AI Bias and Fair Lending Risk in CRE

Fair lending law was written for humans making decisions with pencils and gut instincts. It was not written for gradient-boosted models ingesting ten years of cap rate spreads. And yet, here we are: the same legal framework applies, regulators have said so explicitly, and the CRE industry is deploying AI across deal workflows at a pace that has comfortably outrun most institutions' compliance thinking.

This is not an argument against AI in CRE lending. The efficiency gains are real, the competitive pressure is real, and frankly, the old workflow had its own bias problems. This is an argument for understanding where bias enters the machine before an enforcement action makes that education expensive.

Historical CRE Transaction Data Doesn't Just Reflect the Past. It Teaches It.

Supervised learning is, at its core, pattern recognition on historical data. Tell a model what good loans looked like over the past decade, and it will learn to prefer the conditions under which those loans were made. That appears reasonable until you remember that the historical record of CRE lending was not neutral.

Redlining is the most legible example. Models trained on where capital flowed, and where it did not, will encode geographic exclusion as a predictive signal without any explicit instruction to do so. The GAO has confirmed this mechanism: historical underwriting decisions influenced by discriminatory practices can propagate directly into model outputs. This is not a bug in a particular vendor's implementation. It is a structural property of supervised learning on real-world financial data.

CRE has its own aggravating factors. The transaction data is thinner and less standardized than residential mortgage data, which means models trained on it have fewer corrective observations to smooth out historical distortions. Geographic and asset-type concentrations in historical deal flow can look like legitimate predictive signals when they are actually artifacts of who had access to capital and who did not. And borrower-level data in CRE often conflates entity creditworthiness with the individual characteristics of smaller sponsors in ways that do not arise cleanly in institutional residential lending.

The implication is straightforward: bias auditing must begin at the data layer, before model architecture and certainly before output review. You cannot audit your way out of a discriminatory training set.

Removing Protected Characteristics Is a Starting Point, Not a Solution

One might argue that the fix is obvious: simply exclude race, gender, and national origin from the model inputs, and the model cannot discriminate on those bases. This assumption is not only incorrect, it is specifically the assumption regulators have addressed.

The mechanism is proxy variables. Inputs that are not themselves protected characteristics but that correlate strongly with them can serve as indirect channels for bias. Geographic identifiers are the most direct example: ZIP code, submarket, and neighborhood name correlate strongly with race and income in virtually every US metro. Property type and price point can function as proxies for the borrower population that typically invests in them. Sponsor operating history, taken at face value, reflects who historically had access to capital rather than who is creditworthy today.

That raises an important question: if the proxy variables are structural features of CRE underwriting, how do you model the asset class without them? You cannot, entirely. The question is not whether these variables appear in the model; it is whether the model's use of them produces outcome patterns that correlate with protected class membership in ways that cannot be justified by legitimate credit factors. Disparate impact liability does not require discriminatory intent. The pattern is what matters under ECOA.

Dynamic model updating adds a second layer of complexity. AI systems that learn from new data can drift over time, introducing or amplifying proxy correlations that were not present at initial deployment. A model that passes a bias audit at launch does not necessarily pass one twelve months later. Ongoing monitoring is therefore not a compliance formality; it is the mechanism that keeps a passing audit from becoming a false sense of security.

The Research on LLMs in Underwriting Should Give CRE Lenders Pause

Researchers at Lehigh University tested several leading large language models, including versions of GPT, Claude, and Llama, on mortgage underwriting decisions. The findings are worth sitting with.

Bias against minority applicants was most pronounced for applications at the margin: low credit score, high debt-to-income ratio, high loan-to-value ratio. This is precisely the worst place for bias to concentrate. The decisions where human judgment and model influence matter most are exactly where these models were most biased.

Bias in interest rate recommendations was broadly consistent across models. Approval rate bias varied significantly, with meaningful differences between versions of the same product. What this means practically: swapping one general-purpose LLM for another, or upgrading to a newer model version, can change the bias profile of outputs in ways a lender would not detect without structured testing. Model updates are not neutral events from a fair lending standpoint.

The prompt engineering finding is counterintuitive enough to be worth stating plainly: instructing a model to "use no bias in making these decisions" outperformed instructing it to comply with the Fair Lending Act and ECOA. Compliance-specific language, in some tests, made things worse. This has direct implications for how compliance teams write system prompts, and it indicates that the relationship between regulatory framing and model behavior is not intuitive or stable.

What this research does not resolve: the Lehigh work covered residential mortgage contexts. CRE underwriting inputs are different enough, and the borrower population is different enough, that lenders should not assume these findings transfer directly without conducting their own testing. The directional concern is well-founded. The specific magnitudes are not yet established for CRE.

The Regulatory Environment in 2026 Has Fewer Ambiguities Than the Industry Seems to Believe

The US federal framework is built on provisions that predate modern AI and have not been relaxed on its account. ECOA and Regulation B require that credit denials be explained with specific, accurate reasons. The CFPB has stated explicitly that generic adverse action notices do not satisfy this requirement simply because the decisioning was algorithmic. There is no advanced technology exception to federal consumer financial laws.

SR 11-7, the foundational model risk management guidance issued by the Federal Reserve and OCC, remains the primary examination framework applied to AI and machine learning in banking, even though it predates the current generation of AI tools by more than a decade. April 2026 revised interagency guidance, issued as SR 26-2 and related OCC bulletins, narrows the formal model definition in some respects but confirms that document classifiers and extraction models fall within scope. That is a direct reference to the kind of AI tools CRE lenders are deploying in document-heavy workflows today.

