Using AI in Property Management: Compliance Rules for 2026

No federal statute is written for AI in property management. Existing rules apply to the task, not the technology: consent before an AI-voiced call, fair housing limits on ads and replies, adverse action notices when a consumer report informs a decision, and truthful statements to consumers. A few states add disclosure duties, and Colorado enacted a new automated decision law in May 2026 that takes effect January 1, 2027.¹

This article states the rules as of October 13, 2026 and flags what was withdrawn, proposed or changed. The governance model near the end is an operating design, not a legal requirement.

Automated calls and texts: the TCPA

The Telephone Consumer Protection Act and the FCC's rule at 47 CFR 64.1200 restrict calls that use an artificial or prerecorded voice. The rule bars a person from initiating such a call to a cellular number without the called party's prior express consent, absent an emergency or an exemption. A call that includes or introduces an advertisement, or constitutes telemarketing, requires prior express written consent.²

In Declaratory Ruling FCC 24-17 (adopted February 2, 2024, released February 8, 2024), the FCC confirmed that the restrictions on "artificial or prerecorded voice" encompass current AI technologies that resemble human voices or generate call content using a prerecorded voice. The ruling covers voice cloning and allows no carve out for technologies that purport to provide the equivalent of a live agent.³

Two points follow from the rule text. First, the prohibition applies to a person who initiates the call, so an AI voice agent that places rent reminders, lead follow-ups or owner outreach is within the ruling. A call the consumer places to your line is a different situation that the ruling does not address. Second, an artificial-voice message must identify the responsible business at its start.²

A consumer may revoke consent by any reasonable method. A reply of "stop," a keypress opt-out and a voice request all count, and other words count if a reasonable person would understand them as a revocation.² An AI channel therefore has to recognize an opt-out in free text or speech and pass it to every system that calls or texts that number. Consent tiers and opt-out timing are in the TCPA texting guide.

Fair housing: ads, replies and pricing

The Fair Housing Act makes it unlawful to discriminate in the terms, conditions or privileges of a rental, and to publish any notice, statement or advertisement for a rental that indicates a preference, limitation or discrimination based on race, color, religion, sex, handicap, familial status or national origin. Subsection (f) extends the same rule to disability, including refusals of reasonable accommodations.⁴ The statute does not exempt a message because software wrote it. A chatbot reply, a generated listing description or an automated ad audience is a statement or advertisement of the company that publishes it.

HUD's rule at 24 CFR 100.500 allows liability for a practice with a discriminatory effect even without intent. The respondent may defend it by proving it is necessary to achieve a substantial, legitimate, nondiscriminatory interest that a less discriminatory practice could not serve.⁵ The section remains in the October 8, 2026 edition of the Code of Federal Regulations. HUD proposed on January 14, 2026 to remove its discriminatory effects regulations and leave the question to the courts, and it published a supplemental proposal on August 10, 2026.⁶⁷ Neither is final, and the statute is unchanged either way.

Ad delivery. In June 2022 the Department of Justice filed a settlement agreement in the Southern District of New York resolving a Fair Housing Act case against a large social media company. It followed a 2018 HUD complaint alleging that the company's targeting options and delivery processes for housing ads violated the Act. The company stopped using a lookalike-audience tool for housing ads, agreed to build a system that reduces differences between the audience an ad was eligible to reach and the audience that saw it, and paid a $115,054 civil penalty.⁸ The agreement binds only that defendant, but it shows that a delivery algorithm, not only an advertiser's targeting choices, drew a fair housing claim.

Rental pricing. In November 2025 the Department filed a proposed final judgment resolving its antitrust claims against a rental revenue management software provider. As proposed, it bars use of competitors' nonpublic data in runtime pricing, limits model training to data aged at least 12 months and not from active leases, and requires a compliance monitor. The competitive impact statement notes that the amended complaint added six property management companies as defendants.⁹ This is antitrust law, not fair housing law, but it reaches operators that let software set rents. Entry of the judgment should be checked on the docket for No. 1:24-cv-00710 (M.D.N.C.).

HUD's advertising guidance. On April 29, 2024, HUD issued guidance on advertising through digital platforms, saying automated targeting and delivery can violate the Act "without the advertiser's direction or knowledge."¹⁰ On April 6, 2026, HUD published a notice that the guidance was withdrawn effective September 17, 2025. The notice says the documents "should not be relied upon as authoritative" and adds that actions that do not comply with the Act remain subject to enforcement.¹¹ The withdrawal removes an agency interpretation. It does not change section 3604(c). A July 17, 2026 notice also withdrew, effective September 25, 2025, HUD's 2016 guidance on criminal records.¹² See the fair housing guide.

