EU AI Act for Real Estate and Proptech: What Is High-Risk, and What Is Not

Mostly not. The bulk of the AI a real-estate agency or proptech platform runs under Regulation (EU) 2024/1689 — the EU AI Act — is minimal- or limited-risk: listing-copy generation, automated valuation models, lead scoring, search ranking and forecasting sit outside the high-risk regime. Only four lines genuinely bite: tenant and applicant screening on financial grounds, rental and mortgage creditworthiness scoring, AI gating access to public housing assistance, and the Article 50 disclosure duty on chatbots and synthetic listing media.

The trap is treating the whole estate as one compliance problem and building a high-risk programme over systems that need only transparency and literacy hygiene. This page is a triage map: it leads with what is not high-risk, isolates the systems that are, and routes you to the credit-scoring and mortgage-decision deep-dives for the obligation stack rather than re-deriving it. The scope is the standalone Annex III route.

---

The Real-Estate AI Estate Is Mostly Not High-Risk — Lead With That

The honest thesis first: most proptech AI is not high-risk, and pretending otherwise wastes a budget you should spend on the systems that matter. Listing-copy generation, automated valuation models, lead scoring, search ranking, demand forecasting and viewing-scheduling tools are minimal- or limited-risk. None of them appears in Annex III.

High-Risk Is a Closed List — Article 6(2)

A system is high-risk only where it maps onto a named use case. Article 6(2) makes a system high-risk where it falls within Annex III, a closed list of eight headings. Real estate is not one of them. An agency enters the regime only when a specific system maps to a specific Annex III point — chiefly point 5 (essential services, including creditworthiness and public assistance) or point 4 (employment). The sector label is irrelevant; the function of the individual system is everything.

Four lines bite; everything else is transparency-and-literacy housekeeping. The use-case-to-risk table later in this page sets out the whole estate in one view. The frame holds throughout: classify each system, not the company.

The Prohibited-Practice Floor Applies to Everyone — Article 5

Regardless of tier, Article 5 prohibitions bind every operator. An agency that runs emotion recognition over its branch staff, or biometric categorisation inferring sensitive attributes of visitors, is in prohibited territory whatever else its AI estate looks like. That floor is live now.

---

Listing Copy, Valuation Models, Lead Scoring and Search: Why These Are Low-Risk

The commercial core of proptech AI is the part the Act touches least. These systems optimise marketing and operations; none decides a natural person's access to an essential service.

AI-Written Listing Descriptions and Marketing Copy

AI-generated listing text, photo enhancement and marketing personalisation are minimal-risk. The only live duty is Article 50 output-marking: synthetic text, image, audio and video must be marked as artificially generated in machine-readable form. Those content-marking duties arrive on 2 December 2026 under the Digital Omnibus — adopted, so plan against the stated date.

Automated Valuation Models (AVMs) for Pricing and CMAs

An automated valuation model (AVM) that estimates a property's market value for pricing, a comparative market analysis (CMA), or a portfolio is valuing an asset, not a natural person. It sits outside Annex III point 5(b), whose object is the creditworthiness of natural persons. The distinction is the object of assessment: property versus person.

Caveat the line carefully. If the same model is repurposed to gate a person's access to a mortgage or tenancy on affordability grounds, the intended purpose changes and point 5(b) can re-engage — the mortgage-decision guide covers that crossover.

Lead Scoring, Search Ranking and Demand Forecasting

Lead scoring of prospective buyers and sellers for marketing prioritisation is commercial profiling, not an Annex III decision about access to an essential service. It is low-risk under the Act, though the GDPR still governs the profiling. Search ranking and demand forecasting are likewise operations tooling outside Annex III.

Article 6(3) confirms that narrow procedural or preparatory tasks are not high-risk — but never assert that exemption where a system profiles a natural person to gate housing access, because the filter does not rescue a system that sits in Annex III.

