Shadow AI in Real Estate: What Your Team Is Using - And What You Don't Know About It

Real estate sits at an unusual intersection of marketing pressure, transaction urgency, and high-value financial risk. Property listings need to be compelling and fast. Settlement timelines are fixed. Client relationships are competitive. And in that environment, AI tools have found a natural home - not through any formal adoption decision, but because agents and property managers discovered, one tool at a time, that AI made their work faster and their listings better.

A 2025 MIT study found that while only 40 percent of companies have formal AI subscriptions, employees at more than 90 percent of organisations are using generative AI in their daily work. In real estate, that pattern is likely more pronounced. Agents aren't wired to seek approval before trying a new tool. That's part of the model and the mindset. A free tech tool has always been a good thing.

The result is a sector where AI adoption is wide, enthusiastic, and almost entirely ungoverned. And where the consequences of unmanaged AI - from client data exposure to payment fraud to misleading property representations - sit at the sharper end of what shadow AI risk looks like in practice.

What Shadow AI Looks Like in a Real Estate Agency

Shadow AI in real estate doesn't look like a technology project. It looks like this:

An agent using ChatGPT to write a property listing description from a brief they've prepared. They enter the property address, key features, and client's asking position. The listing goes live. The client's property details - and in some cases, confidential aspects of the client's motivation or pricing position - are now in an external AI system.

A property manager using a public AI tool to draft a tenancy breach letter, entering the tenant's name, address, breach details, and tenancy history to generate a structured letter. The document is reviewed before it goes out. The tenant's personal information - including details about their behaviour and financial position - has been processed through an external platform with no data handling agreement.

A business development manager using an AI summarisation tool to prepare for a listing presentation, pasting in research about the prospective vendor's property, comparable sales, and neighbourhood context. Some of that research includes personal information about the vendor gathered from public sources. It's all now in an external AI system.

A property manager using an AI transcription tool added to Teams to capture notes from an owner update call. The call includes discussion of the tenant's payment history, maintenance issues, and the owner's planned sale timeline. The full transcript is stored on a third-party server with no agreement governing that data.

An agent experimenting with AI-enhanced property photography tools that use generative AI to improve presentation of images - removing cars from driveways, improving lawn appearance, brightening interiors. The images are published in the listing. Whether they accurately represent the property is a question the client's buyers haven't been asked.

None of these individuals were acting carelessly. Each found a tool that made their work faster, better, or more competitive. The issue is that in each case, client information moved outside the agency's control - and in one case, potential buyers are being shown a property that's been materially altered from how it actually presents.

Where AI Is Genuinely Creating Value in Real Estate

The opportunity is real. AI has legitimate, high-value applications across every part of a real estate agency's workflow - and the agencies that use it well will be more productive and more competitive than those that don't.

Property listing copy - AI-assisted listing writing is one of the highest-adoption AI use cases in real estate globally. When used within a governed environment - and when the output is reviewed before publication - it compresses writing time significantly without the data governance risk of entering client-specific information into public AI tools.

Market research and comparable sales analysis - AI tools that analyse publicly available sales data, market trends, and property information for internal use represent a low-risk, high-value application. The key distinction is whether client-specific or confidential commercial information is being entered into the analysis.

Client communication drafting - Drafting and refining routine client correspondence - vendor updates, appraisal follow-ups, property management communications - is a legitimate time-saving application when the output goes through professional review before it's sent.

Administrative efficiency - Lease drafting from templates, maintenance request summarisation, inspection report structuring - AI can compress the administrative workload of property management significantly. Within a governed environment where tenant and owner personal information is handled appropriately, this is operationally valuable.

Microsoft Copilot within the agency's environment - For agencies on Microsoft 365 Business Premium, Copilot provides AI capability within the agency's existing data governance structure. It doesn't send client or tenant information to external AI models. It works within the agency's existing permissions. For agencies that haven't yet activated it in a governed way, this is the alternative that already exists within their licence.

The consistent principle: AI capability within the agency's governed Microsoft 365 environment is a different proposition from public AI tools. The productivity gain is similar. The data governance risk is not.

The Specific Risks for NZ Real Estate Agencies

Real estate sits at a particular convergence of risk: high-value financial transactions, personal client information, tenancy obligations, and professional conduct requirements - all in an environment where AI adoption is moving faster than governance.

Client confidentiality - Real estate clients share significant personal and financial information with their agents - their financial position, their reasons for selling, their price expectations, their personal circumstances. That information is shared in confidence. When it's entered into public AI tools for any purpose - drafting a listing, preparing for a presentation, summarising a conversation - it moves outside the agency's control and into systems operating under terms the client never agreed to.

