AI for property managers in Spain: real uses that save time (and the ones that don't)

AI saves a property manager time when it reads and sorts: it classifies emails and incidents by building and urgency, drafts replies and meeting minutes from your notes, extracts invoice data and answers routine questions from owners, passing the rest to a person. It should not decide or send anything important on its own. And because you process data on behalf of each owners' community, you need its authorisation to use an AI provider.

What AI does well in a property management office

In Spain, an administrador de fincas (property or community manager) runs the comunidad de propietarios, the owners' community of a building divided into flats. An office like that receives a lot of text: emails from residents, messages with photos of a leak, supplier invoices, notes from the last owners' meeting. AI is useful for reading that text, putting it in order and preparing drafts. The decisions stay with you.

Use	What AI does	What you do	If it fails
Sorting emails	Suggests the building, type and urgency	You correct the ones that do not fit	A misfiled email, which you spot when reviewing
Creating incidents	Pulls the building, location and problem out of the message	You decide and assign a contractor	An incident with incomplete details
Draft replies	Writes using the community's documents	You review and send	A wrong detail, if you do not review
Draft minutes	Puts your notes into the structure the law requires	You check attendees, shares and votes	Minutes with errors that need correcting
Routine questions	Answers what is in the documents and passes on the rest	You handle what it passes on	A made-up answer, if it is not limited to the documents
Invoice data	Extracts the supplier, tax ID, amounts and building	You approve the payment	A misread amount
Inspections	Nothing: dates and a rule are enough	You enter the dates	An alert that never arrives if the date is wrong

1. Sorting emails and turning them into incidents

Start with rules, because they are predictable: if the sender is already in your database, the email goes to their community. AI comes in for everything else. It reads the message and suggests three things: the community (from the address mentioned), the type (breakdown, query about a bill, meeting, paperwork, supplier) and the urgency (water, a lift out of service, lighting in common areas).

If the message reports a fault, the system can prepare the incident: community, block and flat, affected area, description and attached photos. The acknowledgement to the resident is best kept as fixed text, not generated: "We have received your report, reference number 123". That way there are no surprises.

Urgent matters must not sit in a queue. Set a rule so that anything that sounds like water, fire or a stuck lift reaches a person immediately. Spain's Horizontal Property Act (Ley de Propiedad Horizontal, LPH), the law that governs owners' communities, gives the administrator the job of looking after the upkeep of the building and arranging urgent repairs, reporting them immediately to the community president (art. 20). That decision is yours, not the system's.

This is what we built Incidents for: every incident from every building on one board, with the person in charge, the contractor and the days open. A property management firm in the province of Alicante has used it daily since July 2026. And Unanswered-mail alerts sends you a daily summary of customer emails still waiting for a reply in each Microsoft 365 mailbox.

2. Draft replies that you review

Many questions are answered by a document: "when was the special levy approved?", "what was agreed about the awnings?". AI can search that community's minutes, budget and contracts and draft the answer. You review it and send it.

Two tips to make it get things wrong less often. Ask it to cite the document and the point each detail comes from, and to say "I can't find it" when it cannot find it. These are two of the techniques Anthropic recommends to reduce made-up answers, and even so it warns that they do not remove them entirely (Anthropic). Microsoft says the same of its Copilot: its responses are not 100% guaranteed and should be checked before you send them (Microsoft Learn).

Mind the permissions too. Copilot only shows the data the user has permission to see, according to the same Microsoft page. If you have a shared folder with every community mixed together, the assistant may mix them up as well. The AEPD (Spain's data protection authority) warns about this risk: using the same agent for different processing activities without separating their data can end up disclosing one group's data to third parties (AEPD, agentic AI). One community, one space.

3. The minutes: AI organises, you check

The Horizontal Property Act sets out what the minutes of every owners' meeting must state, at a minimum (art. 19.2):

1. The date and place.
2. Who called the meeting and, where relevant, the owners who requested it.
3. Whether it is an ordinary or extraordinary meeting, and whether it is held at the first or second call.
4. All attendees and their roles, the owners represented and their participation shares.
5. The agenda.
6. The resolutions, with the names of those who voted for and against and their shares, where this matters for the resolution to be valid.

That list is your template. AI can put your notes into that structure and word the resolutions consistently. What you have to check by hand are points 4 and 6: names, shares and votes. That is where an error matters. If you also record the meeting to transcribe it, remember that a voice recording is personal data and that you must inform attendees when you collect it (GDPR, art. 13).

The minutes are closed with the signatures of the president and the secretary when the meeting ends or within the following ten calendar days (art. 19.3). Nobody signs a draft without reading it. If you want to go over the notice periods for calling the meeting, they are in owners' meeting notice period in Spain.

4. Routine questions from owners, with handover to a person

An assistant can answer what is the same for every resident and is in the documents: the emergency repairs number, the date of the next meeting, how to request a certificate of outstanding fees, or which company maintains the lift. Everything else goes to a person:

• Anything about the debt or data of a particular owner, and always after checking that the person asking is that owner.
• Complaints, disputes between neighbours and legal questions.
• Anything it cannot find in the documents.

INCIBE (Spain's national cybersecurity institute) puts it simply: an AI should never communicate with customers on its own about a sensitive matter (INCIBE, September 2026).

Tell residents they are talking to an automated assistant. Since 2 August 2026, the EU AI Act requires that anyone interacting with an AI system knows it, unless it is obvious (Regulation (EU) 2024/1689, art. 50.1; dates in the Commission's timeline). The obligation falls on the provider, but the regulation treats as a provider anyone who has a system developed and puts it into service under their own name or trademark (art. 3.3).

If the assistant runs on WhatsApp, WhatsApp's business policy requires that the recipient has given you their number and permission to receive your messages. And if you automate replies, you must offer clear, direct ways to reach a person (WhatsApp Business Messaging Policy).

