Deep dive: Smart buildings and building automation — the integration challenges and how to overcome them

Why It Matters

Commercial and institutional buildings consume approximately 30 percent of global final energy and are responsible for 26 percent of global energy-related emissions according to the International Energy Agency (IEA, 2025). Smart building technologies, including advanced building management systems (BMS), IoT sensor networks and AI-driven optimisation platforms, have demonstrated the ability to reduce energy consumption by 15 to 30 percent in controlled deployments (JLL, 2025). Yet adoption remains stubbornly slow. A 2025 survey by Navigant Research found that only 12 percent of commercial buildings globally have integrated smart building platforms that connect HVAC, lighting, access control and metering into a unified data layer (Guidehouse, 2025). The gap between what the technology can deliver and what building owners actually achieve in practice is driven by interoperability failures between legacy and modern systems, fragmented data architectures, cybersecurity concerns and misaligned incentive structures between landlords and tenants. Closing this gap is essential for meeting national and international decarbonisation targets. The EU's revised Energy Performance of Buildings Directive (EPBD recast, 2024) introduces a Smart Readiness Indicator (SRI) that will rate buildings on their capacity to interact with occupants and the grid, creating regulatory pressure that makes integration challenges impossible to ignore.

Key Concepts

Building Management Systems (BMS) and Building Automation Systems (BAS). A BMS is the central nervous system of a building, coordinating HVAC, lighting, fire safety, elevators and security. Legacy BMS platforms from the 1990s and 2000s typically use proprietary protocols such as Metasys (Johnson Controls) or Apogee (Siemens), making them difficult to connect with newer IoT devices and cloud analytics platforms. Modern BAS architectures increasingly adopt open protocols like BACnet, Modbus and the newer Brick Schema and Project Haystack tagging conventions, but the installed base of proprietary systems remains vast.

Interoperability and protocol fragmentation. The core integration challenge is that buildings contain systems from multiple vendors, each speaking a different data language. A typical commercial office may have an HVAC controller using BACnet, a lighting system on DALI, access control on proprietary TCP/IP, and metering on Modbus. Connecting these requires middleware or integration platforms that translate between protocols, normalise data schemas and maintain real-time data flows. The ASHRAE 223P standard, currently in public review, aims to define a unified semantic model for building data, but widespread adoption is still several years away (ASHRAE, 2025).

Digital twins and fault detection. A building digital twin is a virtual replica that mirrors real-time conditions using sensor data. When paired with fault detection and diagnostics (FDD) algorithms, digital twins can identify equipment malfunctions, detect energy waste from simultaneous heating and cooling, and predict maintenance needs before failures occur. Lawrence Berkeley National Laboratory (LBNL, 2024) estimated that FDD systems can reduce HVAC energy use by 10 to 25 percent simply by identifying and correcting operational faults that would otherwise persist undetected for months or years.

AI-driven energy optimisation. Machine learning models trained on historical building data, weather forecasts and occupancy patterns can continuously adjust setpoints and schedules to minimise energy consumption while maintaining comfort. These systems go beyond rule-based programming by adapting to changing conditions in real time. However, their performance depends heavily on data quality and sensor coverage. Buildings with sparse or poorly calibrated sensor networks produce noisy data that limits model accuracy and can lead to occupant complaints.

Cybersecurity in operational technology (OT). As building systems become networked and cloud-connected, they become attack surfaces. A 2025 report by Claroty found that 78 percent of commercial building OT networks contained at least one known vulnerability, and that building automation protocols like BACnet were originally designed without authentication or encryption (Claroty, 2025). Ransomware attacks targeting building systems have increased, with notable incidents disrupting hospital HVAC systems and hotel access controls. The convergence of IT and OT security in buildings lags behind industrial sectors.

Grid interactivity and demand flexibility. Smart buildings can act as distributed energy resources by shifting loads in response to grid signals, storing thermal energy and managing on-site generation and battery storage. The concept of a grid-interactive efficient building (GEB) is central to decarbonisation strategies that rely on variable renewable energy. The US Department of Energy's GEB roadmap estimates that widespread adoption could reduce peak electricity demand by 80 GW nationally by 2030 (DOE, 2024).

