What should a housing association require from AI used on tenant data?

A housing association should require four things from any AI that touches tenant data: processing inside infrastructure the association controls, a guarantee that tenant records never train a supplier's model, a per-case audit trail that a Housing Ombudsman investigation can verify, and a hard boundary on scope, with AI drafting and prioritising while housing officers decide. Any deployment that cannot meet all four should not see tenant data.

The question is live in 2026 because associations face simultaneous pressure: Awaab's Law timescales on damp and mould, the Regulator of Social Housing's consumer standards, and complaint volumes that outstrip casework capacity. AI can genuinely help with triage and correspondence, which makes the governance question urgent rather than academic.

Why is tenant data more sensitive than ordinary customer data?

Because it maps a household's vulnerabilities, not just its transactions. A tenant file can hold vulnerability flags, safeguarding notes, arrears histories, complaint records and damp and mould casework, often concerning children and disabled residents. Some of it, such as health and vulnerability information, is special category data under UK GDPR, and all of it concerns people who cannot take their tenancy elsewhere. Data of this kind should not sit in a jurisdiction the association cannot answer for, and it should never become training material for a model that serves other organisations.

What does Awaab's Law mean for AI in repairs?

Awaab's Law, introduced under the Social Housing (Regulation) Act 2023 and coming into force in phases from October 2025, sets fixed timescales for social landlords to investigate and remedy damp and mould and emergency hazards. That makes repairs triage a genuine AI use case: reading inbound reports, flagging damp and mould language, and prioritising by hazard and household vulnerability. It also raises the evidential bar. If an association uses AI in triage, an Ombudsman or the regulator may later ask how a case was prioritised and when. The triage record must therefore be complete, per case and verifiable, not an aggregate dashboard.

What do the consumer standards and UK GDPR actually require?

The Regulator of Social Housing's consumer standards, in force from April 2024, require landlords to understand the condition of their homes and the needs of their tenants, and to handle complaints fairly and promptly. UK GDPR adds purpose limitation, minimisation and accountability for every processing operation, with heightened expectations where children's data is involved. Neither regime names AI, and neither needs to: an association remains accountable for processing regardless of whose infrastructure performs it. Passing tenant data to an external AI service does not pass the accountability with it, which is why sending such data outside the association's control creates risk the association itself carries.

Should tenant data ever train a supplier's model?

No. A model trained on tenant records can memorise and reproduce them, so the weights become a derivative copy of the data outside the association's control. A supplier's contractual promise not to train on your data is a promise, not a technical guarantee, and enforcement after the fact cannot untrain a model. The architectural answer is stronger than the contractual one: run the models inside the association's own boundary, where a zero-egress inbound perimeter means tenant data cannot reach a training pipeline because it never leaves the building.

What does a verifiable audit trail look like for a complaint case?

Per case, sealed, and checkable without trusting the supplier. In Mickai, our Sovereign Intelligence Operating System, every AI action on a case writes to a post-quantum signed audit ledger: the document read, the summary produced, the priority suggested, the model version that produced it, and the officer who accepted or overrode it, with identity hardware-attested and bound to the chain. The record is verifiable offline, so an Ombudsman investigation can check it without any connection to us or to anyone else. That is the standard to hold any supplier to: not a report about the system, but a record from it that a third party can verify.

Where should AI help first, and where should it stop?

The honest scope is narrow and valuable: AI drafts and prioritises, and housing officers decide.

• Repairs triage: reading inbound reports and flagging damp, mould and hazard language for officer review.
• Complaint handling: drafting stage one responses from the case file for an officer to check and send.
• Case summaries: condensing long histories before a visit, a panel or a handover.

Decisions about a household, a tenancy or a safeguarding referral stay with people, and the audit trail should show that they did.

What questions should you put to an AI supplier?

Four questions expose most of the risk.

• Where, physically, is tenant data processed, and can the system run with no outbound connection at all?
• Can you prove our data never trains your models architecturally, rather than contractually?
• Can an Ombudsman verify a single case's AI history without your cooperation?
• Are model weights versioned and hashed, so we know exactly which model handled which case?

A supplier with good answers will welcome the list. A supplier without them is asking the association to carry the risk on trust.

“Tenant data should be processed where the association can answer for it, and nowhere else.”

How the whole sovereign pattern fits together is set out at /sovereign-ai, and the film at /film shows the interface in operation.

Frequently asked questions

Can we use ChatGPT to draft housing complaint responses?

General drafting with no tenant identifiers carries limited risk on any public service. The problem begins when a complaint file, a vulnerability flag or an address enters the prompt, because that is tenant data leaving the association's control for infrastructure it cannot answer for. Public cloud services such as ChatGPT, Claude or Gemini are not designed to give an association verifiable per-case evidence of what happened to that data, so complaint casework belongs inside the association's own boundary.

Does UK GDPR stop housing associations from using AI on tenant data?

No. UK GDPR governs how the processing happens, not whether AI may be involved. The association needs a lawful basis, purpose limitation, minimisation and accountability, with particular care where children's data or special category data is present. Processing inside the association's own infrastructure, with a verifiable audit trail, is the pattern that makes those obligations demonstrable rather than asserted.

What should we log when AI helps with a tenant case?

Everything that would matter in an Ombudsman investigation: the input the AI read, the output it produced, the model version, the timestamp, and the identity of the officer who accepted, edited or overrode it. The log should be sealed against alteration and verifiable by a third party. If a case ends in dispute two years later, that record is the association's evidence of fair handling.

Can AI decide repair priorities under Awaab's Law?

AI can propose priorities; it should not finalise them. Awaab's Law timescales make triage speed valuable, and AI reading inbound reports for damp and mould language is a sound use. The determination of a hazard and the commitment to respond within statutory timescales are accountabilities the landlord holds, so the workflow should show an officer confirming every priority the AI suggests.