---

The First Line That Bites: AI for Tenant and Applicant Screening

Tenant and rental-applicant screening is the sharpest real-estate-specific risk. Where it evaluates an applicant's creditworthiness or financial reliability to gate access to housing, it engages Annex III point 5(b) — the creditworthiness and credit-scoring of natural persons.

Two Flavours of Screening

Distinguish them. Pure identity verification and fraud checks are a different matter: the point 5(b) fraud-detection use is carved out, and identity verification may fall outside the heading. But a system that scores ability-to-pay or financial reliability to decide who gets the tenancy is evaluating creditworthiness, and is high-risk — substance governs over label, so a tool badged "verification" that in practice gates credit eligibility is still caught.

The Employment Adjacency — Annex III Point 4

Where a property manager screens applicants for a tenancy offered as an employee-housing benefit, or screens its own staff, Annex III point 4 (employment) can be in play. The adjacency is context-dependent, not automatic.

The GDPR Overlap — Article 22

Tenant screening that produces a legal or similarly significant effect — refusal of housing — engages GDPR Article 22 independently of the AI Act. Proxy-variable discrimination, where postcode, employment type or benefit income stands in for a protected characteristic, is a live fundamental-rights risk both regimes police.

Do not re-derive the obligation stack here. If a system is high-risk, the full Articles 9 to 15 provider requirements, the Article 26 deployer duties and the Article 27 FRIA all apply — the credit-scoring and mortgage-decision pages carry it.

---

The Second Line: Rental and Mortgage Creditworthiness AI

AI that evaluates a renter's or a buyer's creditworthiness for a mortgage or a rental is squarely Annex III point 5(b) — the identical legal basis as the credit-scoring and mortgage pages, applied to the real-estate intermediary's context. Proptech platforms and large agencies increasingly bundle financing and affordability tools at the point of enquiry; embedding or co-deploying a creditworthiness model pulls the platform into a provider or deployer role, not a bolt-on the Act ignores.

Who Holds the Obligation — Articles 16, 26 and 25

The role allocation: the model vendor that develops and places the scoring system on the market under its own name is the provider under Article 16. The agency or platform putting it into use is the deployer under Article 26. A deployer that customises the intended purpose, retrains the model, or white-labels it under its own name flips to provider under Article 25.

The FRIA Trigger — Article 27

A private deployer using high-risk AI for the creditworthiness or credit-scoring of natural persons must run an Article 27 Fundamental Rights Impact Assessment (FRIA) before go-live — the seven-part workflow lives on the dedicated pages.

---

The Third Line: AI Gating Access to Essential Housing Assistance

Where AI determines eligibility for, grants, reduces or revokes public housing assistance or social-housing allocation, it engages Annex III point 5(a) — access to essential public assistance benefits and services.

The Public-Sector and Social-Housing Edge

This is the public-sector edge of the estate. Municipal authorities, social-housing allocation algorithms, and the proptech vendors that serve them are the actors most exposed; a private operator running an allocation algorithm on behalf of a public authority is inside the heading too, and squarely within the Article 27 FRIA obligation.

Keep 5(a) and 5(b) Apart

Distinguish the two limbs so you self-classify correctly. Point 5(a) is public benefit and assistance access; point 5(b) is private, commercial creditworthiness. A social-housing eligibility tool is 5(a); a private landlord's affordability score is 5(b). For the boundary between high-risk and lighter tiers, see how Article 6 classification works and the limited-risk obligations.

---

The Fourth Line: Chatbots and the Article 50 Transparency Duty

Real-estate chatbots, virtual leasing assistants and automated enquiry handlers are limited-risk: the duty is disclosure, not the high-risk stack.

When a Property Chatbot Must Disclose It Is AI

Article 50 requires that a natural person be informed they are interacting with an AI system, unless that is obvious from the context. For a leasing assistant or enquiry bot this is almost always a live obligation, satisfied by a clear in-widget label at the start of the conversation. There is no technical-documentation requirement and no Articles 9 to 15 stack attached.

