AI and GDPR in the tenant file: what is allowed?

Yes, AI may process tenant files under GDPR — provided the processing has a legal basis (usually performance of the lease or the management mandate), the data stays inside your own secured environment, you process no more data than you need, and a human takes the decisions. What is not allowed: pasting tenant data into a public chatbot, or letting AI take decisions about people on its own.

The four conditions, concretely

• Legal basis and purpose limitation. The file serves the management of the property and the contract. AI serving that same purpose — filing, watching deadlines, assembling a dossier — changes nothing about the legal basis. AI for a new purpose (profiling, scoring tenants) is a different matter and needs its own basis.
• Data stays in your own environment. The difference between "using AI" and "giving data away" is where the model can reach the data. A platform that works inside your own Microsoft 365 tenant keeps tenant data under your existing security and processor agreements.
• Data minimisation. The agent watching expiry dates does not need to read national registry numbers. Set access per document type and per role — for the AI as well.
• Human control. GDPR (art. 22) protects against decisions based solely on automated processing that have legal effects. The safe set-up is the same as the workable one: agents prepare, people approve.

What the EU AI Act adds

The AI Act asks above all for demonstrability: know which AI you use, for what, and keep a trail. For a property management office that means, practically: an audit log of what the AI did and who approved it, identity management, and the ability to explain a processing operation. If your files are structured, you get that trail for free.

The practical test: the access request

The best test of your GDPR housekeeping is an access or erasure request from a tenant. With files scattered across mailboxes and folders that costs days of searching — and you hope you have missed nothing. With a structured file it is a filter on the tenant, an export and a documented erasure. That is the difference between compliance on paper and compliance in practice. We build our platform on the second — EU AI Act-ready from day one, because we have to be able to demonstrate it ourselves.