The AI you are probably already running
Most of these arrive as a feature of something you bought rather than as a project anyone called AI. That is exactly why they are missing from the register.
- Arrears and income predictionRanking tenants by likelihood of falling behind. A decision about someone's tenancy, made from their financial history.
- Repairs triage and schedulingPrioritising jobs and routing operatives. Gets safety-critical the moment damp, mould or gas is in scope.
- Allocations and lettings supportAnything influencing who gets housed is a decision about access to a home, and needs a named owner and a human who can overrule it.
- Tenant contact and chatbotsHandling enquiries from people who may be vulnerable, in crisis, or reporting a hazard.
- Vulnerability and safeguarding flagsInferring vulnerability is inferring health data, whether or not anyone described it that way when it was built.
- Asset and stock condition modellingPredicting component failure and investment need across the portfolio.
- Recruitment screeningEmployment decisions are a named high-risk category under the EU AI Act, in every sector.
Why this is harder than generic AI governance
You hold special category data as a matter of routine — health conditions, disability, safeguarding records, vulnerability markers. In most sectors that data is exceptional and handled carefully because it is rare. In housing it is ordinary, which is precisely how it ends up flowing into a model nobody assessed.
The decisions also matter more than the sector's technology budget suggests. An arrears model that ranks the wrong tenant, or a repairs triage that deprioritises the wrong hazard, affects someone's home and safety. That is a different order of consequence from a mis-targeted marketing campaign, and it is why 'we are only using it internally' is not the reassurance it sounds like.
What you get
Owner recorded twice, per system
A business owner and a technical owner against every AI system, because accountability for a tenant-affecting model usually falls into the gap between housing operations and IT.
Data subjects and data types captured
Record what each system touches — tenant records, health and disability detail, safeguarding notes — so a model handling sensitive data is visibly different from one forecasting stock condition.
Shadow AI surveys across services
Send short surveys to repairs, income, lettings and customer contact teams. Responses come back as candidate systems for the register rather than as a spreadsheet someone has to chase.
Lawful basis and DPIA status per system
Both recorded against the system itself, with the gaps visible, instead of living in a folder that gets rebuilt every time someone asks.
Human oversight and kill-switch recorded
For anything influencing arrears, allocations or repairs priority: who can overrule it, and whether it can be stopped quickly.
Action plan with named owners and dates
Gaps become tasks assigned to the person who owns the system, with target dates and completion tracking, exportable for the board pack.
VIVID Homes, a housing association with over 1,000 staff and an award-winning AI programme, uses CXO Ready to keep every AI system inventoried, scored and evidenced.
Used in production
What changes
Every tenant-affecting system, registered
Including the AI features inside housing management and CRM systems you already licence, which is where most of it actually lives.
Special category data flagged per system
So a model touching health or safeguarding data is visibly different from one forecasting stock condition.
Evidence ready before it is asked for
Per-system records of lawful basis, DPIA status, human oversight and who owns the decision, ready before anyone asks.
A board position you can actually present
One page saying how many AI systems you run, which carry material gaps, and what is being done about them.
CXO Ready is an aid, not an assurance. It helps you structure your thinking, record what you have done and see where the gaps are. It does not make you compliant, and nothing it produces is legal advice or a regulatory opinion. Scores are indicative. Responsibility for compliance stays with your organisation, and decisions with legal consequences should be taken with a qualified adviser.
Before you start
Questions from housing associations
What does CXO Ready actually give a housing association?
A single register of every AI system touching tenants, with a business owner and a technical owner against each one, what data it uses, whether a lawful basis and DPIA are recorded, and whether a human can overrule it. Gaps become tasks with named owners and dates, and the whole position exports for a board pack.
Most of our AI came with our housing management system. Does that count?
Yes, and it is the most commonly missed category in this sector. An AI feature inside a system you licensed is still processing tenant data and still influencing decisions. Record it by the use it is put to, not by how it was procured — and note that being a vendor feature does not move accountability to the vendor.
We are not in the EU. Does the EU AI Act matter to us?
Usually not directly, if you house people only in the UK. It is still worth tracking your position against it, because it is becoming the reference framework in UK due diligence and procurement questionnaires, and because it gives you a defensible way to classify systems that UK guidance has not yet defined.
Is predicting tenant vulnerability lawful?
It can be, but it is health-adjacent inference and needs an Article 9 condition, a DPIA, and a genuine route for a human to overrule it. That is a decision for your DPO rather than a setting in a tool. What CXO Ready does is make sure the question was asked and the answer recorded, per system, rather than assumed.
How long does this take with a small digital team?
The first register takes days, not months, and one person can build it. The longer part is surveying operational teams to find what is already in use, which in this sector usually turns up more than expected — particularly in customer contact and repairs.
More in the full FAQ, or ask us directly.
Other sectors