective is to support professional reporting, not transfer responsibility for professional decision-making.

Technology should support the surveyor’s expertise, not assume the surveyor’s authority.

Final thoughts

AI offers considerable opportunities to make professional reporting more efficient. However, as AI agents become capable of taking actions rather than simply generating information, data security, ownership and professional control become even more important.

Surveyors spend years developing their expertise, and clients trust them with confidential information. Both deserve proper protection.

The future of AI-assisted surveying should not simply be about writing reports faster, but ensuring that professional knowledge is protected and that final decisions remain firmly with the surveyor.