How to Audit an AI Building Vendor: A CRE Buyer's Trust Checklist (2026)

Most "AI building" pitches fail the same way: a confident demo, a number with no method behind it, and a contract that quietly makes the vendor's mistakes your problem. Here is the checklist we use before we trust one.

We spend our days reading building-AI vendor decks the way a building inspector reads a wall: looking for what is behind it. The pattern is consistent enough to write down. A platform demos beautifully, quotes a savings figure that no one can reconstruct, and ships a contract where every promise lives in marketing and every liability lives in your operations.

This is the checklist we run before we tell anyone a vendor is worth a pilot. It is vendor-neutral on purpose. It does not name winners, because the right answer changes per building, per portfolio, and per regulator. What does not change is the set of questions a serious buyer asks — and the set of answers that should make you walk.

Question 1: Can they show you the method behind the number?

Every building-AI vendor leads with a savings claim. "20% energy reduction." "30% fewer truck rolls." The number is not the problem. The missing method is.

Ask one question: how was this measured, against what baseline, over what period? A credible vendor answers in the vocabulary of measurement and verification — a weather-normalized baseline, an adjustment for occupancy and operating hours, a stated measurement period. A vendor selling a screensaver answers with a logo wall and a louder version of the same number.

The international reference for this is the measurement-and-verification protocol that energy engineers already use to settle exactly this argument. You do not need to be an expert in it. You need the vendor to acknowledge it exists and to tell you which approach they used. "We compared this month to the same month last year" is not measurement. It is a coincidence with a marketing budget.

If a vendor cannot tell you how a savings number was produced, treat the number as zero until proven otherwise.

Question 2: Who is accountable when the AI is wrong?

Building AI does not just report. Increasingly it acts — it resets setpoints, it reschedules maintenance, it throttles equipment. The buyer question is no longer "is the dashboard pretty." It is: when an automated decision is wrong, who owns the consequence?

Read the contract, not the slide. Look for three things:

• A human-in-the-loop boundary. Which decisions does the system make autonomously, and which require sign-off? A vendor that claims full autonomy over life-safety or tenant-comfort systems with no override is selling you their risk as your feature.
• A liability position that matches the autonomy. If the platform acts on your equipment, the contract should say what happens when an action causes harm. Most do not. Silence here is an answer.
• A clear failure mode. What does the building do when the AI is offline, uncertain, or fed bad sensor data? "It keeps running on the last known good state" is a real answer. "It is always on" is not.

Question 3: Is your data leaving the building, and can you get it back?

Two questions hide inside every integration:

The first is exposure. Building data is increasingly personal data — badge swipes, occupancy heatmaps, camera-derived counts. Depending on where you operate, that pulls in privacy regimes with real teeth. Ask where the data is processed, what is retained, for how long, and under which jurisdiction's rules. A vendor that has thought about this hands you a data-processing answer without flinching. A vendor that has not will improvise, and improvisation is where compliance gaps live.

The second is lock-in. If you leave in three years, do you leave with your historical data in an open, documented format — or do you leave with nothing and start over? The single cheapest insurance against a bad vendor decision is an export clause you negotiated before you signed. Ask for it on day one, when you have leverage, not on day one-thousand, when you do not.

Question 4: Does it speak the building's existing language?

The most expensive sentence in any building-AI project is "we'll need to rip out and replace your controls first." Sometimes that is genuinely required. Usually it is a way to convert an integration problem into a capital project.

Ask whether the platform integrates with the systems you already run, through the open standards the industry already uses, rather than demanding a forklift upgrade as a precondition. A vendor fluent in the existing protocols of building automation is telling you they have done this in real buildings. A vendor whose answer is always "replace it" is telling you they have mostly done this in slide decks.

Question 5: Can it survive contact with a real operator?

Pilots succeed in conference rooms and die in mechanical rooms. The question that predicts which way yours goes is simple: will the people who actually run the building use this on a Tuesday?

• Does the alerting separate signal from noise, or will it train your operators to ignore it within a month?
• Does it explain why it flagged something, or just that it did?
• Is there a path from "the AI noticed this" to "a human fixed it" that does not require a data scientist in the loop?

A platform that an overworked facilities team will actually open is worth more than a more sophisticated one they quietly stop logging into. Adoption is the metric that compounds; the rest are vanity until people log in.

The short version: a buyer's trust checklist

Print this. Bring it to the demo. A vendor worth piloting clears all six without getting defensive.

1. Method, not just number — they can reconstruct any savings claim against a stated baseline and period.
2. Accountability matches autonomy — the contract says who owns the consequence when an automated decision is wrong.
3. Defined failure mode — you know exactly what the building does when the AI is offline or uncertain.
4. Data exposure understood — they answer where data is processed, what is retained, and under whose rules, without improvising.
5. Exit on your terms — your historical data leaves in an open format, via a clause you secured before signing.
6. Operator-real — the people who run the building will actually use it, because the alerts are trustworthy and the actions are explainable.

Why we publish this instead of a ranking

We get asked for a leaderboard constantly. We do not publish one, because a ranking answers the wrong question. The vendor that is right for a single owner-occupied office is wrong for a 40-asset REIT, and both are wrong for a hyperscale data center. A checklist travels across all three. A ranking is obsolete the week after you print it.

The honest position is this: the building-AI market in 2026 is full of capable platforms and confident demos, and the gap between them is exactly the six questions above. If a vendor clears them, the savings claim is probably real and the risk is probably manageable. If they dodge them, the polish is the product, and the building is the beta test.

Run the checklist. Trust the answers, not the demo.

Research compiled by the AISB agent fleet from primary sources; every claim verified against the public record. Cost figures are labeled industry estimates. Full source list available on request — hello@ai-smart-buildings.com.