The safe order is fields, then routing, then AI. Logging, triage and drafting for review are ordinary operations. The moment an automation sends something nobody has seen, you have moved into marketing law.
Key takeaways
Start with the jobs that are pure record-keeping and routing, because those are the ones a CRM was built for and the ones where a mistake is visible and cheap. Logging activity, creating tasks, assigning a new enquiry to the right agent, surfacing a contact who has gone quiet, drafting a reply for review — all of that is safe. The moment an automation sends something to a person without a human seeing it, you have moved from operations into marketing law, and that is a different decision.
The rest of this is a working order, plus the two contract questions that matter more than any feature comparison.
No automation survives a dirty database. Before anything clever, the CRM has to hold, for every contact, where they came from, what they asked for, when you last spoke, and on what basis you are allowed to contact them. That last field is the one almost nobody has, and it is the one that determines whether the rest of the stack is usable.
This is unglamorous and it is most of the benefit. A team that automates follow-up on top of tags nobody trusts gets fast, confident, wrong behaviour. A team that spends a fortnight making the fields honest can automate almost everything afterwards.
Getting an enquiry to the right person quickly is a rules problem, not an AI problem, and mature CRMs do it declaratively. Follow Up Boss documents lead distribution that pulls leads from over 200 sources and routes them by geography and price band, sends a lead from a listing to the listing agent, gives higher-priced leads to senior agents, and offers first-to-claim and round-robin distribution as well as lead ponds for inactive contacts that agents can prospect from. Its geographic rules are described in terms of ZIP code or town, so Canadian teams generally build the rule on town or region rather than postal code.
Its Automations documentation describes the second half: watching for a trigger — a new lead arriving, or an existing lead becoming active again — and then sending an email, creating a task, updating a field, notifying a teammate or reassigning a lead. Notably, the same documentation states that Automations do not control distribution rules for brand new incoming leads but can reassign leads once they are already in the system. Knowing which subsystem owns which decision saves a week of confused configuration.
Once the record is true and routing is deterministic, AI earns its place in three jobs.
Summarising. Turning a six-month thread of calls, texts and emails into four lines before you dial. Follow Up Boss lists call and history summaries among its AI features, along with suggested tasks and suggested replies.
Prioritising. Ranking who to contact today from signals you already hold. The same page describes AI-powered tags surfacing high-intent buyers and qualified sellers.
Drafting. Producing the reply, the market update, the follow-up sequence — for a person to send.
What none of them do is change the compliance position. Every automated email or text remains a commercial electronic message if it encourages a commercial activity, and the CRTC’s CASL guidance requires consent, identification and a working unsubscribe for each one, with the onus on the sender to prove consent. Automation multiplies whatever your consent hygiene already is.
The order that works
Weeks 1–2: fields. Source, last transaction date, last inquiry date, consent basis, representation status. No automation until these are populated.
Weeks 3–4: routing and tasks. Deterministic rules, no AI. Measure time-to-first-response before and after.
Week 5 onward: AI summaries and drafting, with a person releasing anything that sends. Add automated sending only to segments defined by the consent field.
A CRM holds your clients’ personal information, and turning on AI features usually means that information is processed by a system you do not control. CREA’s guidance on artificial intelligence sets out the questions to put to any AI system’s terms of use, and two of them are the ones that actually matter.
Where does the data go, and is it stored in Canada? CREA asks how the system collects, uses and discloses personal information, how it is protected, whether it is stored in Canada, and whether all of that is consistent with your own privacy policy.
Is your content used to train the vendor’s model? CREA asks whether content uploaded to the AI system will be disclosed, in whole or in part, to any third party, including for training the system for other users. It also raises copyright and data ownership — what the contract says about ownership of data uploaded to, or generated from, the system — and whether there are warranties and indemnities covering third-party intellectual property claims.
BCFSA’s Artificial Intelligence Guideline turns this into a managing broker duty: vet third-party AI vendors so their data handling aligns with your brokerage policies and client agreements, review their terms of service and privacy agreements, establish protocols for data retention and secure sharing, emphasise anonymising personally identifiable information before entering it into AI systems, and consider discussing AI use with your insurer to check it does not affect coverage.
Treadstone Law covers the commercial side of both questions in its notes on data ownership clauses in SaaS agreements and on sharing customer data with a third-party provider.
Two obligations sit on top of the contract. Under PIPEDA, described in the OPC’s overview, personal information is collected for identified purposes with consent; the OPC’s meaningful consent guidelines expect individuals to be told what is collected, with which parties it is shared, for what purposes, and the risk of harm, with third parties enumerated as specifically as possible.
And in Ontario, RECO’s Bulletin 2.5 on confidentiality adds a professional duty that survives the deal: except as authorised or required by law, confidential client information must not be disclosed to a third party without the client’s written consent, and the duty of confidentiality is ongoing even after the client relationship ends. The bulletin also notes that under designated representation only the named designated representatives may access a client’s confidential information — which is a live question when a CRM makes every file visible to every agent by default.
A six-agent brokerage in Halifax runs a CRM that everyone half-uses, plus three spreadsheets. Enquiries arrive from two portals and the brokerage website.
Month one is field work: every contact gets a source, a consent basis and a last-contact date, or it is archived. About a quarter of the database turns out to have no defensible basis for marketing contact and is set to internal-only.
Month two is routing: portal enquiries go to the on-duty agent by region, listing enquiries go to the listing agent, and a task is created automatically if there is no logged activity within two hours. No AI involved, and this is where the visible improvement happens.
Month three is AI: pre-call summaries, drafted replies sitting in a queue, and a weekly list of quiet contacts with a suggested reason to call. Sending remains manual except for one newsletter that goes only to the express-opt-in segment.
Month four is governance: a one-page brokerage AI policy naming the approved tools, the rule that client-identifying information is not pasted into any tool that has not been vetted, and who reviews AI-drafted client communications. CREA notes that no Canadian statute obliges a brokerage to have an AI policy, but describes adopting one as prudent to manage privacy, confidentiality, copyright and hallucination risk.
The features that matter — summaries, drafting, prioritisation — are increasingly built into mainstream real estate CRMs rather than sold separately. Follow Up Boss, for instance, states its AI capabilities are included in the CRM at no additional cost. Judge a switch on routing, integrations and data portability, not on whether the word AI appears.
Only to a segment whose consent basis you can prove, and only with identification and a working unsubscribe in the template. The CRTC requires the unsubscribe to remain valid for at least 60 days and to be actioned no later than 10 business days after a request.
You are. BCFSA states that using AI does not exempt a licensee from their legal and ethical obligations and that licensees remain accountable for representations made in the course of providing real estate services; CREA says the adoption of AI does not alleviate professional responsibilities. See also automating client follow-up without sounding like a robot.
A 30-minute call is enough to tell you whether AI pays for itself here.