Synthetic Listing Media and Content-Marking

Synthetic or AI-altered listing imagery, video and audio — virtual staging, generated walkthroughs — and generative listing copy fall under Article 50 disclosure and machine-readable marking of AI-generated output. The content-marking duties arrive on 2 December 2026 under the Digital Omnibus, adopted with European Parliament plenary approval on 16 June 2026 and Council adoption on 29 June 2026. For the detail, read Article 50 chatbot and synthetic-media disclosure.

---

Worked Example: A Mid-Sized Agency and Its Proptech Stack

Consider Lumen Estates, a regional agency with around 40 branches across Germany and the Netherlands, running its proptech vendor NestaFlow across the customer journey.

• AI listing copy and enhanced imagery. Minimal-risk; the only duty is Article 50 machine-readable marking of generated output, with the content-marking obligation set for 2 December 2026 (Digital Omnibus, adopted).
• AVM for pricing and CMAs. Low-risk; it values an asset, not a person, so it sits outside Annex III point 5(b).
• Lead scoring of enquiry traffic. Low-risk commercial profiling under the Act; GDPR still applies.
• Leasing chatbot. Limited-risk; Article 50 disclosure that the enquirer is talking to an AI system.
• Tenant-affordability screening. High-risk under Annex III point 5(b) — it scores applicants' financial reliability to gate the tenancy.

Now the role split. NestaFlow develops and supplies the screening model under its own name, so it is the provider under Article 16. Lumen Estates puts it into use, so it is the deployer under Article 26 and must run an Article 27 FRIA before go-live. If Lumen retrains the model on its own tenancy data, that substantial modification makes it a provider under Article 25, inheriting the Articles 9 to 15 stack.

The honest takeaway: of five systems, one is high-risk, one is limited-risk under Article 50, and three are low-risk — the effort is targeted, not total.

Penalty calibration for an actor this size: high-risk breaches fall under Article 99(4) at €15 million or 3% of total worldwide annual turnover, whichever is higher; prohibited-practice breaches — emotion recognition of branch staff, biometric categorisation of visitors — hit Article 99(3) at €35 million or 7%, whichever is higher. For an SME, Article 99(6) caps the fine at the lower of the two.

---

Real-Estate AI Use-Case-to-Risk Map

Find your system in the left column, read its likely tier, then the governing point and the duty that follows.

---

Deadlines, Roles and What to Do Now

The dates that bite now do not wait for the high-risk deadline. Article 5 prohibitions and the Article 4 AI-literacy obligation have both applied since 2 February 2025 — and that literacy duty reaches every agency using AI, regardless of risk tier.

The High-Risk Timeline and the Digital Omnibus Caveat

The high-risk Annex III statute date under Article 6(2) is 2 August 2026. The deferral to 2 December 2027 was adopted under the Digital Omnibus: the European Parliament passed it in plenary on 16 June 2026 and the Council formally adopted it on 29 June 2026. Only publication in the Official Journal remains — expected before 2 August 2026 — a formality that does not affect the dates. The adopted Digital Omnibus now sets 2 December 2027 for stand-alone Annex III. The "stop the clock" proposal was rejected, and not everything is delayed.

A Light, Non-Duplicative Action Checklist

• Inventory the AI estate, classifying each system rather than the company.
• Isolate any point 5(a), point 5(b) or point 4 systems — that is where the high-risk obligations land.
• Confirm Article 50 disclosure on chatbots and machine-readable marking on generated media.
• Run Article 4 AI-literacy training now; it is already in force.

The honest closing: most proptech AI needs transparency and literacy hygiene, not a high-risk programme. Concentrate effort on the screening and creditworthiness lines.

---

How Confir Helps

Confir walks each real-estate use case through Article 6(2) and Annex III, then applies the Article 6(3) filter — separating the low-risk listing, AVM and lead-scoring systems from the high-risk screening and creditworthiness systems. The engine is deterministic and rule-based: the same intake answers produce the same finding every time, with no model inference and no hallucination, and the rule that fired shown so every classification is audit-defensible.

