← IoT systems

Engineering in the age of AI

What large language models change for IoT

Dr.-Ing. Lena Golgolnia · 21 October 2026 · 11 min read

In short

  • IoT has delivered far less than its data promised. In buildings, understanding what each data point means, not collecting it, has been the main bottleneck.4
  • Large language models work exactly on that layer: they read labels, map them to shared semantic models, answer questions in plain language and turn intent into analysis logic.
  • Early research results are strong where the LLM structures and explains, and weak where it is asked to read raw time series directly.13
  • Control is the frontier. Simulation studies are promising, but an LLM that acts on physical systems needs strict limits and human approval for high-impact actions.18
  • EU rules on building automation make this practical, not academic: under national rules implementing the EPBD, larger non-residential buildings must already have automation systems that monitor, analyse and are interoperable.20

Why IoT under-delivered

Operating buildings accounts for around 30% of global final energy consumption.23 The International Energy Agency has estimated that using real-time data to improve operations could cut their energy use by 10%.24 For more than a decade, the Internet of Things has promised to deliver exactly this data. It has delivered the data. It has rarely delivered the value.

The pattern was visible early. McKinsey found that only about 1% of the data from the 30,000 sensors on a typical oil rig was used.1 In buildings, a 2020 Omdia survey of 248 users found that 77% of smart-building users keep the data their facilities generate, but 42% do not analyse it.5 McKinsey later named interoperability and installation among the main headwinds: almost every large deployment needs customisation.2

The underlying reason is not missing sensors. It is missing meaning. A building automation system can hold thousands of data points with labels such as AHU2_SAT_SP or Rm214.T, following conventions that differ from site to site, if one exists at all. Normalising the metadata of a typical five-storey office building can take weeks of expert work, an approach the researchers call clearly not scalable.3 Researchers at Lawrence Berkeley National Laboratory describe understanding the buildings’ data streams as the major bottleneck of digitising existing buildings.4

The layer LLMs change

It helps to see an IoT system as a stack of five layers, from the device on the wall to the action in the building. Classic IoT and analytics improved the lower layers: cheaper sensors, better connectivity, cloud storage. The layer in the middle, where data gets its meaning, stayed manual. That is the layer where large language models are strongest.

Five layers of an IoT system and where LLMs add value From bottom to top: devices, data, meaning, decision, action. LLMs add most value in the meaning and decision layers and should act on the action layer only within limits and with human approval. 1 · Devices: sensors, meters, controllers 2 · Data: telemetry, storage, time series 3 · Meaning: what each point is and where 4 · Decision: diagnosis, explanation, options 5 · Action: setpoints, schedules, control Largest LLM gain Strong LLM gain Within limits,with human approval Classic engineering Classic engineering
Figure 1. LLMs add the most value where IoT was weakest: turning data into meaning and decisions.

This is also where my own work has taught me the most. Measuring indoor conditions around the clock is a solved problem. Making those measurements mean something to the people who run a building, in their terms, for their decisions, is where projects succeed or stall.

Four shifts

1. From naming chaos to shared semantic models

The building industry has worked for years on shared vocabularies for data points. Brick and Project Haystack announced in 2018 that they would fold their approaches into the proposed ASHRAE Standard 223.6 The proposed standard, 223P, went through a second public review in spring 2026 and is not yet final,7 and the U.S. Department of Energy notes that none of the existing schemas is yet a consensus standard.8 The schemas exist; the bottleneck has been the expert effort to map each building onto them.

LLMs change that effort. Researchers at Berkeley Lab have set out how LLMs can create and query Brick models, precisely because building and querying ontologies requires scarce expertise.9 A 2026 approach from AWS classifies building automation points into Brick classes by combining retrieval of similar labelled examples with several models, and sends uncertain cases to human reviewers; it outperformed earlier fine-tuned language models on the buildings tested.10 The pattern matters more than the numbers: the machine does the bulk of the mapping, and the expert decides the doubtful cases.