What's Working and What Isn't

Proven energy savings in new builds. Purpose-built smart buildings consistently achieve significant energy reductions. The Edge in Amsterdam, developed by OVG Real Estate and equipped with over 28,000 sensors, operates at an energy use intensity (EUI) of 70 kWh per square metre per year, roughly 70 percent below the Dutch commercial average. Alphabet's Bay View campus in Mountain View, California, which opened in 2022, uses an AI-driven all-electric system that achieved net-zero operational carbon in its first full year. These flagship projects demonstrate what is possible when systems are designed together from the ground up.

Retrofit integration remains painful. The vast majority of commercial floor space globally was built before smart building technology existed. Retrofitting these buildings requires connecting legacy controllers to modern platforms, often through hardware gateways and custom middleware. A 2025 industry survey by Memoori found that integration costs for retrofit smart building projects averaged $3.50 to $8.00 per square foot, with timelines of 12 to 24 months for full deployment in buildings over 50,000 square feet (Memoori, 2025). Many projects stall because the cost and complexity of integration exceed the building owner's patience or budget cycle.

Data normalisation as the hidden bottleneck. Even when systems are physically connected, the data they produce is often inconsistent. Sensor naming conventions vary between floors and systems, units of measurement differ, timestamps may not synchronise, and metadata describing what each data point represents is frequently missing or incorrect. The Brick Consortium reported in 2025 that fewer than 5 percent of existing commercial buildings have metadata schemas that meet the minimum requirements for automated analytics (Brick Consortium, 2025). Without clean, normalised data, AI optimisation platforms underperform their laboratory benchmarks.

AI optimisation delivering real but modest gains in practice. Independent evaluations paint a nuanced picture. A 2025 meta-analysis by the American Council for an Energy-Efficient Economy (ACEEE, 2025) reviewed 48 deployments of AI-based building energy optimisation and found median verified savings of 18 percent in HVAC energy consumption, with a range of 8 to 29 percent. The highest savings occurred in buildings with poorly tuned legacy controls where the AI effectively corrected years of operational drift. In already well-managed buildings, marginal gains were smaller. Crucially, 11 of the 48 deployments reported occupant comfort complaints that led to manual overrides, partially eroding savings.

Cybersecurity awareness rising but action lagging. The number of reported cyber incidents affecting building systems rose 32 percent year-on-year in 2025, according to the Cybersecurity and Infrastructure Security Agency (CISA, 2025). Industry response has been uneven. Large portfolio owners such as Brookfield and CBRE have established dedicated OT security teams, but mid-market building owners largely lack the expertise and budget to implement segmentation, monitoring and patch management for building networks. The NIST Cybersecurity Framework has been adapted for buildings by organisations like the Building Cyber Security initiative, but adoption remains voluntary.

Grid interactivity is nascent. Pilot programmes in California, New York and the EU have demonstrated that smart buildings can provide demand response and frequency regulation services. However, monetisation remains difficult because grid services markets are designed for large generators, not aggregated building loads. The regulatory frameworks needed to value building flexibility at scale are still being developed in most jurisdictions.

Key Players

Established Leaders

• Siemens Smart Infrastructure — Global leader in building automation with the Desigo CC platform and Xcelerator digital building suite. Over 500,000 buildings connected worldwide.
• Johnson Controls — OpenBlue digital platform integrating HVAC, fire, security and energy management. Major presence in North American and Asian commercial markets.
• Honeywell Building Technologies — Forge platform for building performance management and cybersecurity. Strong installed base in airports, hospitals and data centres.
• Schneider Electric — EcoStruxure Building platform with open API architecture. Pioneering grid-interactive building capabilities.

Emerging Startups

• Switched — AI-powered HVAC optimisation platform delivering 15 to 25 percent energy savings with non-invasive sensor overlays on existing systems.
• PassiveLogic — Autonomous building platform using physics-based digital twins to replace traditional BMS programming with self-learning controls.
• BrainBox AI — Montreal-based company using deep learning to optimise HVAC in commercial buildings. Deployed in over 400 million square feet globally by early 2026.
• 75F — Cloud-based building intelligence platform focused on mid-market commercial buildings, offering plug-and-play IoT hardware and AI analytics.

