Is AI tenant screening high-risk under the EU AI Act?

It depends on what the tool actually does, because Annex III never mentions tenant screening. A tool that evaluates an applicant's creditworthiness or establishes their credit score can fall under Annex III, point 5(b), which does not say the user must be a lender. Whether a landlord's rent-affordability or payment-risk score counts as "creditworthiness" is genuinely unsettled. AI that a public authority, or a body acting on its behalf, uses to decide who gets social or public housing has a stronger case under point 5(a). A tool that ranks applicants from their social media may be outside Annex III and still run into the Article 5(1)(c) ban on social scoring.

This is an information service to help you orient, not legal advice. To see the obligations that attach to your own AI use, answer three questions about it.

Your situation at a glance

Your situation	High-risk?	Why (article / annex point)
Landlord or letting agency uses an AI score of an applicant's payment risk or rent affordability	Unsettled	Annex III, point 5(b) covers evaluating "the creditworthiness of natural persons". The term is not defined, and both readings are arguable (see below)
The tool pulls credit-bureau data and outputs a credit score	Probably yes	Point 5(b) also covers AI intended to "establish their credit score". The point names no particular user
A public housing authority uses AI to decide eligibility for, or allocate, social housing	Probably yes	Point 5(a): use by or on behalf of public authorities to evaluate eligibility for essential public assistance benefits and services. Recital 58 names "social and housing assistance"
Identity check by matching a selfie to the applicant's ID document	Not under point 1(a)	Point 1(a) excludes biometric verification whose sole purpose is to confirm a person is who they claim to be
The tool ranks applicants by profiling their social media	Not via Annex III unless it scores creditworthiness, but check Article 5	No Annex III point covers general "tenant suitability". Article 5(1)(c) can prohibit it outright if its conditions are met
A human decides, and the AI only flags missing documents	Unlikely	Probably not an evaluation of creditworthiness at all. If it were, Article 6(3)(a), a narrow procedural task, is a reasonable fit

The legal test, point by point

Article 6(2) makes the AI systems referred to in Annex III high-risk. Housing appears in none of its eight areas by name, so a tool is only high-risk if it fits a listed use case. What counts is the provider's intended purpose, which Article 3(12) ties to the instructions for use, promotional or sales materials and technical documentation.

Point 5(b): creditworthiness and credit scores

Point 5(b) lists "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud".

Two things matter. It names no user: unlike point 5(a), limited to use "by public authorities or on behalf of public authorities", point 5(b) does not require the user to be a credit provider. And "creditworthiness" is not defined anywhere in the Act.

Recital 58 of the original 2024 text gives the reason for the listing: "AI systems used to evaluate the credit score or creditworthiness of natural persons should be classified as high-risk AI systems, since they determine those persons' access to financial resources or essential services such as housing, electricity, and telecommunication services."

It says credit scores matter because they gate access to housing; it does not say a landlord's own tenant assessment is a creditworthiness evaluation. That leaves two readings, and neither is settled law.

• The broad reading. A score of whether a person can and will pay rent is an evaluation of their ability to meet a financial obligation, which is what creditworthiness means in ordinary language, and Recital 58 shows the legislator had housing in mind. On this reading, an AI payment-risk or affordability score is a point 5(b) system.
• The narrow reading. Creditworthiness is about credit: whether to lend to someone. A tenancy is not a loan. Recital 58 mentions housing as a downstream effect of credit scores, which is a reason to regulate credit scoring, not an extension of it. On this reading, a tenant-suitability score that does not evaluate creditworthiness as such is outside point 5(b).

The closer a tool comes to a classic credit assessment (credit-bureau data, default prediction), the harder the narrow reading is to run, and a tool that outputs a credit score fits the second limb, "establish their credit score", whoever buys it. Two smaller open points: if a landlord only receives a score in a credit-bureau report, the text does not say whether it is a "deployer" using the bureau's system "under its authority" (Article 3(4)); and whether forged payslips are "financial fraud" within the point 5(b) exception is unclear (Recital 58 frames the exception around fraud "in the offering of financial services").

Point 5(a): social and public housing

Point 5(a) covers "AI systems intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for essential public assistance benefits and services, including healthcare services, as well as to grant, reduce, revoke, or reclaim such benefits and services".

Recital 58 names "social and housing assistance" among those services. AI that a municipal housing authority uses to decide eligibility for social housing, or waiting-list rank, is a strong candidate. Open edges: whether every public-housing allocation is "public assistance", and whether a private or non-profit housing provider acts "on behalf of" an authority. The answer can differ by Member State.

Point 1: biometrics

Point 1(a) covers remote biometric identification systems, but "shall not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be". Matching a selfie to the applicant's ID is that kind of one-to-one check. A feature that reads an applicant's emotions would instead bring in point 1(c), emotion recognition.

