Before your team puts property data into AI: what to ask

A repair report may contain a resident's name, phone number and a photograph inside a home. Add a contractor's quotation and there is commercial information too. AI could help the team understand the job, but before uploading those records, it is worth knowing what happens to the information.

You do not need to become an engineer to ask useful questions. A few plain-English distinctions can help a managing agent or facilities manager understand the service being offered.

1. Answering a question and moving a job forward are different capabilities

A large language model, or LLM, is the language engine behind many AI tools. It can work with the information supplied to it to summarise a report, explain a manual or draft a reply. A fluent answer still needs checking against the actual record.

An AI agent combines that capability with access to tools and a task to carry out. It might look up the leaking-ceiling work order, check the contractor's update and prepare the next action. The Cyber Security Agency of Singapore describes agentic AI as able to plan, act and use external tools with less continuous prompting.

For a buyer, the useful question is: which steps can it take, and which need approval? Drafting a contractor instruction, sending it and approving extra expenditure are three separate permissions. Ask to see those boundaries during a demonstration.

2. Tokens measure AI usage; completed work measures usefulness

You may hear suppliers talk about tokens. These are small units of text processed by a model, sometimes a word or part of one. Input and generated output both matter. OpenAI's token explanation also shows why a short visible answer can involve more processing than it appears to.

A token allowance cannot tell you how many maintenance jobs will be completed. Reviewing a long contract takes different work from drafting a short acknowledgement. Compare products using the same representative task: was the right record found, was the answer accurate, and how much checking did your team need? Ask what happens at the usage limit, including slowdowns or extra charges. Wisbid's Terms of Service, section 6, describe its fair-use arrangements.

3. Open and closed models describe access to the model

Some models can be downloaded and run by other organisations; these are commonly called open-weight models. Others are available through a service controlled by the model provider. The NTIA's explanation of model access describes this distinction and the different degrees of openness.

Neither label tells you where your property's data goes. An open model may run on a supplier's cloud rather than your own computers. A closed model's data handling depends on the service and agreement. Ask who operates it, where it processes information and who maintains it. Your team does not need to choose the technology by acronym.

4. Processing, storage and training need separate answers

Processing means using information to produce an answer. Storage means keeping information afterwards. Training means using data to change the model. Looking up a maintenance manual to answer today's question does not, by itself, mean the model is being trained on that manual.

Trace one ordinary enquiry. Which parts of the resident's message leave the property platform? Which AI or other service receives them? Where are the files, processing and backups located? How long are prompts, answers and logs retained? Who can see them, and what happens after deletion?

Wisbid does not use customer data to train AI models. Using information to answer a maintenance question is different from training a model on that information.

The Wisbid Privacy Policy describes other matters, including AI-related data use, service providers and retention. Ask for clear answers about which records are processed, who can access them and how long they are kept. Processing an enquiry and keeping a record of it are separate questions from model training.

A Singapore hosting statement alone does not answer every processing-location question. The PDPC's data protection obligations cover protection, retention and overseas transfers. Bring your organisation's data protection lead into the discussion before uploading resident records. For an early demonstration, use made-up or properly redacted records.

5. Recognise the warning signs before granting more access

Instructions hidden inside a document

A contractor attachment could contain text intended to steer an AI away from your task. This is called prompt injection. Unexpected requests to reveal records, visit an unrelated link or send information elsewhere are warning signs. Some attacks are hidden, so staff vigilance alone is insufficient. Ask the supplier how it limits what outside content can cause the AI to do.

Information or actions beyond the job

A reply containing another resident's details, or information from a site the user cannot normally access, needs investigation. So does an agent sending messages or changing records outside its assigned task. OWASP calls excessive permissions or autonomy excessive agency. Ask to see access limits, approval steps and an activity record your team can review.

A convincing answer without reliable evidence

An invented warranty date is a reliability failure, even if nobody attacked the system. Open the cited contract and check the asset and dates. Keep safety decisions, spending commitments and acceptance of completed work with the authorised people.

Return to that leaking ceiling. A useful result identifies the correct job, points to the relevant evidence and leaves a clear next step. Start there, with a task your team understands and permissions you can explain, before giving AI more responsibility.