Shadow AI in the brokerage, and what to do about it

The white paper in three minutes

Shadow AI is any AI tool used for brokerage business that the brokerage has not reviewed and approved. It almost certainly exists in your firm already, and you answer for what it produces whether or not you knew. The paper argues that banning AI and ignoring it both fail, and it lays out a five-step path that brings AI use into the open.

1. It is about approval, not the tool.

   The same product can be approved in one brokerage and shadow AI in another. A business account with training switched off can be approved, while a free personal account of the same tool is not. So the broker's real question is never "Is ChatGPT allowed?" It is "Which account, for which task, with which data?"

2. It is almost certainly in your firm already.

   In 2026, 97% of brokerage leaders told Delta Media Group that their agents use AI. In NAR's 2025 Technology Survey, ChatGPT topped the list of AI tools agents use, named by 58% of them, and many agents pay for their own technology, which means the brokerage has no contract with the vendor. No survey measures how much of that use is unapproved, but the safe starting assumption is that some of it is.

3. It is mostly a supply problem.

   Consumer tools are free and already on the phone. Agents run their own businesses, workload pressure is real, and many people hide their AI use. In Microsoft and LinkedIn's 2024 study, 52% of AI users were reluctant to admit using it on their most important work. So silence from your agents is not evidence that shadow AI is absent.

4. The broker answers for it in five places.

   The five are AI's built-in flaws with no one checking, client data leaving the brokerage, fair housing, misleading advertising, and records and supervision. Outside real estate, IBM found that one in five organizations it studied had a breach linked to shadow AI, and those breaches cost about $670,000 more on average.

   1 in 5organizations IBM studied linked a breach to shadow AI

   +$670Kaverage added breach cost where shadow AI was widespread

   65%of shadow AI breaches exposed personal information
   IBM and Ponemon Institute, Cost of a Data Breach Report 2025, 600 organizations across industries.

5. Banning it and ignoring it both fail.

   In general workforce surveys, a large share of workers say they would keep using AI even under a ban, so a ban drives use out of sight. Ignoring it leaves the broker with no policy, no approved list and no review standard to point to when a regulator, a plaintiff or an insurer asks what supervision was in place.

The five-step path

1. Find it. Ask everyone which AI tools they use, under a short amnesty so the answers are honest.
2. Sort it. Rank each use by the data it touches and whether its output reaches the public.
3. Approve it. Replace risky consumer tools with approved ones that do the same job.
4. Set the rules. Write the policy, the review standard and the records rule.
5. Keep watching. Repeat the inventory at least twice a year and at every onboarding.