Screening: the FCRA and adverse action

If a person takes an adverse action based in whole or in part on information in a consumer report, the Fair Credit Reporting Act requires notice of the action, the name, address and telephone number of the consumer reporting agency, a statement that the agency did not make the decision, and notice of the consumer's rights to a free report within 60 days and to dispute the information.¹³ The FTC's landlord guidance lists denying an application, requiring a co-signer, a larger deposit and higher rent as adverse actions, and says notice is required even if the report was not the primary reason.¹⁴

The statute does not distinguish between a person and a system taking the action. A tool that scores an applicant from a consumer report, followed by a staff member who applies the score, produces an action based in part on the report. Build the notice into the workflow so that it issues whatever the tool recommends. See the tenant screening guide.

The CFPB withdrew many guidance documents effective May 12, 2025, including Circular 2022-03 on adverse action notices for credit decisions based on complex algorithms and Enforcement Compliance Bulletin 2021-03 on consumer reporting of rental information. The notice states that the withdrawal is not necessarily final.¹⁵ The statutory notice duty was not withdrawn.

The FTC: AI claims and chatbots

Section 5 of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful.¹⁶ On September 25, 2024, the FTC announced actions against companies it said made deceptive claims about AI or used AI to deceive, and quoted then-Chair Lina Khan: "there is no AI exemption from the laws on the books."¹⁷ The FTC reopened and set aside one of those orders on December 22, 2025, citing the administration's AI Action Plan.¹⁸ On July 1, 2026, it proposed a policy statement on AI systems whose outputs are distorted to pursue undisclosed ideological goals. Comments closed July 31, 2026, and the release states a view that Colorado's AI Act is impliedly preempted to the extent it conflicts with a federal scheme.¹⁹ A proposal is not law.

For an operator, the exposure is ordinary deception. A chatbot that says it is a person, quotes a fee the company does not charge, or promises a repair date no one approved has made a company statement. Marketing claims about an AI feature need support the company holds.

State disclosure and automated decision laws

Utah. The disclosure duty is in Utah Code chapter 13-77, not chapter 13-72. Chapter 13-72, the Artificial Intelligence Policy Act, creates the state's AI policy office and is scheduled for repeal on July 1, 2027.²⁰ Under section 13-77-103, a supplier that uses generative AI to interact with an individual in connection with a consumer transaction must disclose that the individual is interacting with generative AI and not a human if the individual clearly and unambiguously asks. The supplier is not subject to enforcement under that section if its AI clearly and conspicuously discloses, at the outset and throughout the interaction, that it is generative AI, is not human, or is an AI assistant (section 13-77-104). Section 13-77-102, as amended in 2026, makes it no defense to a consumer protection violation that generative AI made the statement. An administrative fine can reach $2,500 per violation (section 13-77-105).²¹ The chapter borrows "consumer transaction" from section 13-11-3, which this article does not analyze, so confirm that rental inquiries fall within it.

California. Business and Professions Code section 17941 makes it unlawful to use a bot to communicate with a person in California online, with intent to mislead the person about its artificial identity in order to knowingly deceive the person about the content of the communication and incentivize a purchase or sale of goods or services. There is no liability if the person discloses that it is a bot, and the disclosure must be clear, conspicuous and reasonably designed to inform.²² A plain statement at the start of a chat or text thread satisfies both the Utah safe harbor and the California disclosure.

Colorado. Senate Bill 26-189, signed May 14, 2026, repealed and reenacted the state's earlier AI statute as Colorado Revised Statutes title 6, article 1, part 17. It takes effect January 1, 2027, applies to consequential decisions made on or after that date, and lists the lease or purchase of residential real estate in Colorado as a covered domain. A deployer using covered automated decision-making technology to materially influence a consequential decision must give clear and conspicuous prior notice and, after an adverse outcome, a plain-language description of the technology's role within 30 days. Consumers may seek correction of data and meaningful human review. Records must be kept at least three years, and the attorney general enforces the part, with a 60-day cure period where cure is possible.¹

The definition of consequential decision excludes customer service triage, communication of decisions, advertising and marketing, and use of the technology to summarize, organize or present information for human review where the system produces no score, ranking, recommendation or similar inference that materially influences an outcome. On that text, staff-reviewed call summaries and message drafts appear to fall outside the part, and applicant scoring appears to fall inside it. "Meaningful human review" requires a trained reviewer with authority to approve, modify or override who considers primary evidence and does not default to the system output.¹

Texas. Business and Commerce Code section 552.056, effective January 1, 2026, bars developing or deploying an AI system with intent to unlawfully discriminate against a protected class, and says disparate impact alone does not show intent. The consumer disclosure duty in section 552.051 is imposed on governmental agencies, so it does not reach a private manager.²³

Call recording, transcripts and summaries

Federal law permits a party to a call, or a person with one party's consent, to record it unless the purpose is a criminal or tortious act.²⁴ Some states require every party to consent. California Penal Code section 632 punishes intentionally recording a confidential communication without all parties' consent, with a fine up to $2,500 per violation or up to a year in jail.²⁵ Florida makes interception lawful when all parties have given prior consent.²⁶

These statutes predate transcription tools, and this article cites no court decision on whether a transcription service is a separate recorder, so treat the question as open. Operators in all-party states typically treat any recording or transcript as a recording, give notice at the start of the call and keep a record of the notice. A multistate manager usually applies the strictest rule to every call.

