Digital Tools and AI: Ethics Rules for Engineers

01What Guideline 007 covers

Guideline 007 is made under paragraph 4(1)(f) of the Registration of Engineers Act 1967. It applies to ECPs and registered persons (section 1).

Section 2 defines:

• Digital technologies – electronic tools, systems, devices and resources that generate, store or process data.
• Digitalisation – use of digital technologies and data, and interconnection that results in new or changed activities.

The guideline sits on top of the profession’s duty to act in the public interest, not only for an individual client, and on Part IV of the Registration of Engineers Regulations 1990 (Code of Conduct) (section 3).

The typical approach BEM describes is to (section 3):

1. identify threats to compliance with fundamental principles;
2. evaluate those threats;
3. address them by eliminating or reducing them to an acceptable level; and
4. create a company SOP or guideline to systematically eliminate the threats.

02Technologies BEM lists

Section 3 lists common digitalisation technologies used by ECPs and registered persons:

• cloud computing;
• communication technologies;
• relevant application / software;
• data analytics, including business intelligence;
• social networking / online communities;
• multimedia and video;
• blogs and websites;
• artificial intelligence;
• any other related digitalisation / apps.

BIM platforms and e-submission or e-signature tools are not named as separate line items. They fall under the listed classes (software applications, cloud computing, communication technologies, and related apps) where they are used in practice.

Guideline 007 does not use the words “BIM” or “e-signature” / “e-submission”. Any BIM- or e-signature-specific do/don’t in this article is therefore an application of the general principles, not a quoted BEM rule about those tools by name.

03Potential risks

Section 4 sets out four risk areas.

4.1 Misuse of information

ECPs and registered persons hold staff personal information and client information such as bank-account details. Technology makes access easier, so there is a risk of unauthorised access and inappropriate use (para 4.1).

4.2 Misinformation and deep fakes

Information can be created without validation. Engineers face a filtering challenge. The guideline’s example is using misinformation from social media in consulting work for a client (para 4.2).

4.3 Cybersecurity failure

Guideline 007 cites cybersecurity failure as one of the top ten global risks in the next two to five years according to the Global Risks Report 2022 (para 4.3). Exposure covers the practice’s own systems and client information held by the practice. Consequences described include reputational damage, legal or regulatory action, and client claims after data loss. The guideline notes that reputational damage may be more severe than the data loss itself.

4.4 Lack of competencies in digitalisation technologies

When using technology in practice or services, ECPs and registered persons may need to improve competence in the technologies used and how those technologies affect their work. Lack of competence may create biases or over-reliance on outputs (para 4.4).

04Ethical principles in practice

Section 5 sets four principles.

5.1 Ethical leadership

As ECPs and registered persons use, develop, implement or rely on technologies, they should demonstrate commitment to ethical behaviour, because that sets the tone for the practice. The guideline expects commitment through actions and behaviours, through strategic decisions, through appropriate organisational structure and role assignment, and through planning and allocating resources consistently with that ethical commitment (para 5.1).

5.2 Reliance on the output of digitalisation technologies

When relying on technology outputs, determine whether that reliance is reasonable. Factors listed in para 5.2 include:

• the nature of the activity performed by the technology;
• the expected use of, or extent of reliance on, the output;
• ability to understand the output in context;
• whether the technology is established and effective for the intended purpose;
• whether new technology has been appropriately evaluated for the intended purpose;
• appropriateness of inputs, including data and related decisions.

This is the core rule for AI drafts, model outputs, automated quantities, or software analysis results: the registered person remains responsible for judging whether reliance is reasonable.

5.3 Relevant competencies

ECPs and registered persons must maintain relevant competence, including continuing awareness and understanding of technology-related developments (para 5.3).

5.4 Confidentiality of information

They must maintain confidentiality of information acquired in the practice or from clients, and take appropriate action to secure information in collection, use, transfer, storage, dissemination and lawful destruction (para 5.4).

05Digital tools and AI under this guideline

Applying only the text of Guideline 007:

Circular No. 001 still requires a PEPC to approve and sign only engineering documents prepared by him or under his direction and control (Circular 001 para 1.1.5). Guideline 007 does not replace that duty.

06A practical SOP outline for ECPs

Guideline 007 expects an internal SOP. A proportionate outline consistent with sections 3–5 is:

1. Inventory – list digital tools in use (cloud, software, AI, websites, messaging).
2. Threat assessment – map each tool to misuse, misinformation, cybersecurity and competence risks (section 4).
3. Access and confidentiality rules – who may access client data; retention and destruction (para 5.4).
4. Reliance checks – when software or AI output may be used in deliverables, and who signs off (para 5.2).
5. Competence and CPD – training for tools that affect design or advice (para 5.3).
6. Incident response – what to do if data is leaked or systems are compromised (para 4.3).
7. Leadership review – assign roles and budget for the above (para 5.1).

07Common mistakes we see

1. Using public AI chat tools with client drawings or personal data without a confidentiality control (paras 4.1 and 5.4).
2. Issuing reports that lean on software output without checking inputs or understanding limits (para 5.2).
3. No firm SOP, so each engineer improvises tool use (section 3).
4. Assuming cybersecurity is only an IT problem. Guideline 007 treats reputation and client claims as practice risks (para 4.3).
5. Skipping competence updates when a new platform is adopted mid-project (paras 4.4 and 5.3).

Frequently asked questions