AI Governance for Real Estate Brokerages
How brokerages should govern AI for lead qualification, listing copy, chat, CRM agents and agent recruitment, with Canadian and US legal touchpoints and a starter inventory.
By AI Compliance Tool editorial team · Published 2026-10-14 · Reviewed 2026-10-14 · Reviewer: Pending independent review · 10 min read
Key takeaways
- Listing copy and internal drafting are low-obligation uses; lead scoring, chat with the public, CRM agents that send, and AI in recruiting carry elevated obligations because they touch personal data or decisions about people.
- In Canada, the live rules are PIPEDA and the Alberta, BC and Quebec statutes, plus Ontario ESA s. 8.4 for job postings; there is no federal AI statute in force.
- In the US, the FTC Act applies to AI claims and chatbots everywhere, and state ADMT laws (Colorado from 1 January 2027, California CCPA ADMT from 1 January 2027) treat housing and employment as consequential decisions.
- Disclose when a lead is talking to an AI system, and make sure any AI-assisted screening of people has a human review route.
- Advertising and listing-content rules are set by your real-estate regulator and board; check them before relying on any generated copy or imagery.
Brokerages adopt AI faster than most small businesses because the tools arrive bundled with the CRM, the website and the transaction platform. A 40-agent brokerage can easily be running a dozen AI features it never evaluated: an “AI concierge” on the listing site, automatic lead scoring, generated listing copy, a recruiting funnel that ranks applicants and a CRM agent that sends follow-ups at 7 a.m.
This guide maps common uses to the obligations they carry, lists the Canadian and US touchpoints that apply today, and gives you a starter inventory. It does not cover real-estate advertising or listing-content rules; those come from your regulator and board. Check them directly.
Typical uses and where they sit
| Use | What it touches | Obligation level | Why |
|---|---|---|---|
| Listing copy, social posts, blog drafts | Property facts, public information | Low | No personal data if done right; licensee reviews output; advertising rules are your regulator’s |
| Internal drafting (emails, summaries, CMAs from public data) | Internal, sometimes client personal data | Low to moderate | Rises when client details or transaction documents are pasted in |
| Website or listing chat | Visitors’ questions, contact details, financial situation | Elevated | Interacting with the public; collects personal information; disclosure rules |
| Lead qualification and scoring | Prospect data, inferred budget, behaviour | Elevated | Shapes who gets service; profiling notice rules in Quebec; ADMT laws in US states where it affects housing decisions |
| CRM agents that send or update | Contact records, outbound messages | Elevated | Agent actions; consent for marketing; errors reach real people |
| Recruiting agents and staff | Applicant data, ranking | Elevated to high | Employment decisions; posting disclosure in Ontario; employment-AI rules in Illinois and NYC; EU high-risk category |
| Tenant or buyer screening (property management arms) | Financial, identity, sometimes sensitive data | High | Housing is a consequential decision in US ADMT laws; automated-decision rules in Quebec and the EU |
The pattern: the moment an AI output changes how a particular person is treated, the obligations rise.
Canadian touchpoints
Canada has no federal AI statute in force. Bill C-27, which contained the proposed Artificial Intelligence and Data Act, died when Parliament was prorogued on 6 January 2025. Bill C-36, introduced 15 June 2026, is a privacy bill at an early stage; the government’s release says it would require transparency about automated decision making for significant decisions, but nothing in it is in force. Do not cite either as a current requirement.
What applies now:
- PIPEDA (federal, and in provinces without a substantially similar law such as Ontario for commercial activity): appropriate purposes (s. 5(3)); accountability including for information sent to processors (Principle 4.1); knowledge and consent (4.3); safeguards (4.7); openness about your practices (4.8); and individual access (4.9). A chatbot that collects a visitor’s budget and timeline is collecting personal information under these principles.
- Alberta PIPA: responsibility for personal information including with service providers, a designated compliance individual, consent (ss. 5, 7, 8), reasonable security (s. 34) and breach notification to the Commissioner where a real risk of significant harm exists (s. 34.1). The statute has no AI-specific provisions; the OIPC has published comments on responsible AI governance.
- BC PIPA: designated individual with published contact details, policies and a complaint process (ss. 4, 5), consent that cannot exceed what is necessary (ss. 6 to 8) and reasonable security (s. 34). OIPC BC published “Before you rely on AI: what to know” on 1 September 2026.
- Quebec Law 25 (P-39.1): published privacy officer (s. 3.1); governance policies (s. 3.2); mandatory privacy impact assessment for any project to acquire or develop an information system involving personal information (s. 3.3), which captures a new CRM AI module; prior notice when using technology that can identify, locate or profile a person, with profiling functions off by default (s. 8.1), which is directly relevant to lead scoring and behavioural tracking on listing sites; and notice, explanation and human review for decisions based exclusively on automated processing (s. 12.1).