2. From dashboards to questions

Dashboards answer the questions someone thought of when building them. Operators have other questions. Berkeley Lab has shown an approach in which a model turns a plain-language question into a query over the building’s semantic model, retrieves the matching time series from the automation system and computes the answer.11 On a public benchmark, the BrickQA method improved answer accuracy (F1) by 0.29 to 0.36 on average over a standard agent baseline, at about half a cent per question in its cheapest setting, and answered 9 of 10 time-series questions on a fault-detection dataset correctly. The authors note that the results come from a single run with one model on small, cleaned datasets.12

3. From thresholds to rules that explain

Fault detection in buildings has long relied on fixed thresholds or opaque machine-learning models. A 2025 study let an LLM write and refine detection rules as executable code. It reached an F1 score of 0.926 on a public HVAC fault dataset, against 0.902 for the next best method, while two methods in which the LLM read the time series directly scored 0.083 and 0.021.13 The result is a clear design lesson: use the language model to produce logic that engineers can read and test, and let conventional code run that logic on the data.

4. From monitoring to proposals for control

The most ambitious shift is from observing a building to acting on it. Early work showed that GPT-4, given task descriptions and examples, could control HVAC in a way comparable to reinforcement learning with few samples.15 In a 2026 simulation of a five-zone office, an LLM-based controller had 4.95% comfort violations, against 18.49% for model predictive control and 28.91% for rule-based control, while using less energy than predictive control but more than the rule-based baseline.16 The study covers one simulated building over three winter days, with setpoints clamped to safe bounds. It shows potential, not proof.

Table 1. The four shifts at a glance
ShiftWhat the LLM doesMaturity
Semantic mappingReads point labels and proposes their meaning in a shared schemaStrong early results; human review of doubtful cases
Questions in plain languageTurns a question into a query and an answerWorking research prototypes; accuracy still limited
Rules that explainWrites analysis and fault rules as readable codeStrong results on public datasets
Proposals for controlSuggests setpoints and schedulesSimulation only; needs bounds and approval

Where LLMs do not help

The same research that shows the potential also marks the boundaries. In an analysis of three LLM-based forecasting methods, removing the language model or replacing it with a simple attention layer did not reduce accuracy and usually improved it.14 For numbers, purpose-built models remain better and cheaper. A review of LLMs for building energy applications lists compute and API cost, data privacy, missing domain knowledge and inconsistent answers as the main challenges, and recommends validation and expert review.17

Three practical limits follow. First, an LLM cannot repair bad data; it can only describe it more fluently. Second, many building decisions need answers in seconds and must keep working when the connection fails, which argues for small models or plain logic close to the equipment. Small models that run on a phone show that this is feasible.19 Third, every new capability is also a new attack surface.

The relationship also runs the other way. IoT gives AI something it lacks: continuous, measured facts about the physical world. An AI system that reasons about a building without live data is guessing. With it, its proposals can be checked against what actually happens.

Design principles

From the evidence and from building such systems, six principles stand out.

Table 2. Principles for combining LLMs and IoT
PrincipleWhy
Semantic model firstEvery later use, from questions to control, depends on knowing what each point means.4,8
The LLM writes the logic, code runs itGenerated rules are readable and testable; direct reading of time series performs poorly.13
Least privilege for agentsAgents get only the tools and permissions they need; authorisation sits in the downstream system.18
Human approval for high-impact actionsOWASP recommends a person approve high-impact actions before they are taken.18
Bounded controlSetpoints stay within limits enforced by conventional safety logic, whatever the model proposes.16
Security as a product dutyConnected devices fall under the EU Cyber Resilience Act; reporting duties apply since September 2026.22

Why it matters now

In the EU, building automation is no longer optional for larger buildings. The recast Energy Performance of Buildings Directive requires Member States to ensure that non-residential buildings whose heating, air-conditioning or combined heating or air-conditioning and ventilation systems exceed 290 kW have building automation and control systems by the end of 2024, and those above 70 kW by the end of 2029, where technically and economically feasible. These systems must monitor, log and analyse energy use, detect efficiency losses and be interoperable across proprietary technologies; since 29 May 2026 they must also be able to monitor indoor environmental quality.20 The Smart Readiness Indicator, an optional EU scheme today,21 is to be applied to non-residential buildings above 290 kW through a delegated act that the Commission must adopt by 30 June 2027.25

The obligation creates the data. Large language models make it far cheaper to turn that data into understanding. Organisations that combine the two carefully, with clear semantics, bounded autonomy and people in charge of what the building does, will get the value IoT has long promised.

