Data Integrity: A View from the Regulator

This was the first time the Regulator of Social Housing (RSH) had been asked to speak to the HAILIE network. Amanda's central message was simple: a clean dataset is not the same as a trustworthy one. As automation and AI shorten the distance between a data point and a decision, providers need to show that their data holds up from source to decision, and they need to tell the regulator when it does not.

1. Data quality and data integrity are linked but separate

Amanda said organisations often treat data quality as a technical exercise: correct the fields, clean the records, and that's it. That is only part of the picture. Data quality asks whether the data is fit for its immediate purpose: accurate, complete, timely, valid and consistent. "How many homes do we own?" needs an accurate, regularly updated answer.

Data integrity goes further. It asks whether you can trust the data from the moment it is created or acquired right through to the decision it informs. The regulator thinks about it in three dimensions:

2. Why it matters more than ever

Data used to be used once, in one spreadsheet or report. Now it is linked across systems, combined with other data, used to make investment decisions and used to give boards assurance. The chain the regulator wants to see is:

Trusted data→Governed analysis→Contextual intelligence→Judgement

The question for a dashboard is no longer "do we have a number?" It is whether you understand where that number came from, what it means, how it connects to other information, and whether you should rely on it.

The issues are not new. What has changed is the speed at which an organisation can move from a data point to a decision:

• More automated: AI and workflow tools can create patterns, recommendations and actions before anyone has challenged the underlying evidence.
• More connected: homes, tenants, repairs, complaints and finance are interpreted together. Individual records can look reasonable while a broken link distorts the overall judgement.
• Higher consequence: when evidence is reused across services, one weak record can influence many decisions and assurances.

Automation does not remove the need for controls and assurance. It makes them more important. In Amanda's words: the faster the decision, the stronger the need for ownership, controls, lineage and challenge.

3. Poor data becomes poor delivery

Amanda gave six areas where weak integrity turns directly into weak services:

4. What causes poor data integrity

The causes usually combine technology, process, accountability and capability.

Amanda said she sees capability and culture as probably the biggest cause, because it sits at the heart of how an organisation views data. Technology can help. Replacing a system will not, if the other things are not in place.

5. Two case studies

Amanda presented two anonymised examples drawn from the regulator's work. The names are pseudonyms.

6. The cost to regulation and to the sector

When returns arrive at the regulator they go through cleaning, queries, reconciliation and engagement, often over several rounds. Amanda said that, repeatedly, what looks like a possible compliance issue turns out to be a data quality or integrity issue. That costs regulatory time and slows down prioritisation, intervention and assurance. Providers that understand their own lineage and governance get issues resolved faster.

The damage also spreads beyond one provider. Unreliable data creates a chain of false confidence:

1. Incorrect evidence: different methods, incomplete scope or an uncorrected error.
2. Distorted benchmarking: peers compare themselves against a number that is not like-for-like.
3. Misallocated action: targets, investment or scrutiny are aimed at the wrong issue.
4. Poor delivery and loss of trust: tenants, providers and investors question published insight and regulatory judgement.

7. What the regulator expects

Continued poor quality and a lack of end-to-end integrity is "not simply a data problem, it's a governance problem". The regulator expects providers to:

On ownership, Amanda was specific: name senior people responsible for particular data rather than "we own it corporately", plan for what happens when a data owner leaves, and rationalise data points that have no owner and no use. A data quality programme corrects individual records. A governance response improves integrity.

When the regulator's concern increases

Not every data error carries the same weight. Concern grows when these features come together:

• Repeated weakness: the same issues recur across returns, operational systems or board reporting, suggesting root causes are not being addressed.
• Weak control environment: ownership is unclear, checks are absent, audit findings stay open, or improvements are not sustained.
• Unreliable assurance: the board cannot show that decisions and claims are based on robust, comprehensive evidence.

Concern is highest when weaknesses are persistent, widespread, known but unresolved, undisclosed, and disconnected from credible executive and board oversight.

The data integrity cycle

Amanda shared the cycle the regulator is using to improve its own data integrity:

1. Knowyour information and where weaknesses exist.
2. Ownthe data and the associated risk, with named senior owners.
3. Controlcreation, amendment and use. Understand lineage and keep it secure.
4. Assurethe organisation that controls are effective, and test them.
5. Disclosematerial weaknesses and limitations to your board and to the regulator.
6. Improvethe underlying systems and processes, then start again.

8. "Tell us"

Amanda's closing message: tell the regulator if you have a data concern, if you have made an error in a return, or if data quality or integrity problems have affected decision-making. A data concern is useful intelligence in itself. Early disclosure helps the regulator tell the difference between:

• a known, controlled weakness
• a capability or systems problem
• a failure of oversight or assurance
• a potential underlying delivery concern.

