A 4–20 person commercial real estate firm never needed an IT department, and buying AI does not change that — but it does mean you now have to cover, deliberately, the five functions an IT department used to perform. Procurement, security and data governance, operations and support, integration, and enablement do not disappear because no one on the payroll owns them. They get done well, done badly, or not done at all. The mistake is thinking the choice is “hire IT or don’t.” The real work is deciding, function by function, who covers each one: a habit you build, a clause you insist on, a runbook you keep, a workshop you run, or a partner you pay. Get that map right and a ten-person firm handling confidential deal data is safer than a hundred-person firm with a neglected server closet.
Why “No IT Department” Is the Wrong Frame
The phrase “we have no IT department” carries a quiet assumption: that IT is a thing you either have or lack, like a legal team or a server room. For a firm born on Excel, Outlook, and PDF, that assumption was always a little off. You have never had a person whose job is patching servers, because you have no servers. Your email lives in Microsoft 365 or Google Workspace, and your files live in the cloud. The hardware IT department the phrase evokes belongs to a 1998 office, not to a modern brokerage or acquisitions shop.
What you do have is a set of jobs that still need doing. Someone decides which software the firm pays for. Someone is responsible when a tool touches a rent roll or an investor list. Someone knows what to do when it breaks on a Monday morning. Historically that someone was the owner, working by instinct between deals — fine when the stakes were a $40-a-month subscription, less fine now that the tools you evaluate read your leases, draft your emails, and make judgment calls on your data.
So the useful reframe is not “should we hire IT.” It is: which functions does an IT department perform, and how does our firm cover each one on purpose instead of by accident. Once you see IT as functions rather than a hire, the anxiety drops. None of the five requires a full-time technologist; each is a decision you can make in plain language.
The Five Functions an IT Department Actually Performs
Strip away the hardware and the help desk, and a modern IT department does five things. Here is each one, and how a small CRE firm covers it without a hire.
1. Procurement — Deciding What to Buy
In a large firm, IT gatekeeps software purchases: it runs a bake-off, checks the security posture, negotiates the contract, and blocks the tool that duplicates one you already own. At a small firm this collapses onto the owner, who usually buys on the strength of a good demo — which is how firms end up paying for four overlapping subscriptions nobody fully uses.
The habit that replaces the gatekeeper is a short, repeatable buying discipline: start from the workflow that bleeds hours rather than the tool in the demo, make the vendor prove the tool on your own worst documents, and never trust a slide over a live run on your data. That discipline is the whole subject of our field guide on evaluating AI vendors fairly, which turns a job you would otherwise delegate to a procurement team into a checklist one person can run before any money moves.
2. Security and Data Governance — Protecting Deal Data
This is the function that keeps CRE owners up at night, and rightly so. Your firm handles letters of intent, rent rolls, tenant financials, and investor data. In a large company, a security team reads the data-processing terms, sets access controls, and owns the answer to “where does our data go.” You have no security team, and you cannot read your way to safety through a vendor’s engineering blog.
The substitute is the contract. Before a tool touches confidential data, three questions get answered in writing, not in a sales call: Does the vendor train its models on your data, and can you turn that off? How long is your data retained, and can you force deletion? Who is liable if it leaks? A contract that commits a vendor on training, retention, and deletion is the small firm’s security department — guarantees that do not depend on anyone internal being technical. The business tiers of ChatGPT, Claude, and Microsoft Copilot publish enterprise data terms that, by default, do not train on your inputs; the consumer tiers often differ, which is exactly why the reading matters.
3. Operations and Support — Keeping It Running
When a tool breaks, a large firm files a ticket and a help desk handles it. A small firm’s help desk is whoever picks up. The failure mode is not dramatic: a nightly job silently stops running, an integration quietly drops a field, and three weeks later a number in a report is wrong and nobody knows why.
Two things replace the internal help desk. First, a plain-language runbook for every tool that does real work: how to confirm yesterday’s run succeeded, what to do when a document fails to process, and who to call. If your least technical colleague cannot operate the tool from one page, adoption will fail. Second, named vendor support with a response time in the contract — not a community forum, an actual commitment. When you buy off the shelf, you are also buying somebody else’s operations team, so make sure it exists. When you build, you negotiate that support explicitly.
