Confidence, verified: what ISO 42001 means for CRE
CRE has always required confidence in the data behind its most consequential decisions. With AI, that confidence must extend to the technology behind it.
Confidence, verified: what ISO 42001 means for CRE
CRE has always required confidence in the data behind its most consequential decisions. With AI, that confidence must extend to the technology behind it.
Author

Matt Tordoff
Chief Information Officer
AI deserves the same due diligence as an acquisition
CRE has always required confidence in the data behind its most consequential decisions. With AI, that confidence must extend to the technology behind it.
The due diligence most CRE firms apply to a single acquisition is often more rigorous than the due diligence they're applying to the AI tools that will touch every asset in their portfolio. What happens to your data inside the system? Can you trace how it arrived at a number? Is the AI deterministic, meaning the same inputs produce the same output every time? If a regulator, auditor, or LP asks you to defend the output, can you?
In an industry where a single valuation opinion can move hundreds of millions in capital, these are operational risks. Most AI tools entering the CRE market right now have no independent verification that they've addressed any of them.
The AI governance gap in commercial real estate: claimed versus verified
When evaluating AI, it ultimately comes down to two questions: can I trust the output, and can I explain it? There is always a risk that you can't really explain the output when AI is done badly.
What "done badly" looks like is more common than most firms realize. A generic AI can produce output that looks polished regardless of what's underneath it. Because outputs can vary — whether because of how a question is phrased, how a model is configured, or changes outside the user’s view — the result isn’t always reproducible. For any AI operating in an audit-sensitive environment, that’s a disqualifier.
Despite this, most vendors in this space have no external accountability for how their AI handles data, produces outputs, or manages risk, and the governance claims on their websites haven't been tested by anyone outside the company. That grey area between what's claimed and what's verified is where the risk lives.
What ISO/IEC 42001 certification requires
At Altus, we recently achieved ISO/IEC 42001 certification, the first international standard for AI management systems. Going through the process required us to document and defend every layer of how our AI works: how client data enters and exits the system, what happens to it in between, who validated the model, and how we ensure the outputs are consistent and traceable.
Throughout this exercise, three areas stood out as the ones that matter most for CRE:
1. Explainability
Can the output be audited? If the auditor followed the same exact process, would they get the same exact answer? Can a valuer defend that output to a lender? Most AI produces probabilistic outputs, meaning the result can shift depending on how you phrase the question. Because Altus's AI is anchored to a deterministic calculation engine, the same inputs produce the same output every time. Every output is traceable to its assumptions, every assumption is visible and challengeable, and the results are reproducible.
2. Data handling
CRE deals routinely involve confidential financial information, personally identifying information, and material non-public information. The questions that should come before features or pricing: is client data training the model? Who has access? How long is it retained? At Altus, client proprietary data is not used to train the model. Customer data ownership stays with the customer.
3. Validation
Who built the AI, who tested it, and against what? ARGUS Assist, our first AI agentic layer in the ARGUS Intelligence Platform, was developed in partnership with our own Valuation Advisory Services team, practitioners who manage thousands of property valuations every quarter. They trained the model against thousands of real-world test cases, interrogated its outputs, and corrected its reasoning. If a vendor can't tell you what data the model was trained on and who validated it, that's your answer.
Independent verification is the essential baseline
The CRE industry doesn't have a long track record with AI. Most firms are evaluating these tools for the first time, and the vendors selling them know the buyer's governance fluency is still developing. That asymmetry is where bad decisions are made.
ISO 42001 certification exists to close that gap. Altus already holds ISO 27001 for information security, and ISO 42001 extends that same rigor to AI. In an industry built on trust, independent verification is the essential baseline.
As our CEO Mike Gordon puts it: "Our customers rely on Altus to inform some of the most consequential real estate decisions they make. When it comes to AI, they need confidence not only in the data, but also in the technology behind it."
The technology will keep evolving. The firms that adopt it well will be the ones that asked the hard governance questions before they signed, not after something went wrong.
Want to be notified of our new and relevant CRE content, articles and events?
Disclaimer
This publication has been prepared for general guidance on matters of interest only and does not constitute professional advice or services of Altus Group, its affiliates and its related entities (collectively “Altus Group”). You should not act upon the information contained in this publication without obtaining specific professional advice.
A number of factors may influence the performance of the commercial real estate market, including regulatory conditions and economic factors such as interest rate fluctuations, inflation, changing investor sentiment, and shifts in tenant demand or occupancy trends. We strongly recommend that you consult with a qualified professional to assess how these and other market dynamics may impact your investment strategy, underwriting assumptions, asset valuations, and overall portfolio performance.
No representation or warranty (express or implied) is given as to the accuracy, completeness or reliability of the information contained in this publication, or the suitability of the information for a particular purpose. To the extent permitted by law, Altus Group does not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it. The distribution of this publication to you does not create, extend or revive a client relationship between Altus Group and you or any other person or entity. This publication, or any part thereof, may not be reproduced or distributed in any form for any purpose without the express written consent of Altus Group.
Author

Matt Tordoff
Chief Information Officer





