← Insights

Article · 2 min read

Can you trust ChatGPT with your rent roll?

Andrew Brown · Jul 13, 2026

Quick answer

Reading risk is a contracts question — business and API tiers of the major AI providers commit not to train on your data, consumer tiers may. The compounding risk is write access: ungoverned tools that update records directly can corrupt a rent roll silently. Safe adoption means AI that proposes, a human who approves, and an audit trail of both.

Somebody on your team has already pasted lease data into a chatbot. That's not a scandal — it's what adoption looks like when the official tools lag the useful ones. The productive response is to know where the actual risk lives and put a policy around it.

What happens to a rent roll you paste into a chatbot?

It depends entirely on the tier of service. Consumer chatbot tiers may use conversations to improve models unless you opt out; business and API tiers from both OpenAI and Anthropic commit — in their published enterprise terms — not to train on your data. So the first governance question is boring but decisive: which tier is your team actually on? More than 90% of leading real estate firms call AI a strategic priority (PwC / ULI, Emerging Trends in Real Estate), yet many run that strategy through personal chatbot accounts.

What's the real risk — reading or writing?

Reading risks are manageable: they're contract terms and access questions, the same class of risk as any vendor. Writing is where the damage compounds. An ungoverned tool that updates records directly can:

  • overwrite a correct rent figure with a hallucinated one, silently;
  • act on a misread date across every downstream report;
  • leave no trail of what changed or why.

A wrong answer you read is a mistake you can catch. A wrong answer that commits itself is corruption of the record.

What five questions should you ask before adopting an AI tool?

  1. Where does our data go, and on what terms? (Named tier, in writing.)
  2. Can the tool write to our records directly — or only propose?
  3. Is every suggestion reviewable next to its source?
  4. Who approved what, when? (Audit trail, not vibes.)
  5. Can we turn it off without losing our data?

Tools that pass all five are rarer than the demo circuit suggests.

What does governed AI look like in practice?

The pattern is simple to state: read → propose → approve → audit. The system reads your documents and messages, drafts the update, and stages it; a person commits it; the decision lands on a ledger. We've written about why this beats fully autonomous agents — for a rent roll, it's the difference between an assistant and an unsupervised intern with edit rights.

Trust, it turns out, isn't a feeling about the model. It's a property of the workflow around it.

FAQ

Does ChatGPT train on data my team pastes in?
On consumer tiers, conversations may be used to improve models unless you opt out. On business, enterprise, and API tiers, OpenAI and Anthropic publish commitments not to train on customer data. The decisive governance question is which tier your team actually uses — audit that before anything else.
What's the biggest AI risk for a CRE firm's data?
Write access without review. A model that reads your rent roll and answers wrong is a catchable mistake; a tool that writes a hallucinated rent figure into your records — silently, with no trail — corrupts the record every report is built on. Require propose-only tools with human approval.
Should we ban chatbots at our firm?
Bans mostly drive usage underground onto personal accounts — the least governed tier. The workable policy: sanction a business-tier tool, keep sensitive documents inside systems that stage AI output for review, and make the audit trail non-negotiable.
What does 'propose, never commit' mean?
A governance pattern for AI in operating systems: the model reads and drafts, its output is staged as a reviewable suggestion beside the source, a person approves or rejects, and the decision is logged. Nothing outward or record-changing executes autonomously.

See what this looks like for your firm.

Governed software, configured to how you actually work — built embedded, shipped as something you own and can audit.