State enforcement is filling gaps where federal agencies have retreated. The Massachusetts Attorney General's 2025 settlement over AI underwriting disparate impact, reached in a non-mortgage context, signals that state enforcers are willing to act. CRE lenders operating across multiple states face a patchwork of enforcement risk that cannot be managed purely at the federal level.

For institutions with any international exposure, the EU AI Act is phasing into enforcement, with high-risk AI provisions for financial services applying from August 2026. Mandatory explainability requirements, bias auditing obligations, and human oversight documentation are now compliance requirements, not aspirational practices. Penalties are structured to concentrate executive attention. US-headquartered lenders with EU-based borrowers or operations cannot treat this as a foreign compliance problem.

The multiagency joint statement signed by the DOJ, CFPB, FTC, EEOC, HUD, and others identifies three risks that map precisely to CRE AI deployments: biased training data, opaque models, and unanticipated downstream use of third-party tools. All three are present in the current CRE AI landscape. None of them are novel enforcement theories.

Bias Does Not Enter the Workflow in One Place. It Enters in Several.

The most consequential misconception about AI bias in CRE is that it lives primarily in the underwriting model. It does not. It enters at every stage where AI touches a deal.

Market screening and deal sourcing are the earliest and most invisible exposure points. AI tools that rank deal opportunities using historical transaction comps can deprioritize geographies that were historically underserved, encoding redlining patterns as lower-opportunity signals before a loan request ever reaches an underwriter. If deal flow is filtered before it reaches a human, the bias is structurally invisible at the underwriting stage.

Financial spreading and automated document analysis present a different risk. These tools extract and calculate financial metrics from borrower documents; they produce quantitative estimates that directly feed credit decisions and fall within model risk management scope. If the spreading logic applies different tolerances or flags based on property type or geography, those differences function as proxies. General-purpose LLMs used ad hoc for spreading, rather than purpose-built CRE tools, carry the model-level bias documented in academic research without the audit trail that would surface it.

Covenant monitoring and portfolio risk classification are often treated as operational functions rather than credit decisions. They should not be. AI systems that assign loan health scores across a portfolio can replicate borrower-level patterns from historical loan performance, which reflects who received favorable terms historically, not just underlying credit quality. A model that consistently assigns lower health scores to loans in certain geographies or to certain sponsor profiles should be tested for proxy correlation before those outputs inform restructuring or watchlist decisions.

Adverse action is the highest-visibility exposure. When AI assists in or drives a credit denial, the CFPB's guidance requires specific, accurate reasons tied to the actual decision factors. A black-box model that cannot produce source-cited, auditable reasoning does not satisfy this requirement, and exposes the lender to enforcement risk on every denial it issues.

Bias Auditing Is Not a Pre-Deployment Checkbox

At minimum, fair lending compliance in an AI-enabled CRE operation requires disparate impact testing across protected classes at each stage where AI influences a credit decision. For models that update over time, it requires periodic re-testing, because drift is a known and documented phenomenon. Documentation of testing methodology, results, and remediation steps is what examiners will ask for. The absence of that documentation is itself a finding.

Explainability is both a regulatory obligation and an operational prerequisite for human oversight. A loan officer who cannot trace how a risk score was produced cannot meaningfully validate or override it. Best-practice frameworks maintain a complete audit trail: the source document, the data point extracted, the calculation, the output, and the human who reviewed and approved the disposition.

Vendor management is not a carve-out. The multiagency joint statement specifically identifies unanticipated downstream use of third-party tools as a risk category. A CRE lender is responsible for the fair lending behavior of tools it deploys, even if those tools were built by a vendor. That means requiring vendors to provide bias testing documentation, explainability capabilities, and audit trail outputs as a condition of deployment, not as a negotiating afterthought.

Choosing a CRE AI Platform When Compliance Is a Real Constraint

The distinction that matters most for fair lending purposes is the one between purpose-built CRE AI platforms and general-purpose LLMs adapted for real estate use. General-purpose models carry the model-level bias documented in the academic literature, without domain-specific training or audit infrastructure. Platforms built on a firm's own documents and templates, rather than generic web-scale training data, reduce the proxy variable risk that comes from models trained on undifferentiated financial histories.

Auditable, source-cited outputs are a non-negotiable for any tool used in credit decisioning. Every extracted data point, calculated metric, and risk flag should trace back to a specific source document and location. This is what enables the adverse action documentation the CFPB requires and the internal validation examiners will look for under SR 11-7 and the 2026 interagency guidance. A platform that cannot produce this infrastructure is not a compliance-ready tool; it is a liability in a document request.

Human oversight architecture should be built into the platform's workflow design, not toggled on as an optional feature. Override authority, disposition logging, and reviewer identity should be captured automatically. Reconstructing an audit trail after a regulatory inquiry is both expensive and unconvincing.

That provenance matters when the question is whether a tool was built with the compliance use case in mind or bolted onto it after the fact.

Institutions that build AI governance into their platform selection criteria now, rather than retrofitting it onto a deployed system later, will encounter less regulatory friction and fewer workflow disruptions as examination pressure increases. The lenders who will be best positioned as AI becomes standard infrastructure are not the ones who adopted it first. They are the ones who adopted it in a way they can defend.