Home AI Finally Has a Rulebook: What a Code of Conduct Means for Your House

Picture a thermostat that notices you are home early and warms the living room before you have your coat off. Pleasant. Now picture that same intelligence deciding, at two in the morning, that the front door should release because a familiar sounding voice asked it to through an open window. The distance between those two moments is not processing power. It is authority, and our trade has written little down about who holds it. That changed in September, and it deserves more attention than it got.

A short document about who is in charge

Josh.ai, a voice and control platform our team deploys in high end homes, published the first edition of a document it calls A Code of Conduct for AI in the Home. It is voluntary, it addresses any AI that can observe, reason about, recommend, automate, or control connected systems in a residence, and it is built on twelve rules. CE Pro covered the release on September 24, 2026 and reported that no other company had adopted it at that point. Josh.ai invites manufacturers, installers, homeowners, and policymakers to sign a public pledge, which the company reviews before listing. CE Pro quoted chief executive Alex Capecelatro saying that the intelligence in a home must always answer to the people who live there.

What struck us is how little of the document is about artificial intelligence and how much is about plumbing, in the engineering sense. These are the rules of a well designed control system, written down as a persuasive new layer is added on top of one.

The control system keeps the keys

The idea doing the most work is what Josh.ai calls the Home Authority Stack, a description of how permission moves through a household. The AI never touches a device directly. It can reason, suggest, and compose an entire evening scene on request, but every instruction passes through the control system, which checks it against the household permissions already in place before any device acts. The AI is a good advisor with no hands of its own.

If you have a properly commissioned Control4 or Lutron system, this is closer to your existing reality than it sounds. Scenes, schedules, keypad bindings, and user profiles already live in the controller, not in whichever app issued the last command. The code insists that the arrangement survives contact with a conversational assistant, and that the limits are engineered deliberately rather than inherited.

Off has to mean off

Two of the twelve rules matter most to the people actually living in the house. A resident can disable the AI entirely, easily, and basic manual control keeps working when they do. And core control runs locally, continuing to function when the internet connection or the cloud model is unavailable.

Those two sentences carry real design consequences. A house whose lighting depends on a remote inference call goes dark in an outage. We keep scenes, schedules, and keypad logic resident on the local controller, and we test the failure case at handover rather than during a February ice storm. Ask your integrator to unplug the modem in front of you. The answer is in what the keypads do next.

Consequence sets the bar

Another rule scales caution to stakes. The more serious or irreversible an action, the more certain the system must be before taking it, and the more likely it should be to ask first. Related rules hold that actions ought to be reversible or safely contained, and that a system uncertain about intent, identity, or outcome should do less and ask rather than guess.

In practice this sorts a house into tiers. Shades, lamps, and music are forgiving, and nobody wants a prompt before dimming a sconce. Door locks, gates, alarm disarming, and water shutoff valves sit in a different category, because a wrong guess is measured in property damage or worse. We draw that line with the client and write it into the permission model rather than leaving it to whatever the assistant feels confident about.

Privacy is a design choice, not a settings tab

The code also asks that systems use the least data necessary, keep household data from outside parties without permission, and ship secure by default with no universal default passwords. That sounds unobjectionable until you look at what regulators have had to pursue.

In May 2023 the Federal Trade Commission and the Department of Justice charged Amazon with violating the Children's Online Privacy Protection Act by retaining children's Alexa voice recordings indefinitely and failing to delete transcripts even after parents asked. Amazon agreed to a twenty five million dollar civil penalty under a proposed court order, with deletion requirements and limits on reusing that data. Samuel Levine, then director of the agency's Bureau of Consumer Protection, said the law does not allow companies to keep children's data forever for any reason, and certainly not to train their algorithms. That case is why we ask vendors where audio is processed, how long recordings and transcripts are kept, and what deletion removes.

Telling a claim apart from a credential

Every manufacturer says its products are private and secure. A handful can point to something an independent party checked, and the distinction is worth learning.

The National Institute of Standards and Technology published its profile of the IoT core baseline for consumer products, NIST IR 8425, in September 2022. It defines six product capabilities, covering asset identification, product configuration, data protection, interface access control, software update, and cybersecurity state awareness, plus four non technical ones covering documentation, information handling, and customer education. Most American device security work borrows that vocabulary.

The Connectivity Standards Alliance, the body behind Matter, built on that foundation with its IoT Device Security Specification 1.0, launched on March 19, 2024 with contributions from nearly two hundred member companies including Amazon, Google, Comcast, and Silicon Labs. It consolidates the most widely used baselines from the United States, Singapore, and Europe into provisions covering unique device identity, no default passwords written into the code, protected storage, secure updates through a published support period, and vulnerability management. Manufacturers submit evidence to an Authorized Test Laboratory, and products that pass may display the Product Security Verified Mark.

Government labeling is moving in parallel. The Federal Communications Commission adopted rules in March 2024 creating the U.S. Cyber Trust Mark, a voluntary program for wireless consumer IoT products in which accredited labs test and approved administrators authorize the label. Its QR code leads to details such as the product's support period and whether security updates install automatically. Britain took the mandatory route instead, with a product security regime effective April 29, 2024 that requires connectable products to avoid shared factory set passwords, publish a route for reporting vulnerabilities, and state their minimum security update period.

For the behavior of the intelligence rather than the device it runs on, the reference point is the NIST AI Risk Management Framework, released as version 1.0 on January 26, 2023 and organized around four functions named Govern, Map, Measure, and Manage. It was written for organizations rather than households, and the Josh.ai code reads very much like that framework translated into language a homeowner can use.

The questions we ask before AI goes in

None of this means a thoughtful homeowner should keep intelligence out of the house. The capability is very good. Josh.ai released its AI X OS platform in June 2026 after a dealer early access program, adding scene recommendations and the ability to build a scene by describing it. That is the kind of moment this industry exists for.

It does mean the evaluation deserves rigor. We ask whether the control system enforces permissions independently of the AI, whether the house still functions with the cloud unreachable, which actions require confirmation and who decided that, where voice and video are processed and how long anything is kept, and whether the manufacturer can point to a specification someone else verified. Those answers are knowable before anything is installed. Asking afterward costs considerably more.

A house that anticipates you is a remarkable thing to live in. A house that overrules you is not. The difference is decided at design time, by people who thought about it on purpose.

If you are planning a system and want the AI and privacy questions pressure tested alongside the equipment list, we can help. Reach us through our contact page or call (781) 506-6008.

Sources

Josh.ai: A Code of Conduct for AI in the Home
CE Pro: Josh.ai publishes AI code of conduct for the smart home industry
CE Pro: Josh.ai officially releases AI X OS
NIST: Profile of the IoT Core Baseline for Consumer IoT Products
NIST: AI Risk Management Framework
Connectivity Standards Alliance: IoT Device Security Specification 1.0
FCC: U.S. Cyber Trust Mark consumer fact sheet
FTC: Amazon charged over children's Alexa voice recordings
UK Government: Regulations on consumer connectable product security