Skip to content
AI Compliance Tool

AI Governance for Real Estate Brokerages

How brokerages should govern AI for lead qualification, listing copy, chat, CRM agents and agent recruitment, with Canadian and US legal touchpoints and a starter inventory.

By AI Compliance Tool editorial team · Published 2026-10-14 · Reviewed 2026-10-14 · Reviewer: Pending independent review · 10 min read

Key takeaways

  • Listing copy and internal drafting are low-obligation uses; lead scoring, chat with the public, CRM agents that send, and AI in recruiting carry elevated obligations because they touch personal data or decisions about people.
  • In Canada, the live rules are PIPEDA and the Alberta, BC and Quebec statutes, plus Ontario ESA s. 8.4 for job postings; there is no federal AI statute in force.
  • In the US, the FTC Act applies to AI claims and chatbots everywhere, and state ADMT laws (Colorado from 1 January 2027, California CCPA ADMT from 1 January 2027) treat housing and employment as consequential decisions.
  • Disclose when a lead is talking to an AI system, and make sure any AI-assisted screening of people has a human review route.
  • Advertising and listing-content rules are set by your real-estate regulator and board; check them before relying on any generated copy or imagery.

Brokerages adopt AI faster than most small businesses because the tools arrive bundled with the CRM, the website and the transaction platform. A 40-agent brokerage can easily be running a dozen AI features it never evaluated: an “AI concierge” on the listing site, automatic lead scoring, generated listing copy, a recruiting funnel that ranks applicants and a CRM agent that sends follow-ups at 7 a.m.

This guide maps common uses to the obligations they carry, lists the Canadian and US touchpoints that apply today, and gives you a starter inventory. It does not cover real-estate advertising or listing-content rules; those come from your regulator and board. Check them directly.

Typical uses and where they sit

UseWhat it touchesObligation levelWhy
Listing copy, social posts, blog draftsProperty facts, public informationLowNo personal data if done right; licensee reviews output; advertising rules are your regulator’s
Internal drafting (emails, summaries, CMAs from public data)Internal, sometimes client personal dataLow to moderateRises when client details or transaction documents are pasted in
Website or listing chatVisitors’ questions, contact details, financial situationElevatedInteracting with the public; collects personal information; disclosure rules
Lead qualification and scoringProspect data, inferred budget, behaviourElevatedShapes who gets service; profiling notice rules in Quebec; ADMT laws in US states where it affects housing decisions
CRM agents that send or updateContact records, outbound messagesElevatedAgent actions; consent for marketing; errors reach real people
Recruiting agents and staffApplicant data, rankingElevated to highEmployment decisions; posting disclosure in Ontario; employment-AI rules in Illinois and NYC; EU high-risk category
Tenant or buyer screening (property management arms)Financial, identity, sometimes sensitive dataHighHousing is a consequential decision in US ADMT laws; automated-decision rules in Quebec and the EU

The pattern: the moment an AI output changes how a particular person is treated, the obligations rise.

Canadian touchpoints

Canada has no federal AI statute in force. Bill C-27, which contained the proposed Artificial Intelligence and Data Act, died when Parliament was prorogued on 6 January 2025. Bill C-36, introduced 15 June 2026, is a privacy bill at an early stage; the government’s release says it would require transparency about automated decision making for significant decisions, but nothing in it is in force. Do not cite either as a current requirement.