Frequently asked questions

Can a large language model analyse sensor data directly?

It can, but it is often not the best tool. Research shows that LLMs reading raw time series perform poorly, while LLMs that write analysis rules or queries, executed by conventional code, perform well. The LLM works best on meaning and logic, not on the numbers themselves.

What is a semantic model of a building?

A structured description of the building’s systems and data points, for example which sensor measures which room and which valve belongs to which air handling unit. Brick, Project Haystack and the draft ASHRAE 223 standard are the main schemas.

Should an AI agent control HVAC systems on its own?

Not without limits. Agents should only get the permissions they need, setpoints should be bounded by conventional safety logic, and high-impact actions should be approved by a person. OWASP lists excessive agency as one of the top risks of LLM applications.

Does this require new sensors?

Often not. The largest gain is in making existing building automation and IoT data understandable and usable. New sensors help where important conditions, such as indoor air quality, are not measured at all.

Which regulations are relevant?

In the EU, the Energy Performance of Buildings Directive sets requirements for building automation and control systems in non-residential buildings, and the Cyber Resilience Act sets security and reporting duties for connected products.

Sources

  1. McKinsey Quarterly: An executive’s guide to the Internet of Things (Aug 2015)
  2. McKinsey: IoT value set to accelerate through 2030 (Nov 2021)
  3. Koh et al.: Plaster, an integration, benchmark and development framework for metadata normalization methods, BuildSys 2018
  4. Duarte Roa et al.: Towards a stronger foundation, digitizing commercial buildings with Brick to enable portable advanced applications, ACEEE Summer Study 2022
  5. TelecomTV on Omdia: Smart building owners and operators could do more with their data (Jul 2020)
  6. ASHRAE: BACnet committee, Project Haystack and Brick Schema collaborating on a unified semantic modelling solution (Feb 2018)
  7. ASHRAE Standards Actions (24 Apr 2026): Second public review of BSR/ASHRAE Standard 223P
  8. U.S. Department of Energy: Semantic modeling and interoperability
  9. Mulayim et al.: Large language models for the creation and use of semantic ontologies in buildings, requirements and challenges, BuildSys 2024
  10. Qian et al.: Brick-DICL, dynamic in-context learning for automated Brick schema classification (2026)
  11. Mulayim, Prakash, Paul, Pritoni: Extraction and analysis of time series data from building automation systems using large language models (2025)
  12. Ko, Jung, Pritoni, Jain: BrickQA, bridging the semantic gap in building operations with dynamic graph exploration, BuildSys 2026
  13. Lin, Hua: Physics-informed large language models for HVAC anomaly detection with autonomous rule generation (Oct 2025)
  14. Tan et al.: Are language models actually useful for time series forecasting? NeurIPS 2024
  15. Song et al.: Pre-trained large language models for industrial control (2023)
  16. Bhatt et al.: ThermoLLM, thermodynamics-aware HVAC control with spatial-semantic knowledge graph (Jun 2026)
  17. Zhang, Chen: Opportunities and challenges of applying large language models in building energy efficiency and decarbonization studies (Dec 2023)
  18. OWASP GenAI Security Project: LLM06:2025 Excessive Agency
  19. Abdin et al. (Microsoft): Phi-3 technical report, a highly capable language model locally on your phone (2024)
  20. Directive (EU) 2024/1275 on the energy performance of buildings (recast), Article 13
  21. European Commission: Smart Readiness Indicator
  22. European Commission: Cyber Resilience Act
  23. IEA Tracking Report: Buildings (Sep 2022), via GlobalABC
  24. IEA: Digitalisation set to transform global energy system (Nov 2017)
  25. Directive (EU) 2024/1275 (EPBD recast), Article 15: Smart readiness of buildings