AI In Commercial Real Estate: Innovation, Compliance And Accountability

The commercial real estate sector is undergoing a significant technological transformation, with artificial intelligence increasingly deployed across operational and strategic functions. From processing voluminous lease documentation to regulating building energy consumption, redesigning physical workspaces, and generating portfolio-level financial insights, AI presents both a remarkable opportunity and a considerable legal challenge. We look at some of these use cases and steps to take to mitigate associated legal risks.   

Document Processing and Lease Management

Commercial real estate portfolios frequently involve hundreds or thousands of lease agreements containing complex provisions relating to rent reviews, make-good obligations, options to renew, and assignment rights. AI-powered document processing tools using natural language processing can now extract key terms, flag anomalies, and summarise obligations across entire portfolios in a fraction of the time previously required. Global firms such as JLL and CBRE have invested significantly in AI platforms that analyse lease abstracts and flag commercial risks, while Australian prop-tech companies have developed tools tailored to local requirements, including tracking compliance with retail lease disclosure obligations under State and Territory legislation.

The deployment of AI in lease management impacts a number of legal areas. Commercial leases frequently contain personal information about tenants, guarantors, and key personnel. The Privacy Act 1988 (Cth) regulates the handling of personal information. 

• Entities deploying AI tools must ensure compliance with the Australian Privacy Principles (APPs), particularly regarding collection, use, and disclosure of personal information.  
• Where AI tools are hosted on overseas cloud infrastructure, which is relatively common given the lack of home-grown AI models, APP 8 requires the organisation to take reasonable steps to ensure overseas recipients do not breach the APPs. 
• If these lease management tools are used to generate new insights in relation to individuals, it can amount to a new ‘collection’ of personal information, a position that will be further clarified under the long-awaited Tranche 2 Privacy Act reforms. 
• If the AI system generates recommendations affecting individual tenants, the organisation will also need to take account of the upcoming changes to the Privacy Act in relation to automated decision making. 

Beyond privacy, if an AI tool misinterprets a lease clause, for example, incorrectly identifying a rent review date or mechanism, option exercise window, or make good provision — the resulting decisions could expose parties to loss of proprietary rights, disputes and significant financial loss.

Ensuring that there is a ‘human in the loop’ to verify output helps avoid costly mistakes. It would also be advisable that the organisation seeks to manage risk in its technology procurement contracts. In practice, the extent to which a service provider in willing to assume liability will often depend on how the AI system is obtained, either as a licensed model at one end or a fully integrated and managed system, at the other end, or anything in between.

Building Regulation and occupant personalisation

A second use case involves integrating AI with Internet of Things (IoT) sensor networks to regulate building systems and conserve energy. IoT sensors can monitor temperature, humidity, lighting, occupancy, and air quality in real time, with AI algorithms dynamically adjusting HVAC systems and lighting to reduce consumption. Google's deployment of DeepMind AI to manage data centre cooling — reportedly achieving energy savings of up to 40 per cent — illustrates the potential. Building management companies such as Honeywell and Siemens now offer AI-integrated automation systems, and Australian institutional landlords including Dexus and Mirvac have adopted smart building technologies to improve NABERS ratings and meet net-zero carbon commitments.

In a more forward-looking vein, AI-driven enhanced personalised building services such as, intelligent concierge, virtual assistants, personalised retail and well-being tools, will be driven by personal information, collected through intelligent sensors. 

IoT sensors collecting data that constitutes personal information must comply with the Privacy Act. To reduce regulatory compliance requirements, organisations should seek to avoid collection of data that identifies specific individuals. That will not be an option for AI-driven in-building services and consideration will be required around data collection, use and other compliance requirements of the Privacy Act.

Where AI building management systems restrict access or adjust environmental conditions based on occupancy data, the landlord may need to consider the new Privacy Act requirements for automated decisions, which come into effect in December 2026, to confirm that personal information is not used or, if the position is unclear, to update its privacy policies giving notice of impacts of environmental management or other occupant monitoring systems.

Furthermore, the new statutory tort for serious invasions of privacy under Schedule 2 to the Privacy Act creates additional exposure for IoT sensors and in-building services. The definition of "intruding upon the seclusion of an individual" expressly includes watching, listening to, or recording the person's private activities or private affairs. IoT systems monitoring individual behaviour in areas where occupants might reasonably expect privacy could give rise to claims under this tort. Landlords should address these risks in leases and building rules, while tenants may seek protections regarding data sharing and the ability to opt out of monitoring.

Separately, the deployment of AI‑enabled building systems raises considerations under planning, building and strata regulatory frameworks. Smart building technologies that dynamically adjust building operation, including energy use, access controls and hours of operation, may interact with conditions imposed under building codes, planning approvals or development consents, particularly where those conditions regulate building performance or environmental outcomes. 

For example, Victoria's building legislation prohibits persons in the business of building from carrying out building work if they know that the work is not being delivered in accordance with legislation, building regulations or relevant building permit (section 16B of the Building Act 1993 (Vic)). Breaching this obligation can incur fines and/or criminal imprisonment of up to 5 years for natural persons, and significant fines of over $600,000 for body corporates. As a result, review and audit of AI-enabled systems and designs is essential to ensuring compliance to building legislation and standards. 