Key Investors/Funders

• Breakthrough Energy Ventures — Invested in PassiveLogic and other building decarbonisation technologies.
• Fifth Wall — Largest venture capital firm focused on built-environment technology, with investments across smart building platforms.
• US Department of Energy — Funding grid-interactive efficient building research through the Building Technologies Office with $180 million in active grants.
• European Innovation Council — Supporting building digitalisation startups through the EIC Accelerator with over €200 million allocated to built-environment innovations since 2023.

Examples

Empire State Building retuning (New York, USA). The Empire State Realty Trust partnered with Johnson Controls and the Clinton Climate Initiative to retrofit the iconic tower's building automation systems. The project installed over 6,500 IoT sensors, connected legacy chillers and air handlers to a cloud analytics platform, and deployed fault detection algorithms. By 2025, the building had achieved a 40 percent reduction in energy consumption from a 2009 baseline, saving approximately $4.4 million annually. The project demonstrated that even century-old buildings can achieve substantial savings, though the integration required 18 months of data normalisation work before the AI optimisation layer could function reliably (Empire State Realty Trust, 2025).

BrainBox AI deployment across Ivanhoé Cambridge portfolio (Canada). Ivanhoé Cambridge, one of Canada's largest commercial real-estate investors, deployed BrainBox AI's autonomous HVAC optimisation across 12 office and retail properties totalling 4.2 million square feet. The system connects to existing BMS infrastructure through API integrations and uses a deep learning engine that retrains every four hours based on live sensor data and weather forecasts. After 18 months of operation, the portfolio reported verified HVAC energy savings of 20 percent on average, with peak demand reductions of 12 percent. The deployment cost averaged $0.45 per square foot annually on a software-as-a-service basis, delivering a payback period of under two years (BrainBox AI, 2025).

Siemens Erlangen campus digital twin (Germany). Siemens built a comprehensive digital twin of its 54-building Erlangen campus, integrating over 120,000 data points from HVAC, lighting, shading, EV charging and on-site solar generation. The twin uses Desigo CC as the building automation backbone and feeds data to a Siemens MindSphere analytics layer that runs predictive maintenance and energy optimisation algorithms. In its first year of full operation (2024 to 2025), the campus reduced total energy consumption by 23 percent and cut unplanned maintenance incidents by 35 percent. Siemens open-sourced portions of its data schema to contribute to the ASHRAE 223P standardisation effort (Siemens, 2025).

Singapore's Green Mark smart building mandate. Singapore's Building and Construction Authority (BCA) updated its Green Mark certification in 2024 to require a Smart Readiness Score for all new commercial buildings above 5,000 square metres. The score evaluates interoperability, data analytics capabilities, grid interactivity and cybersecurity maturity. In the first year of enforcement, 82 percent of new office developments achieved at least a "Smart Ready" rating, and the BCA reported that these buildings averaged 22 percent lower EUI than non-smart equivalents in the same climate zone (BCA Singapore, 2025).

Action Checklist

• Audit your existing BMS to identify proprietary protocols, data gaps and integration points before selecting a smart building platform.
• Adopt open data standards such as Brick Schema, Project Haystack or the emerging ASHRAE 223P for all new sensor deployments and system integrations.
• Start with fault detection before AI optimisation, as FDD typically delivers the highest initial savings by correcting existing operational inefficiencies.
• Budget for data normalisation as a distinct project phase, allocating 15 to 25 percent of total smart building investment to metadata cleanup, sensor calibration and schema mapping.
• Implement OT cybersecurity basics including network segmentation, BACnet authentication where possible, regular vulnerability scanning and an incident response plan specific to building systems.
• Negotiate grid interactivity provisions in lease agreements and utility contracts to capture demand-response revenue and prepare for emerging regulatory requirements.
• Measure and verify independently by engaging a third-party measurement and verification provider to confirm energy savings using IPMVP protocols rather than relying solely on vendor-reported figures.

FAQ

What is the typical ROI for a smart building retrofit? ROI varies significantly based on building age, existing systems and climate zone. Industry data from 2025 suggest that AI-based HVAC optimisation delivers payback periods of 1.5 to 4 years when deployed on buildings with legacy controls and annual energy spending above $5 per square foot. Full smart building platform deployments including sensors, middleware and analytics typically achieve payback in 3 to 7 years, with faster returns in buildings where operational inefficiencies are severe. Demand-response revenue and maintenance cost avoidance can accelerate payback but are harder to predict.

