An AI policy template for housing associations should name where AI is used, decide which tenant outcomes are off limits for automation, require human review for significant decisions, and show the board how evidence will satisfy the RSH, the Ombudsman, UK GDPR and Awaab's Law.
The need is no longer theoretical. The National Housing Federation reported in 2025 that 47% of surveyed members were using AI in day-to-day operations, while 87% reported low knowledge of AI and 44% had no AI policy in place (National Housing Federation). A housing association policy has to close that gap without becoming a generic staff handbook.
This checklist supports our wider guide to AI governance for housing association boards and the sector hub for housing association AI governance. Use it as a board paper structure before piloting repairs triage, arrears scoring, complaint summarisation, resident chatbots or any supplier feature that influences service to tenants.
Key takeaways
- A housing association AI policy is a board control, not an IT acceptable-use note.
- The policy should distinguish decision support from automated decision-making before a supplier tool is switched on.
- Tenant-facing use cases need named human authority, retained records, resident explanation routes and regular bias checks.
- The evidence pack should map to the RSH consumer standards, the Housing Ombudsman's Code, Awaab's Law and UK data protection duties.
- A policy that cannot stop or restrict a risky use case is not yet a governance control.
Where the AI policy template for housing associations starts
Start with scope. The policy should cover staff use of public AI tools, Microsoft Copilot-style productivity features, embedded supplier AI and any model that scores, prioritises, summarises or recommends action about a resident, property, complaint, repair, arrears case or allocation.
That scope matters because housing associations often acquire AI indirectly. A repairs platform adds automated triage. A customer-service system introduces response drafting. A finance tool starts flagging arrears risk. The board may not have approved an AI project, but the organisation is already relying on AI-assisted outputs.
The first page of the policy should therefore define four terms in plain English:
- AI system: software that generates, scores, predicts, classifies or recommends using data or prompts.
- Decision support: AI informs a trained person, who remains free and expected to disagree.
- Automated decision: AI determines an outcome without meaningful human involvement.
- High-impact housing decision: any decision that can affect a resident's safety, home, tenancy, complaint rights, financial position or access to services.
The policy should then state the board's default position: AI may support staff, but it must not make or silently determine high-impact housing decisions unless the board has approved the use case, the data protection assessment, the resident route to human review and the evidence pack.
Board decisions the policy must settle
The policy is not finished until the board has answered six questions. They are practical decisions, not values statements.
- Which resident outcomes are never left to a system alone?
- Which AI uses need board approval, executive approval or local manager approval?
- Who owns the complete register of AI uses, including supplier systems?
- What records must be kept so a repair, complaint or arrears escalation can be reconstructed?
- How will residents be told that AI has been used in a decision-support process?
- When must a use case be paused, withdrawn or reported to the board?
The Regulator of Social Housing's consumer standards Code of Practice, published on 1 April 2024, says responsibility for delivering the standards lies with provider boards and councillors, and that providers must deliver all outcomes of the standards (RSH consumer standards Code of Practice). That is the correct board frame for the policy: technology choices are operational, but assurance over tenant outcomes is a board matter.
The policy should make one committee accountable for oversight. In most associations, that is the board, audit and risk committee, or a resident services committee with a formal reporting route to the board. The committee should receive a quarterly AI register summary covering live uses, proposed uses, incidents, complaints, overrides, bias checks and supplier assurance gaps.
Controls and evidence to request
A template is useful only if it tells managers what evidence to produce. The controls below are the minimum package for a housing association policy.
| Policy clause | Evidence the board should require | Usual owner |
|---|---|---|
| AI register | List of every approved and suspected AI use, including supplier features, owner, purpose, affected residents and review date | Company secretary or risk lead |
| Use-case approval | Short assessment setting out resident impact, data used, expected benefit, failure mode, equality risk and exit route | Executive sponsor |
| Human authority | Named role with authority to change the outcome before enforcement, refusal, escalation or closure | Service director |
| Data protection | DPIA where profiling or automated decision-making risk is present, lawful basis, privacy notice text and retention period | Data protection officer |
| Resident explanation | Plain-language explanation of what the system does, what data it uses, who can review the case and how to contest the outcome | Customer services lead |
| Testing and monitoring | Accuracy checks, sample reviews, bias testing, false-negative review and post-deployment monitoring | Risk, data or service owner |
| Complaint and repair record | Complete audit trail showing inputs, output, human review, reasons, timestamps and final action | Complaints or repairs lead |
| Supplier assurance | Contract clauses for audit access, model changes, data use, incident reporting, subcontractors and termination | Procurement and legal |
The ICO's rights guidance for automated decision-making and profiling points to practical controls that fit this table: a lawful basis, a DPIA for new automated decision-making or profiling, additional checks for vulnerable groups, a simple way to ask for reconsideration, identified staff who can change decisions, and regular checks for accuracy and bias (ICO automated decision-making rights). The ICO's AI and data protection guidance also frames fairness, individual rights, security and data minimisation as core AI governance questions (ICO AI and data protection guidance).