Further, in strata‑titled commercial buildings, AI‑driven sensors and building management systems are often installed on, or form part of, common property, requiring careful consideration of the role and responsibilities of the owners corporation, including allocation of compliance obligations, data governance and liability for system failures. These overlays add additional complexities for landlords and asset managers, who must ensure that AI‑driven optimisation does not inadvertently result in regulatory non‑compliance or misalignment between landlord, strata manager and tenant obligations. Beyond regulatory non-compliance, property developers may also incur flow-on contractual penalties alongside financial loss associated with rectification of works or systems upgrades to be fit for purpose.

Internal business processes

Beyond property-specific applications, commercial real estate companies are increasingly deploying AI to generate efficiencies in internal business processes common to organisations across all sectors. One of the most significant areas of adoption is human resources, where AI tools are being used to automate candidate screening and résumé parsing, generate shortlists based on skills-matching algorithms, monitor employee performance, and support workforce planning through predictive attrition modelling. Large property companies with hundreds or thousands of employees — including facilities managers, leasing agents, project managers, and corporate support staff — stand to benefit considerably from these efficiencies.

AI is also being applied to internal knowledge management and compliance training, with tools that can automatically generate tailored training modules, track employee certification status, and flag compliance gaps across large organisations. For a commercial real estate company with operations spanning multiple States and Territories, each subject to different regulatory requirements, AI-driven compliance monitoring can significantly reduce the administrative burden on HR and legal teams.

However, the legal risks associated with AI in HR are substantial and multifaceted. The use of AI in recruitment and employment decisions engages both Commonwealth and State anti-discrimination legislation, as well as transparency requirements under the Privacy Act. 

Further considerations include whether the organisation is authorised to use existing data sets in conjunction with AI, in particular, if the data is subject to any confidentiality rights. In other business areas, such as marketing, use of AI generated output in a public context raises risks of intellectual property right infringement and liability for misleading statements. 

Financial Insights for Property Portfolios

Property companies manage complex financial datasets encompassing rental income, capital expenditure, asset valuations, and market data. AI tools can generate predictive financial models, identify underperforming assets, and forecast cash flows. Platforms such as Yardi's Elevate suite and MRI Software's analytics modules are increasingly used globally, and Australian listed groups such as Charter Hall and GPT Group have invested in data analytics platforms to enhance portfolio management and investor reporting.

The Corporations Act 2001 (Cth) imposes reporting requirements relevant to this analysis. Chapter 2M of the Act requires companies to prepare annual financial reports giving a true and fair view of financial position and performance. AI-generated outputs feeding into statutory reports may contain errors or reflect biased training data, and directors bear personal responsibility. While directors may delegate preparation of financial reports, they must take a diligent and intelligent interest in the information and apply an inquiring mind. The opacity of AI models heightens the need for directors to interrogate assumptions and methodologies, and to unpack the black box.

Directors must exercise the care and diligence that a reasonable person would exercise in their position. Uncritically accepting AI-generated insights may breach this duty. For listed entities, the continuous disclosure regime requires notification of information that a reasonable person would expect to have a material effect on the price or value of securities. A failure to promptly review and act upon AI-generated insights revealing material portfolio deterioration could constitute a contravention. Directors must not provide information that is false or misleading in a material particular, including where AI-generated data is inaccurate. 

Further, if AI-generated errors are relied on externally (as described, in company reporting or as a part of continuous disclosure obligations), companies face possible negligence and misleading and deceptive conduct exposure. The human loop is a risk mitigation measure, not a legal safe harbour and diligent interest in the information, as noted above, must be given to external-facing information. 

Sustainability outcomes and obligations 

Utilisation of AI can streamline the process of decarbonising real estate portfolios through building insights that analyse and benchmark against established frameworks and market data. This can assist with the preparation of annual sustainability reports. However, it is essential that data processed within the AI appropriately reflects and measures the building's condition. 

The importance of accurate AI outputs and human oversight is relevant to the incoming lower threshold from 1 July 2026 (and again in 1 July 2027) for entities subject to mandatory sustainability reporting on, amongst other things, greenhouse emissions, company metrics concerning climate matters, and the identification of material financial risks and opportunities under the Corporations Act. Relevantly, directors must provide a declaration that the sustainability report has been made in accordance with the Corporations Act and relevant accounting standard. As such, proactive consideration of AI-generated analysis is pertinent to ensuring truthful declarations by directors.

Governance Framework

With AI potentially triggering a range of additional legal risks, commercial real estate companies must ensure a strong culture of AI governance within its organisation. A well-designed AI governance framework provides several important benefits. 

• It can protect investments, especially for systems involving high-risk use cases. A substantial investment in cutting-edge technology, together with extensive implementation costs, may be wasted, or require substantial remediation work where the system triggers unacceptable legal risks.
• Establish senior accountability for AI systems, with the benefit of focussing attention on getting things right first time.
• Reduce exposure for unforeseen breach of laws or third-party rights.
• Identify errors, providing opportunities to correct processes. If left unchecked the speed of AI, including agentic AI processes, can quickly multiply liability events.  
• Demonstrate a compliance-centric approach, providing protection in the event of regulatory investigation or legal claims, such as possible class actions based on negligence or other duty of care. 

Conclusion

Artificial intelligence offers transformative potential for commercial real estate. Property developers, managers, investors and technology stakeholders should approach AI adoption with a clear understanding of these obligations and a proactive and holistic approach to risk management. 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.