And one red line: the assistant never gives out other owners' data. The AEPD's view is that, as a general rule, posting the list of owners who owe fees on the noticeboard is not covered by data protection law. The route the law provides is to include those in arrears in the notice calling the meeting (AEPD, guide for property managers).

5. Data from supplier invoices

Every invoice must show, among other details, its number and series, date, the issuer's name and NIF (Spanish tax ID), address, description, tax rate and tax amount (Royal Decree 1619/2012, art. 6). Those are the fields AI extracts from each PDF or scan, along with the community it belongs to.

Then simple rules check what the AI has read:

1. The tax ID matches the one for the supplier you have on file.
2. The net amount plus tax equals the total.
3. There is no other invoice with the same number from the same supplier.
4. The amount fits the approved quote.

Anything that fails one of the four checks goes to a person. And you always approve the payment: making payments is the administrator's job (LPH, art. 20.d), and INCIBE insists that an AI should not authorise a payment on its own.

6. Inspection reminders: no AI needed here

A community's inspections have fixed dates: lift, gas, fire protection, the building report. They are explained in mandatory building inspections in Spain. To get reminders in time, a calendar and a rule are enough. At most, AI can read the date on a scanned certificate for you to confirm. That is what Renewals does: email alerts every morning before something expires.

What is best not to automate

1. Decisions about owners in arrears and debt claims. Neither the list nor the tone of a claim should leave a system without you looking at it.
2. Sending minutes or notices to the whole community. An error is multiplied by every resident, and the minutes need the signatures of the president and the secretary.
3. Payments and ordering works. They are your job and your responsibility.
4. Complaints and disputes between neighbours. They need judgement and tact.
5. Health data. If an owner mentions their disability to request accessibility works, that is health data, a special category whose processing is prohibited except in certain cases (GDPR, art. 9 and recital 35). The AEPD's Lab proposes that AI uses involving health data require prior authorisation or be banned (AEPD Lab).
6. An agent that reads your inbox and replies on its own. The AEPD uses this very example to explain its "rule of 2": if an agent receives emails with no safeguards, has access to sensitive information and acts automatically, that is a setup that should not be allowed. An email can carry hidden instructions that the agent obeys (AEPD, agentic AI, pp. 41 and 42).

Data protection in an owners' community: what changes when you use AI

According to the AEPD's sector guide, which the agency itself marks as under review, the owners' community is the data controller and the administrator who manages it on its behalf is the processor. That relationship must be set out in a contract, and the administrator may only process the data on the community's instructions (AEPD, guide for property managers).

When you bring in an AI provider, that provider processes the community's data on your behalf. It is a sub-processor. The GDPR says the processor shall not engage another processor without the controller's prior specific or general written authorisation, and that under a general authorisation it must report any changes so the controller can object (GDPR, art. 28.2). The AEPD guide gives subcontracting cloud services as an example of general authorisation.

In practice:

1. Review your processing contract with each community. Check whether it includes a general authorisation for sub-processors.
2. Tell the community which AI provider you are going to use, and about any change later on.
3. Use a business account with a contract. The AEPD's Lab reminds you that a free account is not the same as a business account with guarantees (AEPD). On their business plans, Microsoft, Google, OpenAI and Anthropic say they do not train their models on your data by default.
4. Send only what is needed. If the paragraph about the fault is enough, do not send the resident's history.
5. Update your record of processing activities. The AEPD guide says that both communities and administrators must keep their own.
6. No automated decisions with effects on an owner. The GDPR recognises the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects (art. 22).
7. Train whoever uses it. Since 2 February 2025, anyone using AI in their business must take AI literacy measures for their staff (Regulation (EU) 2024/1689, art. 4). The July 2026 reform turned this into measures to support that training, with no set level required of each person (Regulation (EU) 2026/1744).

How to get started in your office

1. Pick a single workflow. A good candidate is emails into incidents: there is a lot of volume and a mistake is quickly corrected.
2. Measure for a week. How many emails come in and how long it takes you to sort them. The savings calculation, with your own numbers, is in how to automate business processes with AI.
3. Sort out the paperwork. Processing contracts, sub-processor authorisation, a business account with the provider.
4. Run it in draft mode for two to four weeks. The system suggests and you decide. Note every error.
5. Decide with data. If the sorting is accurate enough, move on to the next use: draft replies and, after that, the minutes.

You will find more examples of what can be automated in a property management office under automation for property managers and AI solutions.

Sources

• Law 49/1960 on Horizontal Property (in Spanish), arts. 19 and 20.
• Royal Decree 1619/2012, Invoicing Regulation (in Spanish), art. 6.
• Regulation (EU) 2016/679 (GDPR), recital 35 and arts. 9, 13, 22 and 28.
• Regulation (EU) 2024/1689, the Artificial Intelligence Act, arts. 3.3, 4 and 50.1.
• Regulation (EU) 2026/1744 (digital omnibus on AI), which amends art. 4.
• European Commission, AI Act application timeline.
• AEPD, Data protection and property management (sector guide, under review, in Spanish).
• AEPD, Agentic artificial intelligence from a data protection perspective, v1.2, February 2026 (in Spanish).
• AEPD Lab, "Prompts, personal data and confidentiality", 25 August 2026 (in Spanish).
• INCIBE, "The human factor in cybersecurity for SMEs and the self-employed", 3 September 2026 (in Spanish).
• WhatsApp Business Messaging Policy.
• Anthropic, "Reduce hallucinations".
• Anthropic Privacy Center, is my data used for model training?.
• OpenAI, "Data controls in the OpenAI platform".
• Microsoft Learn, "Data, Privacy, and Security for Microsoft Copilot".
• Google Workspace, Generative AI Privacy Hub.