Privacy Act 2020 and personal information - Real estate agencies hold substantial personal information about vendors, buyers, landlords, and tenants - contact details, financial information, tenancy history, personal circumstances. Processing that information through AI tools without adequate data governance creates Privacy Act obligations that most agencies haven't fully considered. Tenancy information in particular - which includes information about individuals' living situations, financial behaviour, and personal circumstances - carries significant privacy weight.

Payment fraud and BEC - Real estate property transactions in New Zealand involve large financial transfers - deposits, settlement payments, bond payments. The NCSC identifies real estate agencies as a consistently high-frequency target for business email compromise precisely because of those large transactions. An AI tool that has been used to process information about a transaction - client names, property addresses, settlement timelines - creates an information environment that makes a BEC attack easier to execute convincingly. This isn't a direct shadow AI risk, but AI tools that process transaction information without governance expand the attack surface for financial fraud.

Misleading property representations - AI-enhanced property imagery - tools that improve lawn presentation, remove vehicles, brighten interiors, or add virtual staging - raises an obligation question under the Real Estate Agents Act 2008. The Act requires that agents act in a manner that is not misleading or deceptive. Whether an AI-enhanced image that doesn't accurately represent a property's actual condition meets that standard is a question NZ real estate agencies haven't broadly grappled with yet - but it's one that's becoming more visible as AI image enhancement becomes easier and more widespread.

Tenancy law obligations - Property managers operate under the Residential Tenancies Act 1986 and its subsequent amendments. Documents generated with AI assistance - tenancy agreements, breach notices, formal communications - that contain errors or misrepresentations don't become less the property manager's responsibility because AI produced the first draft. The professional obligation attaches to the output, not the process that generated it.

Inconsistent representation across the agency - Different agents using different AI tools for listing copy, client communications, and market analysis produce inconsistent outputs with inconsistent quality controls and inconsistent data handling. An agency that has no visibility into which AI tools are in use across its team has no ability to ensure consistency of representation or quality of client service.

The Visibility Problem

Brokerages, MLSs, and Associations may not see it, but their agents are already using AI. Shadow AI is already active inside their organisations. And just because these tools are invisible to leadership doesn't mean they're harmless.

In real estate specifically, the independent contractor model amplifies this challenge. Agents have significant autonomy over their own workflows. Many operate across multiple offices or brands simultaneously. The instinct to try a useful new tool without seeking approval is built into how real estate professionals work.

The average enterprise has 14 distinct AI tools in use while IT teams are aware of only four to five, according to Productiv's 2026 research. In real estate, where agents are often independent and tech adoption is individually driven, that gap is likely wider.

AI features have also been progressively embedded into the property management software, CRM systems, and Microsoft 365 tools that agencies already use - often activated through product updates without any governance decision having been made. The result is AI processing happening across the agency's environment, including processing of client and tenant information, without anyone having made a deliberate choice about it.

Visibility comes before policy. Understand what tools are actually in use across your team - including embedded AI features in existing software - before building policy around what you wish was happening.

What Good AI Governance Looks Like for Real Estate Agencies

Real estate agencies that approach AI governance well start with the same question: what's actually happening before we decide what should be?

That means gaining technical visibility into the AI tools and services connecting to the agency's environment - not asking agents to self-declare tools they might assume aren't permitted, but understanding the actual picture. It means reviewing the agency's Microsoft 365 configuration to understand which AI features are active and whether data governance settings are appropriate for an environment handling client and tenant personal information.

From that foundation:

An approved tool list that covers listing tools, client communication tools, property management AI, and image enhancement tools - with clear guidance on which tools are appropriate for which types of information. An agent who knows which listing AI tools are approved and what client information can be used with them makes consistently better decisions than one choosing their own tools without guidance.

A simple, practical AI policy covering what client, vendor, buyer, and tenant information can and can't be used with AI tools, what review requirements apply before AI-generated content is published or sent, and how new tools get assessed and approved. Short enough that an agent under time pressure will actually read it.

Specific guidance on AI-enhanced imagery. Given the professional conduct obligations under the Real Estate Agents Act, a clear agency position on what AI image enhancement is and isn't permitted - and what disclosure, if any, is required - is worth establishing before a complaint is made, not after.

Microsoft Copilot as the governed alternative. For agencies on Microsoft 365 Business Premium, Copilot provides the productivity gains agents are looking for - faster drafting, better summarisation, more efficient communication - without client and tenant information leaving the agency's governed environment.

