Aipedia: Estate and letting agents

AI tenant referencing and automated rejection

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

A letting agent can use AI to reference tenants, but a solely automated decision to reject an applicant is a significant decision that needs safeguards under UK GDPR Articles 22A to 22D. Referencing decides whether someone gets a home, so errors and bias matter.

Part of: AI in estate and letting agents

In short

Referencing platforms can score affordability, verify income from open banking data, read payslips and flag risk. Some return an automatic pass or fail. Since 5 February 2026, UK GDPR Articles 22A to 22D, inserted by the Data (Use and Access) Act 2025, require safeguards for solely automated significant decisions: information about the decision, a way to make representations, human intervention and a right to contest. Agents also handle sensitive financial data under TPO Code 1h and data protection law. Poorly designed models can produce discriminatory outcomes. Complaints, data protection claims and landlord claims for bad tenant selection can follow.

How agents use AI in referencing

Tenant referencing used to mean phone calls to employers and previous landlords. Now applicants complete an online form, connect a bank account, upload documents and receive a result within hours. AI reads payslips and bank statements, categorises income and spending, checks identity documents and produces a score or recommendation. Some agents set rules so that applicants below a threshold are declined without a person looking at the file.

The same tools are sometimes used to rank several applicants for one property, which raises the stakes further.

An important question is whether a person genuinely reviews the outcome. If a negotiator simply forwards whatever the platform decides, the decision may still be solely automated in practice. Real human involvement means someone with authority looks at the file, can change the result and sometimes does. Agents should also be clear about who makes the final decision: the agent, the referencing provider or the landlord. That allocation affects who owes the safeguards and who an unhappy applicant or landlord will pursue.

The duties that apply

UK GDPR Articles 22A to 22D: safeguards for solely automated decisions with legal or similarly significant effects, including Article 22C safeguards: information, representations, human intervention and contest. In force from 5 February 2026 under SI 2026/82.
TPO Code 1h: do not use confidential information for any purpose other than that for which it was given. The Code also requires data protection compliance.
Equality law: a model that relies on proxies for protected characteristics can produce indirect discrimination.
RICS AI standard: for RICS-regulated agencies, a risk register, reliability decisions and advance written client disclosure.

What can go wrong

Self-employed, gig-economy or benefit income misread or ignored, leading to automatic rejection.
A model that penalises postcodes or employment types that correlate with protected characteristics.
No route for an applicant to ask for a human review.
Document checks that pass forged payslips.
Financial data kept longer than needed or shared with third parties beyond the purpose given.

Illustrative: a letting agent uses a platform that automatically declines applicants whose verified income falls below a set multiple of rent. The tool fails to read a disabled applicant's benefit income, and the applicant is declined without review. The applicant complains about the decision and the lack of any way to challenge it. Separately, a landlord whose tenant was passed despite forged payslips claims rent arrears from the agent.

How PI usually responds

A landlord's claim that the agent negligently referenced a tenant will usually be considered under the agent's PI policy, subject to the wording. Applicant claims are more mixed: discrimination claims and data protection claims may be treated differently, and regulatory fines are commonly excluded or limited. Some PI policies include limited cover for data protection liabilities, while others leave it to a cyber policy; see GDPR and data breach cover within PI. Propertymark sets higher minimum PI limits for firms doing lettings or management.

Practical controls

Map where your referencing process makes a solely automated decision.
Tell applicants when automated decisions are used and how to ask for a human review.
Have a named person review every decline before it is final.
Ask the provider how it tests for bias and handles non-standard income.
Agree with landlords in writing what referencing you do and do not carry out; see telling landlords you use AI.
Set retention periods for financial data.

How Apex helps: Apex arranges PI for letting agents and can review how your cover treats referencing and data claims. See AI in estate and letting agency, AI lettings compliance tools and AI AML and ID checks.

Sources

Frequently asked

Can a letting agent reject tenants automatically?

It is possible, but a solely automated rejection is a significant decision. Under UK GDPR Articles 22A to 22D, in force since 5 February 2026, the applicant must be told, be able to make representations, obtain human intervention and contest the decision.

Is a referencing provider responsible for its own errors?

The provider may be liable to you under its contract, depending on the terms. The landlord and applicant will usually look to the agent first, so review the provider contract and your own PI wording together.

Does the Data (Use and Access) Act ban automated referencing?

No. It replaced the old Article 22 with Articles 22A to 22D, which allow many automated decisions subject to safeguards. Check what data your provider processes and where in your process a person actually reviews the result.

Will PI cover a discrimination claim from an applicant?

It depends on the wording. Some PI policies exclude discrimination or employment-type claims, and some limit data protection cover. Ask a broker to review how your policy treats claims from people who are not your clients.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.