- Ontario Employment Standards Act, 2000, s. 8.4: employers with 25 or more employees that publicly advertise a job posting and use AI to screen, assess or select applicants must say so in the posting (in force 1 January 2026; O. Reg. 476/24 supplies the definitions and the headcount exemption). If your recruiting platform ranks applicants with AI, this is you.
- Regulator guidance: the federal, provincial and territorial privacy regulators’ joint generative AI principles (December 2023) are guidance, not law, but they describe how regulators read the statutes above: legal authority, appropriate purposes, openness, accountability and the ability to explain outputs that affect people.
US touchpoints
- FTC Act Section 5 applies to every brokerage marketing to US consumers. Claims such as “our AI finds the perfect home” or “AI-powered valuation accuracy” need substantiation at the time they are made (Operation AI Comply, September 2024; Workado final order, August 2025). The FTC’s July 2026 policy statement on AI accuracy is proposed, not final.
- Colorado SB 26-189 (signed 14 May 2026, obligations from 1 January 2027) covers automated decision-making technology that materially influences consequential decisions, including housing and employment. Deployers must give clear notice at the point of interaction, provide a plain-language explanation within 30 days after an adverse decision, keep records for three years and honour requests for data access, correction and meaningful human review. If a Colorado brokerage’s property-management arm screens tenants with AI, this applies.
- California CCPA ADMT regulations (effective 1 January 2026; ADMT significant-decision requirements by 1 January 2027) require pre-use notices, opt-out and access rights for ADMT used in significant decisions, which include housing and employment, for CCPA-covered businesses.
- Illinois HB 3773 (effective 1 January 2026) prohibits AI with a discriminatory effect in employment decisions, bars zip codes as a proxy for protected classes and requires employee notice. NYC Local Law 144 requires an annual independent bias audit, a public summary and 10 business days’ notice before using an automated employment decision tool. Title VII disparate-impact liability (s. 703(k)) applies to AI hiring tools for employers with 15 or more employees regardless of the vendor.
- Utah Code 13-75-103 requires disclosure of generative AI in consumer transactions when clearly asked, with a safe harbour for upfront disclosure.
- Texas TRAIGA (effective 1 January 2026) prohibits AI deployed with intent to unlawfully discriminate or manipulate, and treats a documented risk program such as NIST AI RMF alignment as supporting a reasonable-care presumption. Alignment is not certification.
EU touchpoint
If your chatbot serves EU residents, the EU AI Act Art. 50(1) transparency duty applies from 2 August 2026 and GDPR applies to the personal data; recruitment uses are Annex III high-risk from 2 December 2027. For most North American brokerages a disclosure line and a privacy notice cover the international-enquiry case.
Disclosure practices that work
- Chat. First message: “You’re chatting with [Brokerage]‘s AI assistant. A licensed agent can take over at any time; type ‘agent’.” Log that the line was shown.
- Lead scoring. Privacy notice section: what signals are used, that scores influence follow-up priority, and how to ask a person to review. In Quebec, give the s. 8.1 notice before profiling features are active and keep them off by default.
- Automated follow-up. Emails and texts sent by an agent identify the brokerage and offer an unsubscribe; the inventory records the agent’s autonomy level and the suppression check.
- Recruiting. Posting template includes the Ontario s. 8.4 statement where it applies; application flow includes the Illinois or NYC notice where it applies; every AI-ranked applicant pool has a human reviewer who records the review.
- Generated media. Internal rule: generated or altered images of a property are labelled as such internally and are only published in line with your regulator’s advertising rules. Check those rules; this guide does not state them.
