In March 2026 the National Association of REALTORS® released its AI Policy Template for Brokers, a member resource that gives brokerages a way to formalize how AI is used across their operations. The kit includes a twelve-section policy, a glossary of AI terms, an FAQ for agents and staff, and a one-page summary.
It is, by any fair assessment, a serious piece of work. The policy covers governance and oversight, security and data protection, acceptable use, fair housing and advertising compliance, client communication and chatbots, brand integrity, legal and vendor compliance, agent supervision and training, incident response, and enforcement with examples at three levels of severity. It references the NIST AI Risk Management Framework and ISO/IEC 42001:2023, addresses agentic AI, and includes protections for MLS data that reflect how brokerages actually work. The companion glossary even defines "shadow AI." Most trade associations have published nothing comparable. The template gives brokerages a place to start, and starting matters.
But a policy template is not an AI governance program. The distance between the two is where brokerages are most exposed.
The disclaimer says it all
Before getting into substance, read the disclaimer NAR placed on the template:
"NAR is providing the information as a resource only as it does not suggest or require any entity adopt this policy, and no entity may rely on the content as legal advice or a failsafe against legal liability."
NAR, AI Use Policy Template for Real Estate Brokerages, March 2026
Read that again. NAR is telling every brokerage what its AI governance should look like, and in the same breath telling it not to rely on the template for protection.
This is not a criticism of NAR. It is the correct legal posture for a trade association that publishes a template. NAR is not an auditor and does not certify brokerages, and the disclaimer is honest about what the template is and is not.
It does create a problem that brokerages need to understand clearly. Adopting the template, by itself, does not create a defensible position. It creates a starting point that still needs implementation, verification and evidence.
Six gaps the template cannot close on its own
Nothing confirms the policy was put into practice
The template tells a brokerage what its policy should say. It has no way to show whether the policy is being followed. A brokerage can download it, customize it, save it to a shared drive and check the box. If no agent has been trained, no tool has been vetted and no records exist, the policy is a document, not a program.
After an incident, the question will not be "do you have a policy?" It will be "show me that the policy was followed." The template does not create that proof.
Training is required, but not supplied
Section 10 of the policy requires that all agents and staff receive AI training "upon adoption of this policy and at least annually thereafter," covering acceptable use, data protection, fair housing in AI-generated content, advertising rules and incident reporting. NAR does not supply that training, its content, or a way to assess it. A brokerage that follows the requirement to the letter still has to build or buy the training itself, with no guidance on what adequate training looks like.
Tools must be approved, but there is no way to vet them
Section 4 says "only approved AI tools may be used for brokerage business," and requires vendor contracts that prohibit vendors from training models on brokerage or client data. Section 9 adds contract terms on data ownership, retention, deletion and breach notification. Those are the right requirements. But a managing broker who reads them knows an approved list is needed without knowing how to build one. Which questions should go to vendors? What security standards are enough? What counts as adequate due diligence? The template leaves those answers to the brokerage.
Records are expected, but not defined
Section 3 asks brokerages to "maintain audit logs of AI system usage where feasible," and the glossary describes an audit log as a record of inputs, outputs and the user. That is a meaningful requirement. But the template does not say what format the logs should take, how long to keep them, where to store them, or what "feasible" means. For a brokerage with 20 agents, a spreadsheet might be enough. For a brokerage with 1,000 agents across 20 offices, "where feasible" is not an operating instruction. It is an aspiration without a framework.
There is no way to measure where you stand
A brokerage that adopts the template has no rubric, maturity model or benchmark to judge whether its rollout is adequate, minimal or deficient. A broker who has customized the template, trained 10% of agents and vetted two of fifteen tools in use cannot tell whether that is reasonable or dangerously thin. Without measurement, improvement is guesswork.
There is no evidence trail a third party can review
This is the gap that matters most in practice. When a regulator asks about your AI governance, when your errors and omissions carrier reviews your risk, or when opposing counsel asks for documentation after a dispute, the question is not "do you have a policy?" It is "what can you produce?"
Even fully implemented, the template does not produce a structured record that an outsider can review, and it does not include any independent attestation that a firm's governance meets a defined standard as of a given date. The template creates intent. It does not create proof.
The pattern this follows
Real estate has faced this gap before. The Code of Ethics sets professional standards, and Realtor associations enforce them. State license law defines a broker's duties, and license regulators enforce them. Fair housing law defines obligations, and agencies and courts enforce them. In each case, a standard alone is not enough. There is also a way to check that the standard was met.
AI governance is the one area where brokerages now have detailed guidance but no common way to show it was followed. NAR has provided the "what." The "proof" is still up to each brokerage.
What brokerages should do now
If your brokerage does not yet have a written AI use policy, download NAR's template and start customizing it. Doing something is far better than doing nothing.
If you want a defensible position and not just a documented intention, ask four more questions:
- How will we confirm agents actually follow the policy? Training without any check of understanding is hard to enforce. You need to know that agents understood the material, not only that they attended.
- How will we judge AI tools against one consistent standard? An approved list without criteria is a liability. Every tool on it should have a written reason for its approval.
- How will we produce evidence if someone asks? A policy in a shared drive is not evidence. You need records that connect the policy to what people actually did.
- Who will check that our governance is adequate? Self-assessment has limits. A brokerage that wants credibility with clients, regulators and insurers will eventually need someone outside the firm to confirm its governance meets a defined standard.
A free way to start on the third and fourth questions is NIRAP's AI governance gap assessment, which shows where a brokerage's program is weakest.
NAR built the foundation. The brokerages that build on it will have evidence. The ones that stop at the template will have a document.
Sources
- National Association of REALTORS®, AI Policy Template for Brokers (AI Use Policy Template, AI Glossary, Agent & Staff FAQ and One-Pager), March 2026. Member resource at nar.realtor; a public copy of the kit is posted by Bay East Association of REALTORS®.
- National Association of REALTORS®, "Why Every Brokerage Needs an AI Use Policy," REALTOR® News, March 24, 2026.
- National Institute of Standards and Technology, AI Risk Management Framework 1.0 (2023); ISO/IEC 42001:2023.
About NIRAP
The National Institute for Responsible AI Practice is an independent standards and certification body for professional services firms that use AI tools rather than build them. Its brokerage program combines a guided toolkit that your own staff completes, an hour of AI Governance 101 training for everyone who uses AI, and RAICB™ certification, in which a NIRAP assessor reviews your evidence against the V-AGE™ standard.
This article is for general information and is not legal advice. NIRAP offers the certification program discussed here.