For deployers of in-scope screening or creditworthiness AI, Confir runs the Article 27 FRIA as a guided workflow and produces an audit-ready, registrable output, and flags which chatbots and generative-media systems need Article 50 disclosure and output-marking — so an agency neither under- nor over-complies. The GPAI workflow remains partial and on the roadmap; classification and FRIA are the live core.

---

Frequently Asked Questions

Is an automated valuation model (AVM) high-risk under the EU AI Act?

No. An AVM that estimates a property's market value for pricing, a comparative market analysis, or portfolio valuation is assessing an asset, not the creditworthiness of a natural person, so it falls outside Annex III point 5(b) and is generally minimal-risk. The classification turns on the object of assessment: property versus person. The line moves only if the same model is repurposed to gate an individual's access to a mortgage or tenancy on affordability grounds, which changes the intended purpose and can re-engage point 5(b).

Is AI used to screen rental applicants high-risk?

It depends on what the system evaluates. Identity verification and fraud checks are generally not high-risk, and the Annex III point 5(b) fraud-detection use is carved out. But where the system scores an applicant's creditworthiness or financial reliability to decide whether they get the tenancy, it evaluates creditworthiness of a natural person and is high-risk under Annex III point 5(b). The full provider and deployer obligation stack then applies, and GDPR Article 22 may apply in parallel.

Do real-estate chatbots need to disclose they are AI?

Yes. Under Article 50, a leasing assistant, enquiry bot, or virtual agent must inform the person that they are interacting with an AI system, unless that is obvious from the context. This is a transparency duty, not the high-risk regime, so it does not pull in Articles 9 to 15. AI-generated or AI-altered listing imagery, video, and copy must also be marked as artificially generated in machine-readable form, with content-marking duties arriving 2 December 2026 under the Digital Omnibus.

Is AI-generated listing copy regulated?

Only lightly. Generating listing descriptions, marketing text, or enhanced photos is minimal-risk and does not trigger Annex III. The relevant obligation is Article 50 output-marking: generative systems must mark synthetic image, audio, video, and text as artificially generated in a machine-readable way. Those content-marking duties are scheduled for 2 December 2026 under the Digital Omnibus, which is now adopted law.

When does AI become high-risk for a real-estate or proptech company?

When a system maps onto a named Annex III point. In practice that means three lines: evaluating a tenant or buyer's creditworthiness or financial reliability to gate housing access (point 5(b)); determining eligibility for public housing assistance (point 5(a)); and recruiting or managing the company's own staff (point 4). Listing copy, valuation models, lead scoring, and chatbots stay outside the high-risk tier. Concentrate the compliance effort on the screening and creditworthiness systems, not the whole AI estate.

What penalties apply to a real-estate company under the EU AI Act?

Three tiers. Prohibited practices, such as emotion recognition of staff or biometric categorisation inferring sensitive attributes, reach €35 million or 7% of worldwide annual turnover (Article 99(3)). Breaches of high-risk obligations reach €15 million or 3% (Article 99(4)). Supplying incorrect information to authorities reaches €7.5 million or 1% (Article 99(5)). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the percentage or the fixed amount.

What does a real-estate company need to do before the high-risk deadline?

First, note the dates already in force: Article 5 prohibitions and the Article 4 AI-literacy duty have applied since 2 February 2025, regardless of risk tier. For high-risk systems, obligations apply from 2 December 2027 under the Digital Omnibus, adopted in June 2026. Inventory your AI estate, isolate any point 5(a), 5(b), or point 4 systems, run the FRIA for in-scope deployers, and confirm Article 50 disclosure on chatbots and generated media.

---

Related guides

• Creditworthiness AI is high-risk under Annex III point 5(b)
• Mortgage and loan AI obligations explained
• Article 50 chatbot and synthetic-media disclosure
• Limited-risk transparency obligations
• How Article 6 high-risk classification works