Let's be honest. Running a business in 2026 and going into 2027 feels a bit like trying to renovate a building while somebody keeps moving the foundations.

Economic conditions remain uncertain, supply chains continue to face disruption, while skills shortages show little sign of easing. At the same time, organisations are navigating evolving government policy, geopolitical tensions and heightened regulatory scrutiny.

Add to this the rapid adoption of AI, cyber threats and increasing pressure to do more with less, making the operating environment more complex than ever. These forces are not only reshaping how organisations operate day-to-day, but also influencing strategic priorities, investment decisions and the way leaders assess and manage risk.

While many real estate and construction businesses entered the year with cautious optimism. The reality is that leaders are navigating a more interconnected and uncertain risk landscape - where traditional approaches to risk management are no longer enough.

Real estate and construction businesses are investing rapidly in AI, digital systems and transformation. But in many organisations, governance, risk management and internal controls aren't evolving at the same pace. The result is a growing gap between the speed of transformation and the maturity of the control environment supporting it.

How the Building Safety Act is reshaping governance

Building safety provides a useful example of how risks are increasingly interconnected. The introduction of the Building Safety Act has not only created compliance and regulatory obligations, particularly around higher-risk buildings, but also affected project delivery, financial performance, technology, supply chain and reputational risk.

For example, a building safety compliance issue may initially appear to be a regulatory risk. However, if key design information is unavailable or incomplete, it can quickly become a technology and data governance risk. Delays in obtaining regulatory approval can then impact project timelines and cash flows, creating financial and operational consequences.

Where contractors or suppliers are unable to meet the required standards, organisations may also face supply chain disruption, contractual disputes and increased delivery costs. In turn, public scrutiny and regulatory enforcement can damage stakeholder confidence and organisational reputation.

The question for leaders is no longer "What are our biggest risks?" but "How do these risks interact?"

Why technology alone isn't enough for transformation

Leaders are increasingly recognising an important truth: the solution is not simply to invest in more technology or introduce more controls. Success depends on building governance, risk and assurance frameworks that can keep pace with change while enabling transformation.

Across our discussions with Internal Audit and Risk leaders throughout 2026, a common message has emerged: organisations are not struggling because they lack technology. They are struggling because the speed of change is often exceeding the maturity of the control environment needed to support it.

Many organisations in the sector are accelerating investment in transformation programmes, digital initiatives and AI-enabled capabilities. However, governance, risk management and control frameworks are not always evolving at the same pace. As a result, businesses can find themselves introducing new technologies, processes and ways of working before the appropriate oversight, accountability and assurance arrangements are fully established.

Can your governance keep pace with AI adoption?

Perhaps no area illustrates this challenge more clearly than artificial intelligence.

Just twelve months ago, AI adoption was largely viewed as an innovation opportunity. Today, it is rapidly becoming a governance priority. Organisations are increasingly using tools such as Microsoft Copilot to prepare reports, analyse information and improve productivity, while others are using AI to review contracts and challenge their commercial terms. As these tools become embedded within day-to-day operations, the focus is shifting from adoption to ensuring appropriate governance, data protection and accountability arrangements are in place.

A recurring theme within the Construction Internal Audit Forum discussions was concern over unauthorised use of external AI tools such as ChatGPT, uncertainty around data ownership, and growing exposure to AI-enabled cyber threats such as sophisticated phishing attacks and deepfakes.

The challenge is no longer whether employees will use AI, but whether organisations can govern its use effectively. In response, some organisations are beginning to define approved AI tools and use cases, provide targeted employee training, establish human review requirements and strengthen controls over the information that can be entered into external platforms.

The same principle applies across the wider transformation agenda. Innovation without proportionate governance may create short-term value, but it can also introduce risks that undermine transformation over the longer term.

Technology investment trends across the sector

Our Real Estate 360 survey found that operational and finance system upgrades are ranked as the leading technology investment priority, closely followed by AI and automation, and cybersecurity and resilience. This suggests that organisations are concentrating investment on modernising core infrastructure, processes and control environments to create the foundations for longer-term transformation.

The lower ranking of digital tenant experience platforms does not necessarily suggest reduced ambition. Instead, it may indicate that businesses are prioritising the operational foundations needed to support the next generation of tenant and occupier services.

Interestingly, these are rarely technology problems. More often, they are governance and control challenges.

How effective controls support successful transformation programmes

For real estate and construction businesses, effective governance is about more than complying with planning, health and safety, building safety and financial reporting requirements. Institutional investors, lenders and development partners also expect clear evidence that major projects are being governed effectively, risks are visible and management information can be relied upon.

Control effectiveness therefore needs to be assessed in practical terms:

• Can leaders identify emerging cost and programme pressures early?
• Can they rely on project, asset and building-safety data?
• Are design changes appropriately controlled?
• Are contractor and supplier risks visible across the organisation?

This is particularly relevant as investment continues to accelerate across infrastructure, defence, energy, water and digital infrastructure programmes. As projects become larger, more complex and increasingly technology-enabled, the quality of governance, reporting and assurance arrangements becomes a critical factor in successful delivery.

The conversation is therefore shifting from control existence to control effectiveness.

Three questions every board should ask transformation risk

The challenge is not simply to determine whether transformation programmes are progressing. Boards must understand whether governance and controls are evolving quickly enough to protect value and support delivery.

• Are accountability and decision rights clear where technology, projects, assets and third parties intersect?
• Can management rely on the data being used to make decisions about cost, programme delivery, building safety and asset performance?
• Are controls providing meaningful visibility and assurance, or simply adding process and administrative burden?

The organisations best positioned for the future will not necessarily be those investing the most in technology. They will be those that combine investment with reliable information, clear accountability and proportionate controls.

Technology may be the engine, but effective governance will determine whether transformation reaches its intended destination.

For more information, get in touch with Stacy Eden or your usual RSM contact.

Latest related insights