AI reaches property businesses through several doors at once: an assistant answers questions about available units, a model reads leases and other PDF documents, and AI drafts an offer. At every one of these points, personal data of tenants, owners and clients passes through the system.
Two pieces of EU law matter for this kind of project. The GDPR (Regulation 2016/679, known in Poland as RODO) governs how personal data may be processed, including when an AI model does the processing. The AI Act (Regulation 2024/1689) adds obligations tied to the technology itself, and some of its provisions and deadlines were changed in July 2026 by the Digital Omnibus Regulation 2026/1744.
Below we set out what this means for property managers (zarządcy), developers and agencies in Poland, as of 21 October 2026. How to organise document reading itself, so that AI proposes and a person approves, is covered in a separate post on AI lease extraction with human review. This is not legal advice; it is worth checking the details of your own situation with a lawyer.
Your AI provider is a processor
When an AI service processes personal data on behalf of your company, for example by reading a lease that contains a tenant's details, its provider is a processor under the GDPR. Article 28 allows you to use only processors that provide sufficient guarantees, and it requires a data processing agreement (in Polish, umowa powierzenia).
The GDPR lists what such an agreement has to contain, including:
- the subject matter and duration of the processing;
- the nature and purpose of the processing;
- the type of personal data and the categories of people it concerns;
- a rule that the provider processes data only on documented instructions from the controller, including transfers to a third country;
- a rule that a sub-processor, meaning the provider's own subcontractor, may be brought in only with the controller's written authorisation.
Before you connect an AI service, read its processing agreement and its list of sub-processors. The same rule applies to us as a contractor: if we have access to personal data while building a system, we sign a processing agreement before work begins.
Data outside the European Economic Area
An AI service may process data on servers outside the European Economic Area (EEA). The GDPR allows this, but only under the conditions of Chapter V:
- the European Commission has issued an adequacy decision for the country in question (Article 45);
- or appropriate safeguards are in place, such as standard contractual clauses (Article 46);
- in exceptional situations, a transfer may rely on Article 49.
The people whose data you collect have to hear about this when you collect it. Article 13 requires information on, among other things, the recipients of the data, transfers outside the EEA, the retention period and the person's rights. If you bring AI into how you deal with tenants or clients, review your privacy notice with this in mind.
Automated decisions: where a person has to step in
Article 22 of the GDPR gives everyone the right not to be subject to a decision based solely on automated processing if it produces legal effects for them or similarly significantly affects them. There are exceptions, for example when the decision is necessary for entering into or performing a contract, or when the person has given explicit consent. In those cases the controller must provide at least the right to obtain human intervention, to express one's own point of view and to contest the decision.
Suppose a system scores applications from prospective tenants on its own and rejects some of them without any employee involved. Whether such a decision significantly affects the applicant has to be judged case by case, but this is exactly the territory of Article 22. A simpler design: AI sorts the applications and an employee decides.
Automated decisions also have to be disclosed. If you make them, Article 13 requires meaningful information about the logic involved.
Data protection impact assessment (DPIA)
If processing is likely to result in a high risk to people, the controller carries out a data protection impact assessment, or DPIA (Article 35), before the processing starts. The GDPR explicitly names systematic evaluation of people involving profiling on which decisions with legal effects are based.
The changes to the GDPR proposed in the Digital Omnibus package (procedure 2025/0360(COD)) have not been adopted: as of 21 October 2026, the proposal is awaiting a decision by a European Parliament committee. The existing GDPR text applies, Article 22 included.
The AI Act: what applies today
Article 4 of the AI Act, on AI literacy, has applied since 2 February 2025. Since 27 July 2026, following the Digital Omnibus amendment, it speaks of measures that support the development of AI skills among the people working with AI. The provision also makes clear that this does not mean ensuring that each of those people reaches a specific level of competence.
A practical starting point: a short guide for the team on what AI does in the system, where it makes mistakes and who approves its output.
An AI assistant talking to clients: Article 50
Article 50 of the AI Act, on transparency, applies from 2 August 2026. The Digital Omnibus did not move this general date, but it added one exception, described below. Three paragraphs matter for the property sector.
- Paragraph 1. The provider of an AI system that interacts directly with people designs it so that a person knows they are talking to AI, unless this is obvious. The information has to be given at the latest at the first interaction (paragraph 5). This is an obligation of the system's provider, not of a company that merely uses it.
- Paragraph 2. The provider of generative AI marks its output in a machine-readable format as generated or manipulated by AI. An assistive function for standard editing is an exception. Providers of generative AI placed on the market before 2 August 2026 have until 2 December 2026 to do this.
- Paragraph 4. A company deploying AI discloses that a deepfake has been generated or manipulated by AI. The same applies to text on matters of public interest, unless it has undergone human review or editorial control and someone holds editorial responsibility for it.
If we build you an assistant that answers tenants or agency clients, its first message says plainly that it is an AI assistant. Who counts as the provider under the AI Act in such an arrangement is worth assessing with a lawyer. The agreed split of obligations can then be written into the implementation contract.
Tenants, scoring and high-risk systems
Tenant screening raises the most questions. Annex III of the AI Act, the list of high-risk areas, does not mention residential lettings. Housing appears only in recital 58, as an example of an essential service to which access may depend on scoring.
High risk does, however, cover AI systems intended to assess the creditworthiness of natural persons or to establish their credit score, except systems used to detect financial fraud (Annex III, point 5(b)). If your system in fact assesses the creditworthiness or credit score of an applicant who is a natural person, that is exactly this point, whatever the feature is called.
The deadlines for high-risk systems have been moved: requirements for Annex III systems apply from 2 December 2027, and for Annex I products from 2 August 2028. The original dates were 2 August 2026 and 2 August 2027. The postponement does not touch the GDPR: Article 22 and the impact assessment already apply.
Checklist before you deploy AI
- List where AI touches personal data: the assistant, document reading, draft offers, reports.
- For each AI service, check the processing agreement and its rules on sub-processors.
- Find out where the provider processes the data. If outside the EEA, check which Chapter V basis applies.
- Review your privacy notice: recipients, transfers outside the EEA, retention period, automated decisions.
- Design the process so that decisions that matter for a person are made by an employee, and the system records who approved them and when.
- Assess whether a DPIA is needed and carry it out before launch.
- If you run an AI assistant, check that its very first message says it is AI.
- If any feature assesses the creditworthiness or credit score of a natural person, treat it as an Annex III, point 5(b) system and take legal advice.
- Send the AI service only the data that the task really needs.
How we approach this in custom systems
We use existing AI models and do not train our own. Which AI services the system uses and what data reaches them is agreed with you before launch. AI can make mistakes, so a person checks its output first.
We built a module that processes PDF documents using AI in a system for managing a commercial property portfolio: 11 weeks of work in four stages, each closed with an acceptance report. An assistant that talks to clients and lease reading are, for now, our proposal rather than a completed project.
If you are planning AI in your company and want it set up in line with the GDPR and the AI Act from the start, describe in a few sentences what it should do. We will reply with where it makes sense to begin and arrange a free consultation. You can put together an approximate cost of the AI modules in our approximate price builder; it is indicative only, and every quote is individual.
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 13, 22, 28, 35, 44, 45, 46 and 49, checked on 21.10.2026
- Regulation (EU) 2024/1689 (AI Act), Articles 4, 50 and 113, Annex III, recital 58, checked on 21.10.2026
- Regulation (EU) 2026/1744 (Digital Omnibus), OJ L 2026/1744 of 24.07.2026, checked on 21.10.2026
- European Parliament, Legislative Observatory, procedure 2025/0360(COD), checked on 21.10.2026
