AI IMPLEMENTATION
Shadow AI Is Already In
Commercial Real Estate.
Are You Governing It?
BY MICHAEL MULLIN
Shadow IT required a purchase. Shadow AI requires a paste. That distinction may be one of the most important technology issues commercial real estate( CRE) executives need to understand as artificial intelligence( AI) moves into everyday operations.
For years, companies worried about employees purchasing software or subscribing to cloud applications without involving IT. There was usually some friction— a purchase, installation, credit card, or approval. AI has removed that friction. An employee can open a browser, upload a document, paste information into a prompt, and receive an answer within seconds. IT may never know it happened.
And commercial real estate has plenty of information employees may be tempted to give AI. A property manager might use AI to summarize a tenant issue. An asset manager could upload operating results for a variance analysis. Accounting might use it to reconcile a spreadsheet. A leasing professional could paste sections of a lease into AI and request a summary. These are understandable uses of AI. They can also create risks many CRE organizations haven’ t addressed.
SHADOW AI VS. SANCTIONED AI
Shadow AI is when employees use artificial intelligence tools without organizational review, approval, or oversight. Employees generally aren’ t trying to circumvent company policy. They’ re trying to get their jobs done faster.
Sanctioned AI is different. The organization determines which tools employees can use, what information they can enter, how company data is protected, and where human review is required.
That distinction matters in CRE because organizations possess enormous amounts of potentially sensitive information: leases, tenant records, banking information, investor reports, property financials, vendor contracts, employee records, and confidential acquisition and disposition documents.
The most important question isn’ t which AI tool employees use. It’ s what information they’ re giving it. Using AI to improve the wording of a generic tenant notice is very different from uploading a rent roll. Brainstorming marketing ideas is different from uploading confidential acquisition documents.
START WITH AN AI AUDIT
Before writing another data security policy or attempting to prohibit AI, determine what’ s actually happening.
An effective AI audit should answer four questions:
1. What AI tools are employees using? Include standalone platforms, browser extensions, and AI capabilities embedded within existing applications.
10 ProtectMyIT. com