Pillar 02 · Governance
Adoption without exposure.
Guardrails where work happens.
Your teams are going to use AI either way — the question is whether it happens under a framework your counsel and your investors can live with. This is the readiness framework we score every firm against, published in full, because a methodology you have to take on faith isn't a methodology.
Five dimensions
Readiness is a score, not a feeling.
Each dimension is scored 1–5 in the audit. Below: the question each one asks, why it matters in a CRE shop specifically, and what a 5 looks like.
01
Visibility
Do you know where AI is already used in your firm?
Not what you've purchased — what's actually in use, including personal accounts and free tools. Most firms discover 3–5× more AI touchpoints than leadership expected.
What a 5 looks like
A maintained inventory of every AI tool in use, who uses it, and what data it touches — reviewed on a schedule, not once.
02
Policy
Is there a written answer to 'can I use AI for this?'
In the absence of a policy, every employee writes their own. The measure isn't whether a document exists — it's whether a broker under deadline knows the answer without asking.
What a 5 looks like
A short, current usage policy people have actually read: approved tools, prohibited data, and who to ask when the answer isn't obvious.
03
Data boundaries
Which data categories may never touch which systems?
Rent rolls, tenant PII, client financials, and deal terms carry different obligations. A firm that can't name its data categories can't govern where they travel.
What a 5 looks like
A simple classification — even three tiers — mapped to the tool register, so 'never paste tier-one data into an unapproved tool' is an enforceable sentence.
04
Vendor posture
Do your AI vendors' terms match your NDA obligations?
Consumer AI terms often permit training on your inputs. Your listing agreements and NDAs almost certainly don't. The gap between those two documents is your exposure.
What a 5 looks like
Enterprise agreements (or documented settings) for every approved tool: training disabled, retention defined, and terms reviewed against your client obligations.
05
Adoption
Is the governed path also the easiest path?
If the sanctioned way to use AI is slower than the shadow way, the policy will lose. Governance that ignores adoption is a document; governance that includes it is a system.
What a 5 looks like
Approved tools that are genuinely better than the ungoverned alternatives, training that shows the faster governed workflow, and usage that's reviewed — not policed.
Self-assessment
Score your firm. Two minutes, no email.
Rate each dimension 1 (nothing in place) to 5 (documented, current, and actually followed). Be honest — scores stay in your browser; nothing is sent anywhere.
Your readiness score
– / 25
5 of 5 dimensions left to score.
The full document
Get the scoring worksheet.
The complete framework — all five dimensions with the full question set and scoring rubric — as a document you can run your leadership team through in an afternoon. We'll send it directly; no drip sequence follows it.
Next step
Scored your firm and found gaps?
That's the audit's job: verify the score, close the exposure, and turn the gaps into a governed build roadmap.