Skip to main content
There is no sharing feature in guardbook. You generate the evidence pack as a PDF and send it the way your firm sends anything else confidential. That is a deliberate limit rather than an oversight. A compliance file going to an insurer or a regulator should travel by a route your firm already controls and can account for.

​
What to send

1

The evidence pack PDF

Generated on the day you send it, so the snapshot matches what you are claiming.
2

Any clause 4.2 client communications

Where you concluded an output could not reasonably be used and wrote to the client, include those letters. The pack records each decision and whether the client was told, but not the letter itself. See rejected outputs.
3

Records from before you used guardbook

For example, risk register reviews or training done before you started. Anything recorded in guardbook is already in the pack.

​
Already in the pack

You do not need to send these separately, but check them before you export.
1

Your client disclosure statement

It is in the pack, in full, under Client Terms of Engagement (clause 4.3). Make sure the current version is adopted first. An unadopted version is marked in red.
2

Training records

In the pack, under Training. It covers three separate duties: section 2 baseline knowledge for members using AI, clause 3.1 training at least annually for staff with access to private and confidential data, and the clause 3.2 training expectations for everyone involved in AI use. Send any certificates the records refer to if you are asked.
3

Your risk register reviews

Clause 3.3 requires the register to be reviewed and updated at least quarterly. Record each review in guardbook and it appears in the pack under Quarterly Risk Register Reviews. See quarterly review.

​
Sending it safely

The pack contains your firm’s governance records and the names of your people. Treat it as confidential. Use whatever secure route your firm already uses for client documents. Avoid attaching it to an unencrypted email to an address you have not verified, and do not put it on a public link.

​
What to expect to be asked

RICS has not published an assessment checklist for this standard. What follows is judgement, not a published requirement.
Three questions come up more than any others, and none of them are answered by the pack alone: “When did you last review this?” Timestamps in the pack will answer it whether you want them to or not. “Who is accountable?” Have an answer that is a person, not a committee. Clause 3.2 expects roles, responsibilities and liabilities to be clear. “Show me a case where AI got it wrong.” A firm that can point to a rejected output, the reasoning, and the letter to the client is demonstrating the standard working. A firm whose every output was reliable is inviting scrutiny of whether anyone was really looking.

​
A note on timing

The standard takes effect on 09/03/2026. Records made before then are still worth keeping. A firm that can show its governance developing over months is in a stronger position than one whose records appear in a single week.