How to Write an AI Policy for the Real Estate Investment Industry
An AI policy for a real estate investment or asset-management company needs to cover five things: which AI tools are approved for use, which decisions those tools are allowed to inform versus never allowed to make unsupervised, how every AI-assisted output gets reviewed by a qualified person before it reaches a financial decision, how a model's performance gets tested before it is trusted with real work, and who inside the company is accountable when something goes wrong. A policy that only says "use AI responsibly" is not a policy - it gives underwriters, asset managers, and portfolio teams no actual boundary to work inside, and gives the company nothing to point to if a regulator, investor, or court later asks how an AI-assisted decision was made.
Why real estate investment companies need a written AI policy now
Companies are adopting AI faster than they are governing it. A 2026 Compliance Week survey found 83% of organisations are already using AI tools in some form, while only 25% have implemented a governance framework around that use - a gap that used to be a reputational risk and is now becoming a compliance one.
For a European real estate investment company, the pressure comes from two directions at once. Under the EU AI Act, obligations for high-risk AI systems listed in Annex III - which explicitly names evaluating an individual's creditworthiness as a high-risk use case - were originally due on 2 August 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744), adopted in July 2026, moved them to 2 December 2027. Not everything moved: the Article 50 transparency duties - telling people when they are dealing with an AI system and labelling AI-generated content - have applied since 2 August 2026. The other direction is already binding law: in December 2023 the Court of Justice of the European Union ruled, in the SCHUFA case, that an automated credit score produced by a credit information agency counts as "automated individual decision-making" under Article 22 GDPR once a lender draws strongly on that score to grant, refuse, or terminate a contract - closing the argument that a nominal human sign-off is enough to avoid GDPR's automated-decision-making obligations. Between a high-risk deadline that has moved but not disappeared, transparency duties already in force, and a Court of Justice ruling that applies today, this is not a hypothetical compliance exercise.
What the policy needs to cover
Start with an inventory: every AI tool actually in use across the company, not just the ones IT formally approved - a policy that ignores the model already inside someone's underwriting spreadsheet or lease-abstraction workflow is protecting against the wrong risk. From there, draw an explicit boundary around decisions: which tasks an AI tool may inform (drafting a lease abstract, flagging outliers in a rent roll, summarising an offering memorandum) and which decisions it may never make unsupervised (approving or declining a loan, setting a tenant's screening outcome, finalising an investment thesis). Require a qualified person to review and sign off on any AI-assisted output before it reaches a financial decision, and keep a record of that review - not as a formality, but because it is the evidence a company produces if a regulator or claimant later asks how a decision was made. Include an AI-disclosure rule for anything client-, tenant- or investor-facing, since the EU AI Act's transparency obligations already apply. Require that a model's accuracy on the company's own task types be tested and documented before it is trusted with real work, rather than assumed from its general reputation - see our companion piece on what that testing should actually measure.
Where the real estate-specific risk concentrates
The highest-risk uses in real estate investment are the ones that touch a person's access to housing or credit, not the ones that touch a spreadsheet. Credit and creditworthiness scoring is the clearest example, and it is no longer a theoretical concern in Europe: the Court of Justice's SCHUFA ruling arose because a German credit agency's automated score was being used by lenders to decide, in practice, whether to grant credit - precisely the kind of scoring a real estate lender or investment company's underwriting model performs. Valuation carries a version of the same risk in a less litigated form - a pricing or credit model trained on historical data can quietly encode the same patterns without ever being tested for it. And under the EU AI Act specifically, evaluating the creditworthiness of natural persons is named directly as an Annex III high-risk use case, which puts underwriting workflows many European real estate lenders and investment companies already run through AI squarely inside the regulation's highest compliance tier, on top of the Article 22 GDPR obligations that already apply today.
How to structure it: borrow a framework rather than starting blank
A useful shortcut is to structure the policy around ISO/IEC 42001, the international standard for AI management systems, rather than inventing a governance structure from nothing. ISO/IEC 42001 maps closely onto the EU AI Act's own high-risk provider obligations - a risk management system (Article 9), data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency and instructions for use (Article 13), human oversight (Article 14), and a quality management system (Article 17) - so building the policy against ISO/IEC 42001's structure means a company is working toward the same operational requirements the EU AI Act itself demands of high-risk systems, using a certifiable standard compliance and legal teams - and increasingly, auditors - already recognise.
Who this is for
This matters most for European real estate investment companies, institutional asset managers, private equity funds with commercial real estate exposure, and property managers with EU tenant, borrower, or investor exposure - in practice, nearly every company already using AI for underwriting, tenant screening, lease analysis, or portfolio decisions.
Why it matters now
The EU AI Act's high-risk obligations now apply from 2 December 2027, its transparency obligations already apply, and the Court of Justice's Article 22 interpretation applies today. This is overlapping regulatory pressure, not a single future deadline, and the extra time is best used to build the policy rather than to postpone it. A company that writes its AI policy before a regulator or claimant asks for one has a document it can point to; a company that writes it afterward is explaining a gap. The policy itself has to exist independent of any one tool or vendor. Gaianavia helps companies write and implement it, and its AI Evaluation Framework - model benchmarking and team usage reporting, surfaced to clients in Property Twin - supplies the evidence the policy asks for: which models are approved, on what evidence, and how they are actually being used. More on the About page.