Privacy: owner and tenant data

The California Consumer Privacy Act applies to a for-profit business that does business in California and has annual gross revenue above $25 million (as adjusted), buys, sells or shares the personal information of 100,000 or more consumers or households, or derives 50 percent or more of revenue from selling or sharing.²⁷ The Privacy Protection Agency's automated decisionmaking regulations were approved September 22, 2025 and took effect January 1, 2026.²⁸ They cover technology that replaces or substantially replaces human decisionmaking. Use of an output counts as substantially replacing a human only if the reviewer lacks one of three things: knowledge of how to interpret the output, review of it alongside other relevant information, and authority to change the decision. A "significant decision" includes the provision or denial of housing, except a decision based solely on availability or on receipt of payment. A business using the technology for a significant decision before January 1, 2027 must comply by that date.²⁹

The Texas Data Privacy and Security Act applies to a person that does business in Texas, processes or sells personal data and is not a small business under U.S. Small Business Administration standards. A consumer may opt out of profiling in furtherance of a decision that produces a legal or similarly significant effect,.³⁰

Governance model: NIST framework, approval and logging

NIST published the AI Risk Management Framework 1.0 (NIST AI 100-1) in January 2023. It is voluntary and organizes risk work into four functions: Govern, Map, Measure and Manage.³¹ NIST released a Generative AI Profile (NIST AI 600-1) on July 26, 2024, and its framework page says the framework is being revised as part of the White House AI Action Plan.³² No statute cited here requires it. The model below borrows its four functions.

Govern. Name an owner, and keep an inventory of every tool with what it does, what data it touches, its channels and the states it reaches.

Map. Sort each use into one of three tiers.

Source: author's operating model, built on the rules cited above. It is not a legal requirement.

Never automated. Keep these with a named employee: any adverse decision on an application or on rent or deposit terms; the FCRA notices that follow such a decision; eviction notices and any notice with a legal deadline (see the eviction notice guide); and responses to accommodation and modification requests, including assistance animals (see the assistance animals guide). An AI channel that receives such a request should route it to a person at once and record when it arrived. It should not answer on the merits.

Where a human approves. A person approves any message that states a legal right, amount, deadline or fee, any message about delinquency, any reply to a complaint or repair dispute, and any owner communication about money. Where staff review is meant to count as meaningful human review, the reviewer needs training, the source material and authority to change the result, and the log should show more than a click.

Measure. Test before launch and after each model or configuration change. Run paired test conversations that differ only in details tied to a protected class and compare the outputs. Check that disclosures appear and that opt-out words stop messages.

Manage. For every tier 2 and tier 3 interaction, log the date and time, channel, tool and version, prompt template version, disclosure shown, consent status, output, reviewer and action, and any opt-out. Set retention to the longest period that applies; Colorado sets three years after a covered decision. Review each vendor contract for data use, retention, subprocessors and audit rights, because Utah law treats the company, not the tool, as the speaker.

What to do now

• Inventory every AI use and label each tier 1, 2 or 3.
• Get consent before AI-voiced outbound calls and make sure a spoken or typed opt-out reaches every system.³²
• Add a plain disclosure at the start of chat, text and call interactions that an AI assistant is speaking, and answer "are you a person?" truthfully.²¹²²
• Move all tier 3 decisions to staff and remove any automated denial, notice or accommodation reply.¹³
• Issue adverse action notices whenever a consumer report played any part, whatever the tool recommended.¹³¹⁴
• Test ads and replies for protected-class differences, and confirm no audience selection or generated copy states a preference.⁴
• Send rent-setting software to counsel first if it uses competitors' nonpublic data.⁹
• Give notice of recording and transcription at the start of calls and apply the strictest state rule to all calls.²⁵²⁶
• Plan for Colorado before January 1, 2027 if you lease residential property there, including human review of scored decisions.¹
• Confirm which privacy law applies by revenue and consumer-count thresholds, and map tenant and owner data flows.²⁷³⁰
• Put the review on the calendar. Add quarterly checks to your compliance calendar, because the HUD rule and FTC statement above are proposals and the Colorado law is not yet effective.⁷¹⁹ The tenant lead to lease playbook shows where AI replies sit in the funnel.

This article explains the rules and is not legal advice.