30 — Fall Preview — September 2026 — M id A tlantic Real Estate Journal
www.marej.com
AI & C ybersecurity
By Michael Mullin, Integrated Business Systems (IBS) and ProtectMyIT Shadow AI is already in commercial real estate. Are you governing it?
hadow IT required a purchase. Shadow AI requires a paste. That distinction may be one of the most important technology issues com- mercial real estate execu- tives need to understand as artificial intelligence moves into everyday operations. For years, companies wor- ried about employees purchas- ing software or subscribing S Michael Mullin
to cloud applications without involving IT. There was usu- ally some friction - a purchase, installation, credit card, or approval. AI has removed that friction. An employee can open a browser, upload a docu- ment, paste information into a prompt, and receive an answer within seconds. IT may never know it happened. And commercial real estate has plenty of information em- ployees may be tempted to give AI. A property manager might use AI to summarize a tenant issue. An asset manager could upload operating results for a
variance analysis. Account- ing might use it to reconcile a spreadsheet. A leasing profes- sional could paste sections of a lease into AI and request a summary. These are under- standable uses of AI. They can also create risks many CRE or- ganizations haven’t addressed. Shadow AI vs. Sanctioned AI Shadow AI uses artificial intelligence tools without or- ganizational review, approval, or oversight. Employees gener- ally aren’t trying to circumvent company policy. They’re trying to get their jobs done faster. Sanctioned AI is different.
The organization determines which tools employees can use, what information they can enter, how company data is protected, and where human review is required. That distinction matters in CRE because organizations possess enormous amounts of potentially sensitive in- formation: leases, tenant records, banking information, investor reports, property financials, vendor contracts, employee records and confi - dential acquisition and dis- position documents. The most important question
isn’t which AI tool employees use. It’s what information they’re giving it. Using AI to improve the wording of a generic tenant notice is very different from uploading a rent roll. Brainstorming marketing ideas is different from uploading confidential acquisition documents. Start With an AI Audit Before writing another policy or attempting to pro- hibit AI, determine what’s actually happening. An effective AI audit should answer four questions: 1. What AI tools are em- ployees using? Include standalone platforms, brows- er extensions, and AI capabili- ties embedded within existing applications. 2. What information is being entered? Determine whether company, tenant, employee, investor, or trans- action information is moving into systems that haven’t been reviewed. 3. Which uses create meaningful risk? Not every AI interaction deserves the same concern. Focus on situ- ations involving information the organization is responsible for protecting. 4. What alternatives can you provide? Simply tell- ing employees to stop using AI isn’t a long-term strategy. Give them approved tools and clear boundaries. Don’t Turn Discovery into Enforcement If employees believe admit- ting to using AI will get them in trouble, management will learn very little. Ask employ- ees what they’re using, what they’re using it for, and which repetitive tasks they’re trying to eliminate. Those conversa- tions may uncover risks, but they can also uncover oppor- tunities. Shadow AI isn’t only a cybersecurity problem. It can also map where employ- ees believe existing business processes are inefficient. AI Isn’t the Problem. Ungoverned AI Is. Commercial real estate shouldn’t respond to AI by trying to stop it. The produc- tivity opportunity is too sig- nificant. But adoption cannot be separated from governance. The question CRE leadership should be asking isn’t, “Should we allow employees to use AI?” A better question is: “How are our employees already continued on page 38
ProtectMyIT an IBSRE Company
Uncover what’s really happening in your organization Our field guide includes:
Practical insights The risk to your reputation and data Real-world examples
GET THE FREE FIELD GUIDE HERE
protectmyit.com/mida
Made with FlippingBook Annual report maker