9. From the Q&A

How do we give our board assurance on data integrity?

Amanda acknowledged this is hard: it is easy to say data is accurate if you don't understand what is wrong with it. Her advice:

• Change how data is presented. Boards see numbers on dashboards without knowing what sits behind them. Where you know a data point is weak, new or in a pilot phase, say so.
• Have an open discussion about how you govern data, not just "we've got this". How are data owners defined? How are senior teams made responsible for quality and control?
• Map your data flows, at least as evidence for yourselves. Where are the flash points where data is likely to be mismanaged, mismatched or corrupted? Make sure the board knows that work is happening and is continuous.

Will the regulator set data standards and definitions?

Attendees raised the risk of benchmarking errors when definitions differ, and asked whether the sector should adopt its own data standards. Amanda said Tenant Satisfaction Measures are far better defined, and comparability features in the regulator's recent discussion document on data-driven regulation. After a decade of co-regulation the regulator has stepped back from being prescriptive and is now weighing that balance. She could not promise a set of data standards covering everything the regulator collects. Sector-led standards are a live discussion, and the regulator is looking at existing standards and adoption across the sector. What she could say is that it is thinking about how to support a consistent understanding across the sector.

What about providers rushing into AI on poor data?

The concern is the same as for poor data integrity generally, but the risk of a downstream problem is growing. AI, automation and advanced modelling, especially in black-box scenarios, amplify that risk. "AI is linking stuff really quickly and if you haven't got those linkages correct AI is not going to know that." Amanda said the regulator has seen this itself: AI assistant outputs that looked wrong turned out to reflect unclear source information.

Smaller providers and frontline culture

A smaller provider (around 2,000 homes) described limited administrative capacity and a culture that rightly values people skills over data tasks. Amanda said the regulator is going through the same shift. Digital and data have been "in a cupboard down the corridor for years". Her aim is to put them in the middle of the open-plan office as enablers for the whole business, and to build data literacy from the basics, such as how to read and present a chart. That matters more as AI produces outputs faster.

What if regulatory metrics don't fit how we deliver?

One provider explained that its same-day repairs service does not fit neatly into regulatory reporting boxes. Amanda's response: come and talk to us. The regulator needs a core set of comparable metrics but wants to understand their limitations, whether that means changing a definition, an explicit exclusion or, reluctantly, another metric. "The last thing the regulator wants to do is stifle innovation."

Is the regulator optimistic or pessimistic about AI?

"It depends on what day you ask me." AI could be revolutionary for the sector, and there will be growing expectations to generate value from new technology. The worries are bias in AI models, unverified assumptions and the amplification of poor data integrity. Her challenge to everyone, the regulator included: AI needs to be the appropriate solution to the problem you are trying to solve, not a catch-all remedy.

Will the regulator take a position on AI?

Amanda could not give a definitive answer while the regulator reviews its future approach and government expectations develop. For now, its view of AI is outcome-focused and technology-agnostic. If providers can show that AI results are fair, proportionate and improve outcomes for tenants, investment and supply, the regulator is comfortable, in the same way it does not dictate staffing levels or technology choices. Providers are expected to deliver the same quality of service and fair treatment of tenants through AI as through any other means.

What this means for AI in housing

HAILIE's reading of the session, for teams planning or running AI work:

• Put an integrity check in every AI business case. Before automating, ask which records the tool will link and whether those links are reliable. The AI Experiment Template and DPIA template are good places to record this.
• Know the lineage of what you feed the model. If you cannot say where an input came from and who owns it, the output inherits that uncertainty, faster.
• Keep a human challenge step where outputs feed decisions about safety, rent or vulnerable households.
• Be ready to evidence outcomes. The regulator will judge AI by whether results are fair and proportionate and improve outcomes, so measure that from the start.

Next steps from the session

• Disclose data concerns: tell the regulator about data concerns, errors in returns, or cases where integrity issues affected decisions.
• Explain metric limitations: where regulatory metrics do not capture how you deliver, such as same-day repairs, explain why to the regulator.
• Keep the dialogue going: the regulator is reviewing sector feedback from its recent consultations and wants to keep talking with data practitioners through HAILIE, HACT and other industry bodies.

Sources and contact

• Amanda Hall, Data Quality and Integrity: It's not just an IT problem, Regulator of Social Housing, presentation to HAILIE, 9 October 2026.
• Regulator of Social Housing on GOV.UK
• To contact the regulator about a data concern: enquiries@rsh.gov.uk or 0300 124 5225.

This writeup is HAILIE's summary of the talk and Q&A, prepared from the slides and session notes. It is not an official statement of regulatory policy. The section "What this means for AI in housing" and the board questions are HAILIE's own suggestions.