PRIVACY & EU AI ACT

AI in the real estate industry — used responsibly.

Whether an AI use case is lawful and appropriate is not decided by the model alone. Purpose, data, contract, configuration and human review must fit the actual workflow. This page sets out the key questions.

LEGALLY COMPLIANT DEPLOYMENT · PER TOOL

Review points for each language model.

GDPR compliance is not a property of a model. Before production use, the delivery path, contract, data flows and settings must be reviewed and documented for the specific use case.

ChatGPT

OpenAI · Business/Enterprise or API

Deployment: Check EU data residency or in-region processing for the eligible offer and the selected endpoints
Contract & roles: Check the DPA, roles, subprocessors, retention period and third-country transfers before approval
Training & retention: Business, Enterprise and API data is not used for training by default; exclude opt-ins

ChatGPT in detail Provider documentation ↗

Claude

Anthropic · Claude for Work/API or AWS Bedrock

Deployment: Set the processing path and region — direct, through Bedrock or another cloud provider — for each use case
Contract & roles: Check the contract, subprocessors and possible transfers for the selected delivery path
Training & retention: Commercial offerings do not use chats or coding sessions for training by default; document opt-ins

Claude in detail Provider documentation ↗

Gemini

Google Cloud · Vertex AI / Gemini

Deployment: Choose an EU region or data residency; review individual features and endpoints separately
Contract & roles: Check the Cloud Data Processing Addendum and additional features such as grounding and their data retention
Training & retention: Vertex AI does not use customer data to train or fine-tune without prior permission or instruction

Gemini in detail Provider documentation ↗

Microsoft 365 Copilot

Microsoft · Microsoft 365 Copilot

Deployment: Check the M365 tenant and whether the selected model is supported within the EU Data Boundary
Contract & roles: Check the Microsoft DPA, product terms and the feature scope of the organisation’s licence
Training & retention: Prompts, responses and Microsoft Graph data are not used to train foundation models

Microsoft 365 Copilot in detail Provider documentation ↗

EU AI ACT · STATUS 31 JULY 2026

What matters for real estate companies now.

Since 27 July 2026: promote AI literacy

The AI Omnibus replaced the former formal AI literacy obligation with non-binding encouragement. Role-based onboarding, clear rules of use and documented approvals remain the reliable way to operate AI in a controlled manner.

From 2 August 2026: transparency where people encounter AI

Directly interactive AI systems must generally inform people that they are interacting with AI. Further labelling rules apply to deepfakes and certain AI-generated content. Transparency therefore belongs in the rollout plan for customer-service chatbots and generated media.

High-risk systems: deadline extended to 2 December 2027

Drafting, summarising or research with generative AI is not automatically high-risk. Systems used for employment decisions, creditworthiness assessments or other listed sensitive areas need a specific classification of the intended use before they go live.

BEFORE GO-LIVE

Approve the workflow first, then the tool.

Clarify the task being supported, the data being processed, who reviews outputs and when data is deleted. Personal data, confidential tenant and property data, and connected data sources require their own risk and contract review. Pseudonymisation reduces risk, but does not automatically make data anonymous.

SOURCES & CONTEXT

Current legal status and review aids

Status: 31 July 2026. This page supports project work and does not replace a review of the individual use case by privacy or legal counsel.

Settle privacy before it becomes a blocker.

In the AI Audit & Roadmap, GDPR-compliant deployment per tool is part of the recommendation from day one.

Book an intro call Book an intro call