How do I connect legacy BMS to modern cloud platforms? The most common approach uses hardware gateways that translate proprietary protocols (such as Metasys N2 or LON) to open standards like BACnet/IP or MQTT, which can then be ingested by cloud platforms. Several middleware solutions, including Nube iO, Mapped and Memoori's recommended vendors, specialise in legacy BMS integration. The key considerations are latency requirements, data point volume, cybersecurity implications of cloud connectivity and whether the legacy system vendor will support or void warranties when third-party gateways are installed.

Are smart buildings more vulnerable to cyberattacks? Connectivity increases the attack surface, but the risk is manageable with proper controls. Building OT networks should be segmented from corporate IT networks, BACnet communications should use the BACnet/SC (Secure Connect) extension where available, and all cloud connections should be encrypted. Regular vulnerability assessments, firmware updates and access-control reviews are essential. The risk of not modernising is also significant, as unmonitored legacy systems can waste energy for years without detection.

What energy savings should I realistically expect? Based on the ACEEE 2025 meta-analysis and vendor-reported data, a reasonable expectation for AI-based HVAC optimisation in commercial buildings is 15 to 25 percent HVAC energy reduction, translating to 8 to 15 percent of total building energy depending on the HVAC share of consumption. Savings tend to be highest in the first two years as the system corrects accumulated operational faults, then plateau as the building approaches its efficiency frontier. Occupant engagement and ongoing system maintenance are critical to sustaining savings over time.

What is the Smart Readiness Indicator and will it become mandatory? The Smart Readiness Indicator (SRI) is a European framework for rating a building's technological readiness to interact with occupants and the energy grid. It assesses capabilities across nine domains including heating, cooling, ventilation, lighting and EV charging. Under the revised EPBD (2024), EU member states must implement the SRI for large non-residential buildings by 2027, with potential extension to all building types by 2030. While it is not yet mandatory outside the EU, Singapore and several Asian countries are developing similar schemes. The SRI is likely to influence building valuation and green lease negotiations in major markets globally.

Sources

• International Energy Agency. (2025). Tracking Buildings 2025: Energy Use and Emissions in the Global Buildings Sector. IEA.
• JLL. (2025). Smart Building Adoption and Energy Performance: Global Benchmarking Study. JLL Research.
• Guidehouse (Navigant Research). (2025). Smart Building Platforms Market Survey: Adoption Rates and Integration Maturity. Guidehouse Insights.
• ASHRAE. (2025). Standard 223P: Semantic Data Model for Analytical Applications in the Built Environment (Public Review Draft). ASHRAE.
• Lawrence Berkeley National Laboratory. (2024). Fault Detection and Diagnostics for Commercial Buildings: Energy Savings Potential and Market Barriers. LBNL.
• Claroty. (2025). State of XIoT Security Report: Building Automation Systems Vulnerability Analysis. Claroty.
• US Department of Energy. (2024). Grid-Interactive Efficient Buildings Roadmap: Technology and Market Pathways. DOE Building Technologies Office.
• ACEEE. (2025). AI-Driven Building Energy Optimisation: A Meta-Analysis of 48 Commercial Deployments. American Council for an Energy-Efficient Economy.
• Memoori. (2025). Smart Building Retrofit Costs: Integration Complexity and ROI by Building Type. Memoori Research.
• Brick Consortium. (2025). Commercial Building Metadata Maturity: Baseline Assessment and Roadmap. Brick Schema Project.
• CISA. (2025). Annual Threat Report: Operational Technology in Commercial Buildings. Cybersecurity and Infrastructure Security Agency.
• Empire State Realty Trust. (2025). Sustainability Report: 15 Years of Energy Performance Improvement. ESRT.
• BrainBox AI. (2025). Portfolio Deployment Results: Ivanhoé Cambridge Case Study. BrainBox AI.
• Siemens. (2025). Erlangen Campus Digital Twin: One Year of Performance Data. Siemens Smart Infrastructure.
• BCA Singapore. (2025). Green Mark 2024: Smart Readiness Requirements and First-Year Results. Building and Construction Authority.
• European Parliament. (2024). Directive on the Energy Performance of Buildings (Recast): Smart Readiness Indicator Framework. Official Journal of the European Union.