What applies now:

  • PIPEDA (federal, and in provinces without a substantially similar law such as Ontario for commercial activity): appropriate purposes (s. 5(3)); accountability including for information sent to processors (Principle 4.1); knowledge and consent (4.3); safeguards (4.7); openness about your practices (4.8); and individual access (4.9). A chatbot that collects a visitor’s budget and timeline is collecting personal information under these principles.
  • Alberta PIPA: responsibility for personal information including with service providers, a designated compliance individual, consent (ss. 5, 7, 8), reasonable security (s. 34) and breach notification to the Commissioner where a real risk of significant harm exists (s. 34.1). The statute has no AI-specific provisions; the OIPC has published comments on responsible AI governance.
  • BC PIPA: designated individual with published contact details, policies and a complaint process (ss. 4, 5), consent that cannot exceed what is necessary (ss. 6 to 8) and reasonable security (s. 34). OIPC BC published “Before you rely on AI: what to know” on 1 September 2026.
  • Quebec Law 25 (P-39.1): published privacy officer (s. 3.1); governance policies (s. 3.2); mandatory privacy impact assessment for any project to acquire or develop an information system involving personal information (s. 3.3), which captures a new CRM AI module; prior notice when using technology that can identify, locate or profile a person, with profiling functions off by default (s. 8.1), which is directly relevant to lead scoring and behavioural tracking on listing sites; and notice, explanation and human review for decisions based exclusively on automated processing (s. 12.1).
  • Ontario Employment Standards Act, 2000, s. 8.4: employers with 25 or more employees that publicly advertise a job posting and use AI to screen, assess or select applicants must say so in the posting (in force 1 January 2026; O. Reg. 476/24 supplies the definitions and the headcount exemption). If your recruiting platform ranks applicants with AI, this is you.
  • Regulator guidance: the federal, provincial and territorial privacy regulators’ joint generative AI principles (December 2023) are guidance, not law, but they describe how regulators read the statutes above: legal authority, appropriate purposes, openness, accountability and the ability to explain outputs that affect people.

US touchpoints

  • FTC Act Section 5 applies to every brokerage marketing to US consumers. Claims such as “our AI finds the perfect home” or “AI-powered valuation accuracy” need substantiation at the time they are made (Operation AI Comply, September 2024; Workado final order, August 2025). The FTC’s July 2026 policy statement on AI accuracy is proposed, not final.
  • Colorado SB 26-189 (signed 14 May 2026, obligations from 1 January 2027) covers automated decision-making technology that materially influences consequential decisions, including housing and employment. Deployers must give clear notice at the point of interaction, provide a plain-language explanation within 30 days after an adverse decision, keep records for three years and honour requests for data access, correction and meaningful human review. If a Colorado brokerage’s property-management arm screens tenants with AI, this applies.
  • California CCPA ADMT regulations (effective 1 January 2026; ADMT significant-decision requirements by 1 January 2027) require pre-use notices, opt-out and access rights for ADMT used in significant decisions, which include housing and employment, for CCPA-covered businesses.
  • Illinois HB 3773 (effective 1 January 2026) prohibits AI with a discriminatory effect in employment decisions, bars zip codes as a proxy for protected classes and requires employee notice. NYC Local Law 144 requires an annual independent bias audit, a public summary and 10 business days’ notice before using an automated employment decision tool. Title VII disparate-impact liability (s. 703(k)) applies to AI hiring tools for employers with 15 or more employees regardless of the vendor.
  • Utah Code 13-75-103 requires disclosure of generative AI in consumer transactions when clearly asked, with a safe harbour for upfront disclosure.
  • Texas TRAIGA (effective 1 January 2026) prohibits AI deployed with intent to unlawfully discriminate or manipulate, and treats a documented risk program such as NIST AI RMF alignment as supporting a reasonable-care presumption. Alignment is not certification.

EU touchpoint

If your chatbot serves EU residents, the EU AI Act Art. 50(1) transparency duty applies from 2 August 2026 and GDPR applies to the personal data; recruitment uses are Annex III high-risk from 2 December 2027. For most North American brokerages a disclosure line and a privacy notice cover the international-enquiry case.