Executive visibility. Someone in the agency leadership has a clear, periodic picture of how AI is being used across the team, where the governance posture sits, and where the risks are. In real estate, where teams can be large, dispersed, and independently-minded, this requires active management rather than a one-time policy document.

Gaining Visibility Before Building Policy

If your agency hasn't taken a structured approach to AI governance, the starting point isn't writing a policy - it's understanding what's already happening.

Most NZ real estate agencies that begin this process are surprised by the scope of AI use they find because the tools arrived faster than the conversation, and the gap between what's in use and what's governed is wider than anyone expected.

NSP's approach starts with exactly that visibility - mapping the current state of AI adoption across the agency's Microsoft 365 environment, identifying shadow AI exposure, and reviewing configuration and governance posture before any policy work begins. For real estate agencies specifically, that exercise surfaces the client confidentiality, Privacy Act, tenancy law, and professional conduct implications that generic AI governance frameworks don't account for.

For agencies ready to go further, NSP's Secure AI Accelerator provides a structured programme covering AI enablement, security, governance, and ongoing optimisation - with executive reporting that gives leadership a documented, evidenced picture of AI governance maturity over time.

The agencies that will use AI most effectively aren't the ones that banned it or the ones that let it run ungoverned. They're the ones that understood what was already happening, made deliberate decisions about how it should work, and gave their teams the tools and guidance to use AI as a genuine competitive advantage - rather than a liability that surfaces in a client complaint or a Privacy Act inquiry.

If you're not sure how much AI is already in use across your agency's Microsoft 365 environment, that's the question worth starting with. NSP can help you understand your current shadow AI exposure and governance readiness before you begin building policies or wider AI initiatives.

Talk to NSP about AI for your agency →

Or call us: 0508 010 101

Frequently Asked Questions

What is shadow AI in a real estate agency? Shadow AI in real estate refers to AI tools being used by agents and property managers without formal approval or oversight from the agency's leadership. This includes public AI tools used for listing copy, client communications, property imagery enhancement, and tenancy documentation, as well as AI features embedded in existing CRM and property management software activated without review. In real estate, shadow AI is particularly significant because of client confidentiality obligations, Privacy Act requirements covering vendor, buyer, and tenant personal information, professional conduct obligations under the Real Estate Agents Act, and the high-value financial transaction environment that makes agencies a consistent BEC target.

What are the main risks of shadow AI for NZ real estate agencies? The primary risks are client and tenant personal information being processed through external AI systems without adequate data governance, professional conduct questions around AI-enhanced property imagery that doesn't accurately represent a property, Privacy Act obligations being breached through unmanaged processing of client and tenant information, and the expanded information environment that shadow AI creates for business email compromise attacks targeting property settlement payments.

Can real estate agencies use AI safely? Yes - with appropriate governance. The critical distinctions are whether client and tenant information stays within the agency's governed environment, whether AI-enhanced imagery is reviewed against professional conduct obligations before publication, and whether AI-generated documents are reviewed by a professional before being sent or relied upon. Microsoft Copilot within a properly configured Microsoft 365 environment is the most practical example of governed AI use for NZ real estate agencies.

Does AI-enhanced property photography create legal risk in NZ? Potentially yes. The Real Estate Agents Act 2008 requires that agents act in a manner that is not misleading or deceptive. AI-enhanced images that materially alter a property's presentation - removing vehicles, improving lawn condition, brightening interiors beyond what's accurate - raise questions about whether published listings accurately represent the property. Agencies should establish a clear position on what AI image enhancement is and isn't permitted before a complaint arises, not after.

What should a NZ real estate agency do about shadow AI? Start with visibility - understand what AI tools are actually in use across the agency's team, including AI features embedded in existing property management and Microsoft 365 software. From that foundation, develop a practical AI policy that addresses the specific scenarios real estate staff encounter, build an approved tool list with guidance on what client and tenant information can be used with each tool, and implement Microsoft Copilot as a governed AI alternative within the agency's existing environment.

Continue Reading

• Shadow AI in Legal Firms: What You Don't Know Is Happening
• Shadow AI in Accounting Firms: What You Don't Know Is Happening
• Shadow AI in Construction Firms: What You Don't Know Is Happening
• Shadow AI in Healthcare: What You Don't Know Is Happening
• Why Law Firms Are One of the Most Targeted Industries in NZ Right Now
• How Do I Know If My Business Has Been Breached?
• NSP Secure AI Accelerator
• AI Governance - NSP
• Managed IT - NSP