> ## Documentation Index > Fetch the complete documentation index at: https://help.guardbook.ai/llms.txt > Use this file to discover all available pages before exploring further. # The clauses, in plain English > What each clause of the RICS AI standard requires, and where the corresponding record lives in guardbook. A working summary of each clause and the artefact it expects. Read it alongside the standard itself rather than instead of it. ## 1.2 Scope and materiality A conduct standard, applying to AI outputs with a **material impact** on service delivery. Where a firm determines its use will be material, it must record that determination and the reasoning. **In guardbook:** the [Material Impact](https://help.guardbook.ai/materiality/overview.md) page, reached from the Dashboard, with the [AI Use Case Register](https://help.guardbook.ai/materiality/use-case-register.md) underneath it. ## Section 2 Baseline knowledge Members using AI must maintain, as a minimum, a basic understanding of: the types and subsets of AI system and how they work, including limitations and failure modes; the risk of erroneous output; the inherent risk of bias; and data usage and data risks. This is individual competence. It is not discharged by the firm running a training session. **In guardbook:** the Training page records each person's baseline knowledge. ## 3.1 Data governance Firms must safeguard private and confidential data, including by all five of: storing it securely; restricting access to those who strictly need it; training those staff at least annually on the privacy and confidentiality risks AI poses; preparing data in a way that protects privacy, such as anonymising it; and refraining from uploading it to AI systems except where there is express written advance consent from affected stakeholders **and** the firm has satisfied itself the risk is acceptable. **In guardbook:** Data safeguards, a yearly signed check, plus People for who has access and Training for the yearly privacy training. ## 3.2 System governance Firms must develop and implement AI policies, informed by the risk register, covering in-house systems as well as third-party ones. As a minimum the policy must: set out roles, responsibilities and liabilities of everyone involved in procuring or using AI; set out at least annual training expectations; state how human control and judgement interacts with AI use, such as monitoring or dip-sampling; and give guidance on identifying and mitigating risks. **In guardbook:** the AI Policy module, and the System Appropriateness Assessment per tool. ## 3.3 Risk management Firms using AI with a material impact must create and operate a risk register documenting, as overarching risks: inherent bias; erroneous outputs; limits on information about the system and its training data; and retention or use of data the firm inputs. Each risk needs six things: a description; likelihood and likely impact; the mitigation and management plan; the firm's risk appetite; regular updates to status and progress; and a RAG categorisation or similar. Reviewed **and updated** at least quarterly by the staff responsible for AI decisions. **In guardbook:** the [Risk Register](https://help.guardbook.ai/risk-register/overview.md). ## 4.1 Procurement and due diligence Before procuring a third-party AI system with a material impact, firms must carry out detailed due diligence: request information from the supplier in writing; follow up in writing as needed; record and assess what was provided; and keep a record of practical testing for fitness for purpose. Six written questions as a minimum: environmental impact; stakeholders involved in development; compliance with data and confidentiality laws; permissions obtained where data relating to individuals was used; accuracy, relevance and diversity of training data including known gaps and bias risks; and the type and extent of the provider's liability. Where the supplier provides no or only limited information, the firm must identify the resulting risks and record them in the risk register. **In guardbook:** [supplier due diligence](https://help.guardbook.ai/tools-register/supplier-due-diligence.md), which creates those risks for you on signing. ## 4.2 Outputs, reliance and assurance Members and firms must apply professional judgement to decide the reliability of any output with a material impact, and must document that decision in writing detailing five things: relevant assumptions; key areas of concern about reliability including underlying datasets; the reason for each concern; whether anything could lessen each concern; and the impact on overall reliability, including a stated conclusion on whether the output can reasonably be used. The decision must be prepared by, or under the supervision of, an appropriately qualified and named surveyor who accepts responsibility. Where the conclusion is that an output cannot reasonably be used, that must be communicated to the client in writing with the reasoning or a summary. For automated or high-volume output, per-output decisions are generally neither necessary nor proportionate. Randomised dip samples at regular intervals are required instead. **In guardbook:** the [Oversight Log](https://help.guardbook.ai/oversight-log/overview.md) for written reliability decisions, including recording that you told the client about a rejected output. Dip Sampling for automated or high-volume tools. ## 4.3 Terms of engagement and client communication Firms using AI with a material impact must make clear to clients, in writing and in advance, when and for what purpose AI is to be used. Governing documents must detail six things: when AI will be involved; the parts of the process it will be involved in; if available, the extent of professional indemnity cover for the firm's AI use; the internal process to contest AI use; the process to seek redress; and how a client can opt out, if at all. > [!NOTE] > > Item three is the only place the standard touches PI insurance, and it does not require a firm to hold AI cover. It requires disclosure of whatever cover exists. **In guardbook:** [client transparency](https://help.guardbook.ai/client-transparency/overview.md). ## 4.4 Explainability On request, firms must be able to provide written information about: the type of AI system used; its basic ways of working and limitations; the due diligence carried out before use; how relevant risks are identified and managed; and the decisions made about the reliability of its output. This is the clause that turns every other record into something you have to be able to produce. See [what assessors look for](https://help.guardbook.ai/rics-standard/what-assessors-look-for.md). **In guardbook:** Client Explanations, opened from Client Disclosures. It builds the written explanation for each AI tool from your records, and logs when you gave it to a client. ## Section 5 Development Firms developing AI in house must apply the provisions of the standard, as required, to the development process. **In guardbook:** turn on in-house development on the Organisation page and your AI policy covers it. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.