Records tooling for the RICS professional standard Responsible use of AI in surveying practice, in force since 9 March 2026.
Since 9 March 2026, RICS members and regulated firms whose AI use has a material impact on the delivery of surveying services must be able to show: what AI they use, that a named qualified surveyor made a written decision about the reliability of AI outputs, that clients were told in the Terms of Engagement, and that AI procurement was diligenced. That is a records problem, and there is no tooling for it. This is the tooling.
▶ Try the sandbox: register an AI system, watch the validator refuse it, fix the gap, generate the evidence pack. Every button calls the real CLI against a real git repository.
▶ See a rendered evidence pack: a fictional firm's complete records, the tool's finished output.
The panel on the right is oversight check running for real. It names the obligation behind every failure, and the evidence pack refuses to render until they are cleared.
flowchart LR
A["AI system produces<br/>an output"] --> B["oversight rdr<br/>named surveyor decides<br/>sha256 binds the exact output"]
B --> C["oversight check<br/>validates every record<br/>failures cite the obligation"]
C -->|"exit 0"| D["oversight pack<br/>evidence pack, one HTML<br/>git log as the timeline"]
C -->|"exit 1"| B
E["oversight add-system<br/>register + due diligence"] --> C
F["oversight disclose<br/>ToE paragraphs"] --> C
style A fill:#eae9e9,stroke:#201e1d,color:#201e1d
style B fill:#eae9e9,stroke:#201e1d,color:#201e1d
style C fill:#201e1d,stroke:#201e1d,color:#f3f2f2
style D fill:#ec3013,stroke:#201e1d,color:#ffffff
style E fill:#eae9e9,stroke:#201e1d,color:#201e1d
style F fill:#eae9e9,stroke:#201e1d,color:#201e1d
The validator is the gate: the pack refuses to render while any obligation is unmet, so a pack's existence is itself evidence the records were coherent when generated.
No database, no SaaS, no vendor holding records a firm must retain for years. Git gives you append-only history, authorship, and timestamps for free, which is an audit trail. A regulator-ready evidence pack is then just a render of the repository, with the commit log as the evidence timeline.
your-compliance-repo/
├── config.yaml # firm name, staleness thresholds
├── systems/*.yaml # the AI system register
├── rdrs/<engagement>/*.md # reliability decision records (the crown jewel)
├── disclosures/*.md # ToE disclosure paragraphs, per engagement
├── dd/*.md # procurement due-diligence records
└── incidents/*.md # the lived incident log
| Record | Obligation it evidences |
|---|---|
System register (systems/) |
Governance · the firm knows and controls what AI it uses; each system has a named responsible surveyor and a lifecycle review date |
Reliability Decision Record (rdrs/) |
Documentation & accountability · a written decision on output reliability by, or under the supervision of, an appropriately qualified and named surveyor. Each RDR can bind to the SHA-256 of the exact output reviewed, so the record provably covers that output and no other |
ToE disclosure (disclosures/) |
Client transparency · material AI use disclosed in the Terms of Engagement, generated from the register so wording stays consistent |
Due diligence (dd/) |
Risk management · procurement diligence on external AI vendors: data flows, retention, model provenance, exit terms |
Incident log (incidents/) |
Risk management through the lifecycle · outputs rejected, errors caught, mitigations made. A lived incident log reads as real governance; an empty section reads as theatre |
pip install -r requirements.txt # pyyaml, jinja2 (nothing else)
python oversight.py init --firm "Your Firm LLP"
python oversight.py add-system # interactive, or fully flag-driven
python covenant.py 11391321 | python oversight.py rdr 2026-114 \
--system covenant-screening-engine --decision accepted-with-amendments \
--surveyor "A Surveyor MRICS (RICS 1234567)" --hash-stdin \
--checks "Verified against the register directly"
python oversight.py disclose 2026-114 # ToE paragraphs from the register
python oversight.py check # validate everything
python oversight.py pack # the evidence pack, one HTML fileValidates every record and exits non-zero on failure, so it runs in CI or as a pre-commit hook. Every failure cites the obligation it would breach:
FAIL systems/leasereader.yaml
external system with no procurement due-diligence record on file
↳ Risk management: procurement due diligence, data governance, and
review through the AI lifecycle
FAIL rdrs/2026-114/
engagement used AI but has no ToE disclosure on file: run 'oversight disclose'
↳ Client transparency: material AI use disclosed in the Terms of Engagement
It catches: unnamed responsible surveyors · external systems without due diligence · stale DD (>12 months) · overdue lifecycle reviews · unsigned or malformed RDRs · RDRs referencing unregistered systems · engagements that used AI with no client disclosure · template placeholders left in records.
One self-contained printable HTML file: the system register, every RDR with its output hash, the incident log, and the git commit history rendered as the evidence timeline. This is what a firm hands to a RICS regulation review, or its PI insurer.
The pack refuses to render while check fails (override with --force), so a pack's existence is itself evidence the records were coherent when generated.
python demo.py # -> http://localhost:8322A browser demonstration of the CLI, hosted at oversight-sandbox.onrender.com. Every action calls the real functions in oversight.py against a real git repository in a disposable directory, one per browser session: the validator output is the validator, and each action becomes a commit, so the evidence timeline builds as you work.
It exists because compliance records are confidential by nature. A firm's real records belong in the firm's own private repository, under its own retention control, which is why this tool is a CLI and not a hosted service. The sandbox lets the thing be understood without cloning anything, and wipes itself on reset.
python oversight.py --selftestBuilds a firm in a temp directory and asserts the validator catches each failure mode: missing due diligence, missing disclosure, unregistered systems, unsigned RDRs, overdue reviews; then renders and checks the pack. No configuration, no network.
A complete worked example (three systems, including one out-of-scope, recorded anyway; two RDRs, one rejecting an output over OCR errors, with the matching incident; due diligence; disclosure) lives in examples/example-surveyors-llp/, built entirely through the CLI.
The sandbox uses Cloudflare Web Analytics: cookieless, no personal data, no fingerprint, so no consent banner. Off unless CF_BEACON_TOKEN is set, which keeps clones, local runs and CI clean.
The evidence pack a firm generates with oversight pack is never touched. It is a confidential record and makes no outbound requests to anyone, including me: publish.py is the only place a beacon is added, and it exists solely to publish the public demonstration copy.
CF_BEACON_TOKEN=<token> python demo.py # sandbox
CF_BEACON_TOKEN=<token> python publish.py # public example pack for GitHub Pages- This makes compliance demonstrable, not automatic. The reliability judgments are the surveyor's; the standard requires exactly that, and this tool refuses to fake it: an RDR with template placeholders still inside is flagged, not accepted.
- Independent of and not endorsed by RICS. Obligation texts in the tool paraphrase the standard; the published standard is the authority. Firms should adapt record wording to their PI insurer's requirements.
- Signatures are attestations, not cryptography. A named surveyor in the record plus git authorship is the evidence model; firms wanting cryptographic signing can enable signed commits (the file format doesn't change).
covenant: tenant covenant screening from Companies House data. The example firm here registers covenant as one of its AI systems, with a real reliability decision record for a real screening: one tool doing surveying work with AI, one tool governing AI to surveying standards.
MIT.