For repairs and complaints, the policy should add a record rule: if AI influenced a tenant outcome, the record must show enough for a manager, resident, board member, regulator or Ombudsman to understand the decision without asking the supplier to recreate it.
Framework and regulator mapping
The policy should not list frameworks for decoration. Each framework should tell the board what evidence to ask for.
| Regime or framework | What it means for the policy | Evidence test |
|---|---|---|
| RSH consumer standards | AI use in repairs, safety, transparency or tenancy services must support outcomes the provider is already required to deliver | Can the board show assurance over every tenant-facing use case? |
| Housing Ombudsman Code | Complaint handling remains the landlord's responsibility, even where AI drafts, sorts or summarises material | Can the complaint file show the issue, reasoning, evidence, response and learning? |
| Awaab's Law | AI must not delay recognition, investigation or action on significant damp, mould or emergency hazards | Does every report still reach the statutory process and a human owner? |
| UK GDPR and ICO guidance | Profiling and automated decisions need lawful basis, fairness, transparency, rights handling and monitoring | Can a resident understand, challenge and obtain human review where required? |
| ISO 42001 and NIST AI RMF | Management-system thinking turns policy into governance, roles, risk assessment, measurement and improvement | Is the policy linked to a register, risk process, metrics and review cycle? |
The Housing Ombudsman's Complaint Handling Code has been statutory since April 2024, and its 2024 Code requires annual self-assessment, governing-body scrutiny and publication of the governing body's response (Housing Ombudsman Complaint Handling Code). A policy that lets a complaint response be drafted by AI without recording the facts checked, the human sign-off and the reasons given will weaken the file the Ombudsman expects to see.
Awaab's Law has a sharper trigger. The government guidance says the social rented sector requirements apply from 27 October 2025 to emergency hazards and significant damp and mould hazards, with later phases in 2026 and 2027, and says social landlords should create internal policies with the right governance and oversight to support consistent application (Awaab's Law guidance). An AI damp and mould model may rank risk, but the policy must be clear that a tenant report starts the landlord's process. The model does not stop the clock.
For a fuller cross-sector structure, use our UK AI governance framework guide. For sector boards, the test is simpler: can the association explain which controls attach to each resident-impacting system, and can it prove they worked?
Common mistakes in policy adoption
The most common mistake is treating the policy as a communications exercise. Staff are told not to paste personal data into public tools, the board notes the policy, and supplier systems continue untouched. That leaves the highest-risk uses outside the document.
A second mistake is relying on human review without defining it. Human review is not a manager glancing at a recommendation after the letter has been sent. It means a trained person has the information, authority and time to change the outcome before the resident is affected. The ICO's explanation guidance includes responsibility, data, fairness, safety, performance and impact explanations as part of explaining AI-assisted decisions (ICO explaining AI decisions).
A third mistake is approving a tool but not the operating model. A repairs triage model is not governed by an accuracy slide. It needs threshold rules, vulnerability checks, override rights, sampling, failure reporting and a route for staff to say the model is wrong.
A fourth mistake is letting the AI register become stale. The policy should require procurement, digital, risk, data protection and service leaders to update the register when systems are bought, upgraded or switched on. Supplier release notes should be treated as governance evidence, not background reading.
A fifth mistake is measuring only productivity. The board should ask for resident-impact metrics: complaint quality, repair escalation accuracy, false negatives in hazard triage, arrears support outcomes, override volumes and unequal outcomes across resident groups where lawful and proportionate to assess.
Next step: test the policy against real use
Take one live or planned use case and run it through the policy before approving the wording. Repairs triage is usually the best test because it touches safety, vulnerable residents, contractor hand-offs, supplier data and complaint records. If the policy cannot explain that use case, it is not ready for easier ones.
For a fast first draft, use the AI Policy Generator, then adapt the output to the housing-specific controls above. For a board-level view of exposure, complete the Board AI Scorecard. If your board needs an independent assessment against the consumer standards, Awaab's Law, the Ombudsman and UK data protection expectations, the AI governance diagnostic is the fuller route.
Sources: National Housing Federation AI in housing evidence · RSH consumer standards Code of Practice · ICO automated decision-making rights · ICO AI and data protection guidance · Housing Ombudsman Complaint Handling Code · Awaab's Law guidance · ICO explaining AI decisions