Starter inventory for a brokerage
| Name | Vendor / tier | Owner | Purpose | Data categories | Affected people | Jurisdictions | Decision authority | Human oversight | Status | Review date | Agent permissions |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Listing-site chat | Website platform, business | Marketing lead | Answer visitor questions, capture contact | Customer personal; stated budget | Public, prospects | AB, BC, ON; occasional EU | Recommends (routes to agent) | Agent reviews daily | Review Required | 2026-11-15 | Read listings, create CRM lead |
| CRM lead scoring | CRM vendor, business | Broker-owner | Prioritise follow-up | Customer personal; behaviour | Prospects | AB, BC, ON, QC | Recommends; effectively decides for low scores | None today | Review Required | 2026-11-15 | Read CRM, write score field |
| CRM follow-up agent | CRM vendor, business | Sales manager | Send follow-up email and SMS | Customer personal | Prospects, past clients | All | Act and report (to be lowered) | Weekly log review | Suspended | 2026-10-31 | Read CRM, send email, send SMS |
| Listing copy drafting | Model vendor, team | Marketing lead | Draft descriptions from listing facts | Public; property facts | None | n/a | None | Licensee reviews all | Approved | 2027-01-15 | None |
| Recruiting applicant ranking | ATS vendor, business | Office manager | Rank agent and staff applicants | Applicant personal | Applicants | ON (25+ employees) | Recommends | Office manager reviews top 20 only | Review Required | 2026-10-31 | Read applications, write rank |
| Meeting transcription | Extension, consumer | (unassigned) | Transcribe client calls | Client personal; financial details | Clients | AB | None | Each user | Suspended | 2026-10-28 | Read audio, read calendar |
Four of six entries are Review Required or Suspended. That is normal for a first inventory and is the point: the brokerage now knows which entries need a risk assessment, a vendor questionnaire and a disclosure fix before they return to Active.
The next 30 days
Build the inventory, suspend consumer-tier tools that touch client data, add the chat disclosure and lead-scoring notice, send the vendor questions to the CRM and chat vendors, fix posting templates and applicant review, check your regulator’s advertising rules, and calendar 1 January 2027 (Colorado, California) and 2 December 2027 (EU Annex III).
Sources
- PIPEDA: https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-1.html and Schedule 1: https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-7.html
- Alberta PIPA: https://kings-printer.alberta.ca/documents/Acts/P06P5.pdf
- OIPC Alberta AI resources: https://oipc.ab.ca/resources/ai/
- BC PIPA: https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/03063_01
- OIPC BC resources: https://www.oipc.bc.ca/resources/
- Quebec P-39.1 (ss. 3.1, 3.2, 3.3, 8.1, 12.1): https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1
- Ontario ESA, 2000 s. 8.4: https://www.ontario.ca/laws/statute/00e41 and O. Reg. 476/24: https://www.ontario.ca/laws/regulation/r24476
- OPC and provincial regulators, generative AI principles: https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/
- Bill C-27 status: https://www.parl.ca/legisinfo/en/bill/44-1/c-27
- Bill C-36 status: https://www.parl.ca/legisinfo/en/bill/45-1/c-36
- FTC Operation AI Comply: https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes
- FTC Workado final order: https://www.ftc.gov/news-events/news/press-releases/2025/08/ftc-approves-final-order-against-workado-llc-which-misrepresented-accuracy-its-artificial
- FTC proposed policy statement on AI accuracy: https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-seeks-public-comment-policy-statement-addressing-ai-accuracy
- Colorado SB 26-189: https://leg.colorado.gov/bills/sb26-189
- California CCPA ADMT regulations: https://cppa.ca.gov/regulations/ccpa_updates.html
- Illinois Public Act 103-0804: https://www.ilga.gov/legislation/publicacts/fulltext.asp?Name=103-0804
- NYC Local Law 144 (DCWP): https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page
- Title VII (s. 703(k)): https://www.eeoc.gov/statutes/title-vii-civil-rights-act-1964
- Utah S.B. 226 (Chapter 13-75): https://le.utah.gov/~2025/bills/sbillenr/SB0226.pdf
- Texas HB 149 (TRAIGA): https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
- EU AI Act, Regulation (EU) 2024/1689 (Art. 50, Annex III): https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- NIST AI RMF 1.0: https://www.nist.gov/itl/ai-risk-management-framework
Frequently asked
- Can we use AI to write listing descriptions?
- From a governance standpoint it is a low-obligation use as long as a licensee reviews every description for accuracy. Advertising rules for listings come from your real-estate regulator and board; check those rules before publishing generated text or images.
- Do we need to tell website visitors the chat is AI?
- Yes as a default. EU visitors must be told under AI Act Art. 50(1) from 2 August 2026; Utah requires disclosure when asked; Canadian regulators' generative AI guidance recommends openness. An upfront 'you are chatting with an AI assistant' line costs nothing and avoids the question.
- Is lead scoring an automated decision?
- It depends on what happens next. If a low score means nobody ever calls, the system is effectively deciding who gets service. Treat scoring that changes how a person is treated as elevated: document it, keep a human review route and check the jurisdiction-specific notice rules.
- Does Ontario ESA s. 8.4 apply when we recruit licensed agents who are independent contractors?
- The section applies to employers with 25 or more employees advertising publicly advertised job postings. Whether a given recruiting post for contractor agents falls within it is a question for your employment counsel. Record how you decided, and if in doubt include the statement.
This guide is general information, not legal advice. Laws and dates are drawn from our verified regulatory dataset and link to official sources; check them for changes after the review date.