White paper · Guided tour

Shadow AI in the brokerage, and what to do about it.

The question is not whether your agents use AI. It is whether you know how they are using it. Eleven short scenes, ending with a self-check you can score.

About 7 minutesUse the arrow keys, the buttons, or swipeFrom NIRAP, October 2026

01 · The definition

Shadow AI is about approval, not about the tool.

Shadow AI is any AI tool used for brokerage business that the brokerage has not reviewed and approved. NAR's AI glossary defines it the same way and says it raises security, compliance, fair housing and liability risks.

ApprovedBusiness account, training switched off, under a vendor contract

Same product

Shadow AIFree personal account, default settings, no contract

So the question is never "Is ChatGPT allowed?" The question is "Which account, for which task, with which data?"

NAR, AI Policy Template for Brokers and AI Glossary, March 2026.

02 · What it looks like

It usually looks ordinary, and helpful.

What someone does

Why it is shadow AI

Pastes a seller's disclosure into a free chatbot to summarize it

Client and transaction data went into a tool the brokerage never vetted

Writes listing descriptions in a personal AI account

Public advertising was drafted outside any review process

Uses a browser extension that rewrites emails

The extension can read every email it touches

Records buyer consultations with a transcription app

Client conversations sit with a vendor that has no contract with the brokerage

Stages photos with a free image generator

Altered images may misrepresent the property and lack required disclosure

Asks a chatbot to estimate a home's value for a client

A valuation reached the client with no record of how it was produced

Shadow AI is not the same as misconduct. Most of these people are trying to work faster and serve clients well, and it is not limited to agents, because coordinators and marketing staff handle the same data.

03 · How common it is

Assume it is already in your firm.

97%of brokerage leaders say their agents use AI (Delta Media, 2026)

68%of REALTORS® have used AI in their business (NAR, 2025)

58%of agents named ChatGPT among their top AI tools, a general consumer product (NAR, 2025)

24%of agents spend more than $500 a month on technology, often with no brokerage contract (NAR, 2025)

No published survey measures how much brokerage AI use is unapproved. What the data does show is that AI use is common, consumer tools dominate it, and agents pay for many tools themselves.

Delta Media Real Estate AI & Leadership Survey, 2026; NAR 2025 Technology Survey (1,241 responses, July 2025).

04 · The incentives

Shadow AI is mostly a supply problem.

Free and on the phoneA consumer chatbot opens in seconds. An approved tool behind a request form loses every time.

Agents run their own businessesMany do not think of their marketing tools as the broker's business at all.

Workload pressure68% of workers say they struggle with the pace and volume of their work.

People hide it52% of AI users were reluctant to admit using it on their most important tasks.

So silence from your agents is not evidence that shadow AI is absent. A broker who supplies a good approved option and a clear rule removes most of the reason to go around it.

Microsoft and LinkedIn, 2024 Work Trend Index (31 countries, not real estate).

05 · The exposure

The broker answers for it in five places.

1Built-in flaws, uncheckedHallucination, sycophancy and bias are in approved tools too. Approved use comes with a review step. Shadow use usually does not.

2Client data leavesUnapproved tools may store prompts, lack deletion guarantees and create records outside your control.

3Fair housing"Perfect for young families" is a prohibited example in NAR's template. The law applies whoever wrote the ad.

4Misleading advertisingStaged photos and invented features are advertising problems, and the agent answers for the whole listing.

5Records and supervisionA client email sent from a personal AI app may never reach the files you are required to keep.

NAR AI Policy Template for Brokers and Agent & Staff FAQ, March 2026; 42 U.S.C. §3604(c).

06 · When data leaks

Outside real estate, the cost is already measured.

1 in 5organizations IBM studied attributed a breach to shadow AI

+$670Kaverage added breach cost where shadow AI was widespread

65%of shadow AI breaches exposed personal information, against 53% of all breaches

One everyday reason: personal ChatGPT accounts include a setting that lets conversations be used to train OpenAI's models. An agent who has never opened that setting has never switched it off.

IBM and Ponemon Institute, Cost of a Data Breach Report 2025 (600 organizations, all industries); OpenAI Help Center, "Data controls in ChatGPT."

07 · The duty you already have

You answer for it whether or not you knew.

State license law already makes the broker answerable for agents' work. Texas is a clear example, and other states have their own versions. Under 22 TAC §535.2:

a

Responsible for sponsored agents

The broker is responsible for the authorized acts of sponsored sales agents.

e

Delegation does not end responsibility

Supervision can be delegated in writing, but overall responsibility stays with the broker.

i

Written policies are required

The broker must keep written policies that make agents follow advertising rules and keep records.

h

Records must be kept

Substantive communications with parties, and comparative market analyses, must be kept for at least four years.

A point that needs care. No court or regulator has yet published a decision that turns on a brokerage's shadow AI. This exposure is NIRAP's reading of existing duties applied to a new tool, not a ruling.

08 · The easy responses

Banning it and ignoring it both fail.

Switch between the easy responses and the path the paper recommends.

The useWhat happens to AI use?

Result

A ban moves it out of sight. In general workforce surveys, from about a fifth to nearly half of workers, depending on the sector, say they would keep using AI under a ban.

It comes into the open, because the approved way is also the easiest way.

The riskWhat happens to the risk?

Result

It stays, and agents become less likely to report a mistake.

Each use is known, sorted by risk and done in an approved tool.

The recordWhat can you show if asked?

Result

Nothing. No policy, no approved list and no review standard.

An inventory, an approved tool register, review records and training records.

The ban figures come from a general workforce survey of 2,001 US and UK employees (TrustedTech), not real estate, and they measure stated intentions rather than behavior.

09 · The path

Five steps, run in a loop.

1Find itInventory every tool under a 30-day amnesty

2Sort itBy the data in and where the output goes

3Approve itName a replacement for every "no"

4Set the rulesPolicy, review standard, records rule

5Keep watchingTwice a year and at every onboarding

HighClient personal or financial data, transaction documents or MLS data, going anywhere.Move to an approved tool now, or stop.

MediumNo client data, but the output goes public: listings, ads, client emails.Allow in an approved tool, with human review first.

LowNo client data, internal use only: brainstorming, generic research.Allow, with no special review.

The tiers follow the structure of NAR's one-pager. The three-tier labels are NIRAP's simplification.

Shadow AI in the brokerage, and what to do about it.

Shadow AI is about approval, not about the tool.

It usually looks ordinary, and helpful.

Assume it is already in your firm.

Shadow AI is mostly a supply problem.

The broker answers for it in five places.

Outside real estate, the cost is already measured.

You answer for it whether or not you knew.

Responsible for sponsored agents

Delegation does not end responsibility

Written policies are required

Records must be kept

Banning it and ignoring it both fail.

The useWhat happens to AI use?

The riskWhat happens to the risk?

The recordWhat can you show if asked?

Five steps, run in a loop.

Could you answer these with a record?