The other points

Points 2 to 4, 5(c), 5(d) and 6 to 8 (infrastructure, education, employment, insurance, emergency calls, law enforcement, migration, justice) do not describe tenant screening. Article 7 lets the Commission add use cases within the existing areas by delegated act; the consolidated text of 27 July 2026 contains no housing use case. The Commission's Article 6 guidelines were published only as a draft, for consultation, on 19 May 2026; we have not found an adopted version.

Article 6(3), and why profiling closes it

A point 5(a) or 5(b) system can escape the high-risk label under Article 6(3) if it does not pose a significant risk of harm to health, safety or fundamental rights and meets one of four conditions, such as a narrow procedural or preparatory task.

But the last subparagraph is absolute: an Annex III system "shall always be considered to be high-risk where the AI system performs profiling of natural persons". Article 3(52) borrows the GDPR definition (Article 4(4)), which covers automated evaluation of personal aspects, in particular to analyse or predict a person's "economic situation", "reliability" or "behaviour". A rent-payment score is hard to describe as anything else, so for a scoring tool the derogation is effectively closed. For a document-checklist assistant it is open, and a provider that relies on it must document the assessment (Article 6(4)) and register the system in the EU database (Article 49(2)). See when an Annex III system is not high-risk.

Article 5: the social-scoring ban

Some features may be prohibited outright. Article 5(1)(c) bans AI systems "for the evaluation or classification of natural persons or groups of persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics", where the social score leads to either or both of:

• (i) detrimental or unfavourable treatment "in social contexts that are unrelated to the contexts in which the data was originally generated or collected"; or
• (ii) detrimental or unfavourable treatment that is "unjustified or disproportionate" to the social behaviour or its gravity.

A tool that scores applicants on what they post on social media, and is used to turn them away from a flat, fits condition (i) uncomfortably well. But the ban needs both elements: an evaluation over a period of time based on social behaviour or personal characteristics, and a score leading to (i) or (ii). Whether a given tool meets them depends on the facts. Recital 31 says the ban should not affect lawful evaluation practices carried out for a specific purpose under Union and national law, so a conventional rent-history check is unlikely to be its target.

Article 5(1)(g) separately bans biometric categorisation that deduces or infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. Both prohibitions have applied since 2 February 2025 (points (ba) and (bb), added by the Omnibus, apply only from 2 December 2026), and under Article 99(3) breaches carry fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. See prohibited AI practices.

If it is high-risk: who does what, and when

When. The Digital Omnibus on AI (Regulation (EU) 2026/1744) amended Article 113. Chapter III, Sections 1, 2 and 3 apply to Annex III systems from 2 December 2027.

Providers (whoever develops the tool and places it on the market under its own name) carry the main load: the Section 2 requirements, a quality management system, a conformity assessment (internal control under Annex VI, Article 43(2)) and registration. An agency that builds its own model is both provider and deployer, and under Article 25(1)(c) a deployer that repurposes a general-purpose AI system so that it becomes a high-risk tenant scorer becomes a provider.

Deployers (the landlord, agency or housing body using the tool) must follow the instructions for use, assign competent human oversight, monitor the system, keep the logs under their control for at least six months and, under Article 26(11), inform applicants that a high-risk system is being used on them. Whether a private individual letting a single flat acts "in the course of a personal non-professional activity", which Article 3(4) excludes from the definition of deployer, is not settled. See deployer obligations under Article 26.

Fundamental rights impact assessment. Article 27(1) requires one, before deploying the system, from three groups of deployers: bodies governed by public law, private entities providing public services, and deployers of systems referred to in points 5(b) and (c). A housing authority falls in the first group; a private landlord using a point 5(b) system falls in the third. Recital 96 names housing among the areas where private entities provide public services. Public-authority deployers must also register their use (Article 49(3)). For the lending parallel, see credit scoring and creditworthiness AI.

What applies regardless

• AI literacy (Article 4). In force since 2 February 2025. Providers and deployers must take measures to support the AI literacy of staff who use the system. As amended, it does not require a guaranteed level for any individual. See the AI literacy duty.
• Chatbots (Article 50(1)). In force since 2 August 2026. If applicants talk to an AI assistant, the provider must design it so they are told they are interacting with an AI system, unless that is obvious. See transparency obligations.
• GDPR, a separate regime. Article 22 GDPR, outside the AI Act, gives a person the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, subject to the exceptions in Article 22(2). It can matter whatever the AI Act classification.

What to do now

1. Classify each feature separately, and treat any score of ability to pay as a possible point 5(b) system. Until the meaning of creditworthiness is clarified, planning on the broad reading is the cautious choice.
2. Check every feature against Article 5 now, starting with anything that scores social-media behaviour. The social-scoring ban is already in force.
3. Public and social housing bodies: assume point 5(a), and plan the fundamental rights impact assessment and the database registration.
4. Plan for 2 December 2027, and if you claim Article 6(3) for a narrow tool, confirm it does not profile anyone and document the assessment.

For the general test, see is your AI system high-risk?. To get a weekly email of verified changes to these rules, join the waitlist.

The official text is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. This article is an information service to help you orient — it is not legal advice.