Disclosure practices that work

  1. Chat. First message: “You’re chatting with [Brokerage]‘s AI assistant. A licensed agent can take over at any time; type ‘agent’.” Log that the line was shown.
  2. Lead scoring. Privacy notice section: what signals are used, that scores influence follow-up priority, and how to ask a person to review. In Quebec, give the s. 8.1 notice before profiling features are active and keep them off by default.
  3. Automated follow-up. Emails and texts sent by an agent identify the brokerage and offer an unsubscribe; the inventory records the agent’s autonomy level and the suppression check.
  4. Recruiting. Posting template includes the Ontario s. 8.4 statement where it applies; application flow includes the Illinois or NYC notice where it applies; every AI-ranked applicant pool has a human reviewer who records the review.
  5. Generated media. Internal rule: generated or altered images of a property are labelled as such internally and are only published in line with your regulator’s advertising rules. Check those rules; this guide does not state them.

Starter inventory for a brokerage

NameVendor / tierOwnerPurposeData categoriesAffected peopleJurisdictionsDecision authorityHuman oversightStatusReview dateAgent permissions
Listing-site chatWebsite platform, businessMarketing leadAnswer visitor questions, capture contactCustomer personal; stated budgetPublic, prospectsAB, BC, ON; occasional EURecommends (routes to agent)Agent reviews dailyReview Required2026-11-15Read listings, create CRM lead
CRM lead scoringCRM vendor, businessBroker-ownerPrioritise follow-upCustomer personal; behaviourProspectsAB, BC, ON, QCRecommends; effectively decides for low scoresNone todayReview Required2026-11-15Read CRM, write score field
CRM follow-up agentCRM vendor, businessSales managerSend follow-up email and SMSCustomer personalProspects, past clientsAllAct and report (to be lowered)Weekly log reviewSuspended2026-10-31Read CRM, send email, send SMS
Listing copy draftingModel vendor, teamMarketing leadDraft descriptions from listing factsPublic; property factsNonen/aNoneLicensee reviews allApproved2027-01-15None
Recruiting applicant rankingATS vendor, businessOffice managerRank agent and staff applicantsApplicant personalApplicantsON (25+ employees)RecommendsOffice manager reviews top 20 onlyReview Required2026-10-31Read applications, write rank
Meeting transcriptionExtension, consumer(unassigned)Transcribe client callsClient personal; financial detailsClientsABNoneEach userSuspended2026-10-28Read audio, read calendar

Four of six entries are Review Required or Suspended. That is normal for a first inventory and is the point: the brokerage now knows which entries need a risk assessment, a vendor questionnaire and a disclosure fix before they return to Active.

The next 30 days

Build the inventory, suspend consumer-tier tools that touch client data, add the chat disclosure and lead-scoring notice, send the vendor questions to the CRM and chat vendors, fix posting templates and applicant review, check your regulator’s advertising rules, and calendar 1 January 2027 (Colorado, California) and 2 December 2027 (EU Annex III).

Sources

Frequently asked

Can we use AI to write listing descriptions?
From a governance standpoint it is a low-obligation use as long as a licensee reviews every description for accuracy. Advertising rules for listings come from your real-estate regulator and board; check those rules before publishing generated text or images.
Do we need to tell website visitors the chat is AI?
Yes as a default. EU visitors must be told under AI Act Art. 50(1) from 2 August 2026; Utah requires disclosure when asked; Canadian regulators' generative AI guidance recommends openness. An upfront 'you are chatting with an AI assistant' line costs nothing and avoids the question.
Is lead scoring an automated decision?
It depends on what happens next. If a low score means nobody ever calls, the system is effectively deciding who gets service. Treat scoring that changes how a person is treated as elevated: document it, keep a human review route and check the jurisdiction-specific notice rules.
Does Ontario ESA s. 8.4 apply when we recruit licensed agents who are independent contractors?
The section applies to employers with 25 or more employees advertising publicly advertised job postings. Whether a given recruiting post for contractor agents falls within it is a question for your employment counsel. Record how you decided, and if in doubt include the statement.

This guide is general information, not legal advice. Laws and dates are drawn from our verified regulatory dataset and link to official sources; check them for changes after the review date.