4. Integration — Making Systems Talk
Large IT departments spend much of their budget making systems exchange data: the CRM talking to the accounting platform, the deal database feeding the investor report. At a small firm this is invisible until it isn’t. The moment a tool needs data out of your Excel models, out of Outlook, or out of a property-management platform like Yardi or AppFolio, you are doing integration, whether you call it that or not.
For most small firms, the right integration strategy is to minimize it: prefer tools that read the files you already keep and write back into the formats you already use, so no fragile custom plumbing sits between systems. The signal that you have outgrown this approach is specific — when the workaround spreadsheets multiply and the copy-paste between systems becomes the job. Our piece on the signals that it is time to build walks through when integration has crossed from a nuisance into a workflow that justifies custom automation.
5. Enablement — Making the Team Fluent
The least-discussed IT function is training people to use the tools well. A large firm has an internal enablement team; a small firm has whoever figures it out first, and a lot of expensive software used at ten percent of its value. In the AI era this function has the most upside of the five, because the same general tools your team already has — ChatGPT, Claude, Microsoft Copilot — cover a surprising share of daily CRE work once people know how to prompt them for LOI drafts, lease summaries, market write-ups, and email.
Enablement is where a workshop earns its keep. Hands-on fluency training runs a workshop budget, not a project budget — roughly $2,000 to $15,000 at market rates — and it changes every other decision on this list. A fluent team writes better procurement tests, spots AI-washing faster, and can tell which vendor features are substance and which are demo-ware. The case for why fluency comes before spend runs through our buy-vs-build playbook and the small-firm operating manifesto behind the whole approach.
The Four Ways to Cover the Gap — and What Each One Misses
Once you accept that the five functions need covering, the question is who covers them. There are four common paths, and none covers all five — knowing what each one leaves on your plate is the entire point.
Hire a managed IT provider (MSP). A regional MSP handles endpoint security, backup, Microsoft 365 administration, and a help desk on a monthly retainer — real value for the operations and baseline-security functions. What it misses: MSPs are built for a break/fix hardware world and rarely have an opinion on AI procurement, data-training clauses, or the buy-vs-build decision. They will keep your laptops patched; they will not tell you whether a proptech tool is worth its price.
Lean on your proptech platform’s support. Platforms like Yardi, AppFolio, or Buildium bundle hosting, security, and support for their own product, covering operations and much of governance inside that boundary. What it misses: everything outside the platform — your general AI tools, your Excel models, any cross-system integration, and any workflow the platform does not serve. Platform support ends precisely where your firm’s specific way of working begins.
Retain an AI build partner. A firm that builds custom automation covers integration, ongoing support for what they built, and — if they are honest — enablement. What it misses: a build partner is scoped to the systems they deliver, not your whole software estate, and the good ones tell you when the answer is a subscription rather than a build. The trap is scoping, which is why we wrote up the lessons from scoping automations with non-technical teams: the discovery conversation, not the code, is where these engagements succeed or fail.
Cover it yourself with discipline. The default for most 4–20 person firms is DIY: the owner runs procurement, the contract is the security team, a runbook is operations, and a workshop is enablement. This is often the right answer — it costs habits rather than retainers. What it misses: it depends on the discipline actually being applied, and it has a ceiling. When a workflow gets complex enough that a runbook cannot hold it, DIY has to hand off to a build.
Most small firms end up with a blend: a platform for the core system of record, DIY discipline for general AI tools, and a build partner for the one or two proprietary workflows where the firm’s edge lives. The failure is not choosing the wrong path; it is assuming any single path covers all five and discovering, after a data scare or a silent broken job, that it never did.
The One-Page IT Function Map
The whole reframe fits on one page. Print it, fill in the last column with a name, and you have covered IT without hiring it.
| Function | What it does | Small-firm substitute | Who covers it at your firm |
|---|---|---|---|
| Procurement | Decides what to buy, blocks duplicates | A repeatable buying discipline; prove tools on your data | |
| Security & governance | Protects confidential data | The contract: training, retention, deletion in writing | |
| Operations & support | Keeps tools running | A one-page runbook + named vendor support with response times | |
| Integration | Makes systems exchange data | Prefer tools that read your files; build only when workarounds multiply | |
| Enablement | Makes the team fluent | An LLM fluency workshop on your real work product |
Two things to notice. First, not one substitute requires a full-time technologist — each is a decision, a document, or a day of training. Second, the last column matters most: an unassigned function is a function no one is doing, and the cost surfaces at the worst possible moment, usually as a data question you cannot answer or a report you cannot trust.
