Blog
Running AI in a brokerage on solid legal ground: GDPR, EU hosting, DPA and Art. 50 AI Act (2026)
AI in an agency can meet GDPR if personal data is processed in the EU, a DPA exists with the provider, and prospects can tell since 2 August 2026 (Art. 50 AI Act) that they are writing with AI. The office stays the controller; AI takes the operational inbox, not the legal role.
Why the inbox is personal data
An ImmoScout24 or Immowelt message is rarely only “interest in the flat”. It holds a name, contact details, often household size, income, schedule, sometimes notes on children, pets or an employer. Once AI reads the inbox, drafts replies or follows up on forms, it processes personal data under the GDPR.
The office decides purposes and means: which inquiries enter the system, which fields are asked, which appointments appear. The agency therefore stays the controller. The software vendor processes on behalf of the office; the vendor does not take the office’s role toward prospects and supervisors.
Speeding up replies without clarifying the data picture scales the risk. A polite AI reply at 02:14 is operationally right and, under data protection law, the same case as a manual mail at 9 a.m., only visible to more people, at higher frequency.
Three building blocks that are not optional
EU hosting
Personal data should be processed in the European Union. An opaque third-country pipeline without appropriate safeguards is hard for a German office to carry, even if slides promise a “global cloud”. EU hosting makes access, deletion and talking to a supervisor more practical, because the place of processing stays nameable.
Data-processing agreement (AVV/DPA)
Without a DPA, the basis for processing on behalf of the agency is missing. The contract sets which data flows for which purpose, subprocessors, deletion periods, instructions. A link in the terms of service is not a DPA. Before the first connected mailbox, the document belongs in the file, not as a follow-up after an incident.
Transparency toward the prospect
Prospects must understand who they are writing to. An empty autoresponder fakes closeness and does not qualify. AI that pretends the owner is typing at 2 a.m. breaks trust. Since 2 August 2026 a duty under Union law sits on top: Art. 50 of the EU AI Act.
Art. 50 AI Act: disclosure in the first reply
Chatbots and comparable systems must disclose that they are AI. The duty does not hang on the chat widget on a website. Anyone sending AI replies in the portal inbox interacts with people through a system and must mark the AI.
Clean practice: the first reply states that AI is assisting, and there is a path to a human. Hiding it does not save work; it buys an explanation later, internally and toward prospects who feel misled.
Disclosure does not replace care in the substance. No invented property promises, no silent discrimination via opaque filters, logging of cases, escalation to the agent when judgement is required: price, a pet despite a ban, a clash between two prospects, an unclear owner brief.
What qualification may do, and what it may not
Qualification is the minimum information without which a viewing wastes time. Budget or financing, timeline, self-disclosure, property house rules: criteria the listing and the owner letter support. Idle curiosity, questions the exposé already answers, or filters the office cannot legally stand behind do not belong in the catalogue.
Automation makes the same catalogue identical at night and at noon: the benefit and the duty. What the system asks must be explainable. AI may flag contradictions (“looking for 2 rooms but asking about the 5-room house”); who still gets a chance stays with the agent.
The operational flow (connect inbox, assign the property, qualify, book, hand over exceptions) sits in the guide Answering real-estate inquiries automatically. Legally, order does not change who is controller. Organisationally it does: anyone who books viewings first and only then checks financing fills calendars and files with cases the property cannot support.
Three documents before the first mailbox is connected
Not a substitute for legal counsel. An office that lets AI into the inbox should have three items to hand, internally and toward the vendor.
Collect the DPA
Sign the data-processing agreement with the provider and keep it to hand before personal inquiries flow into the system.
Describe data flows
Record internally which data from which channels (portal, email, messenger) goes where, and where it is processed in the EU.
Fix the AI disclosure
Write the wording of the disclosure in the first message and offer a path to a human, in line with Art. 50 AI Act.
Art. 50 AI Act is not a footnote for counsel. The wording of the disclosure changes the visible dialogue. The DPA changes the relationship with the vendor. The data-flow note changes whether the office can answer when a prospect asks what happened to the message.
Service quality and law run in parallel
The DISQ service study shows that about one third of email inquiries to German agents are never answered, and average wait is about 40 hours. Automation closes the leak only if the same care applies as in a manual mail: correct property, no fake promises, filters that can be explained. Sources and figures: Real-estate agents and AI, figures and studies.
Nights without a system leave cases unread. Nights with a system but without a DPA and disclosure let cases grow faster than the office can legally carry. Both are avoidable.
FAQ
Must an agent say in the first message that AI is writing?
Since 2 August 2026, the transparency duties in Art. 50 of the EU AI Act apply. Chatbots and comparable systems must disclose that they are AI. The first reply should name AI assistance and offer a path to a human.
Does an agency need a DPA if AI reads the inbox?
Yes, once a provider processes personal data on behalf of the office. Without a data-processing agreement (AVV/DPA), the legal basis for processing on behalf of the agency is missing.
Is a US server enough if the processor uses standard contractual clauses?
For a German agency, EU hosting remains the clearer path. Third-country transfers need appropriate safeguards; opaque pipelines are a risk that is hard to explain in practice.
Who is the controller under the GDPR: the office or the software vendor?
The agency remains the controller for cases with prospects. The vendor is typically a processor. Technology does not replace the office’s responsibility.
May qualification automatically filter by household income or pets?
Property-specific, explainable criteria from the listing and the owner brief are common. Opaque filters that silently disadvantage people do not belong in the system. The agent decides exceptions.
Does Art. 50 AI Act also cover portal messages, not only website chat?
The duty attaches to systems that interact with people, not to the widget on a website. Anyone sending AI replies in the portal inbox must also disclose the AI.
What it looks like in Realto
Realto is the AI operating system for real-estate agents. In 30 minutes we walk through inbox, qualification and appointments in one flow, no obligation.
Book a demo