The map also clarifies the buy-vs-build call underneath all of this. Buying covers operations and support for you but hides an integration bill inside onboarding; building covers integration and gives you a workflow you own, but you carry support yourself. Neither escapes the five functions — they just distribute them differently, and the right split depends on which workflows are standard to the industry and which are the specific way your firm makes money.
Frequently Asked Questions
Do I need to hire an IT person to use AI safely at a small CRE firm? No. Procurement becomes a buying discipline, security becomes contract terms on data training and deletion, operations becomes a one-page runbook plus named vendor support, integration is minimized by choosing tools that read files you already keep, and enablement is a workshop. A full-time technologist is rarely the answer for a 4–20 person firm; deliberate coverage of each function is.
What is the single most important IT function for a firm handling confidential deal data? Security and data governance, and the substitute is the contract. Before any tool touches an LOI, a rent roll, or investor data, get three answers in writing: whether the vendor trains its models on your data and whether you can disable it, how long data is retained and whether you can force deletion, and who is liable if it leaks. That contract is your security department — no one internal has to be technical.
Should we hire a managed IT provider (MSP)? An MSP is worth it for baseline operations and endpoint security — patching, backup, Microsoft 365 administration, and a help desk. It is not a substitute for AI-specific judgment: most MSPs will not advise you on AI procurement, data-training clauses, or whether to buy or build. Hire one for the plumbing; cover the AI decisions another way.
Can general AI tools like ChatGPT or Claude handle confidential real estate data? The business and enterprise tiers of tools like ChatGPT, Claude, and Microsoft Copilot publish data terms that, by default, do not train on your inputs and let you control retention — verify the current terms for the tier you buy, because consumer tiers often differ. The rule is to read the data terms before the data goes in, not after.
How do we handle software support with no help desk? Keep a plain-language runbook for every tool that does real work: how to confirm it ran correctly, what to do when something fails, and who to call. And when you buy, insist on named vendor support with a response time written into the contract — you are buying somebody else’s operations team, so confirm it exists. When you build, negotiate support explicitly rather than accepting a code handoff.
When does a small CRE firm actually need custom automation instead of off-the-shelf tools? When a workflow is specific to how your firm makes money and off-the-shelf options force you to work their way, or when the workaround spreadsheets and copy-paste between systems have become the job. Standard, industry-wide workflows belong to vendors; proprietary, judgment-heavy, document-heavy workflows are where a build earns its price.
What does it cost to cover these functions without an IT department? Most substitutes cost discipline rather than money — a buying checklist, contract terms, and a runbook are free to adopt. The two paid pieces are enablement and, where justified, a build. Fluency workshops run roughly $2,000 to $15,000 at market rates; custom automation projects commonly run $25,000 to $150,000 depending on scope.
How do I know if a proptech tool is real AI or just marketing? Ask the vendor what the tool does that you could not do yourself with a general AI tool and a good prompt. A real product answers with specifics — connections to your systems, a pipeline trained on real estate documents, a maintained workflow, and support. A thin wrapper deflects or talks only in benefits. A fluent team spots the difference in one conversation.
Who should own the “IT function map” at a small firm? The owner or principal, or a delegate they trust with the checkbook. The map’s whole point is that each function gets a name in the last column. That person need not be technical; they need the authority to insist that no tool goes live with an unassigned function — no unsigned data terms, no missing runbook, no vague support arrangement.
Where to Start
Do not start by hiring anyone. Fill in the last column of the function map for the tools you already run, and see where the blanks are. The blanks — the tool with no signed data terms, the nightly job with no runbook, the workflow held together by copy-paste — are your actual exposure, and they are usually fixable with a contract clause or a one-page document rather than a payroll line.
The next step is to rank the gaps by what they cost you. That ranking is exactly what we build in a free AI-readiness assessment: a working session that inventories the workflows where your hours go to die, checks which of the five functions are exposed, and returns a plain-language plan — including the honest calls about where the answer is a subscription, where it is a workshop, and where it is a build. Book a free AI-readiness assessment if you want that map for your firm. You will leave with a ranked plan whether or not any of it turns into a project.
Arthur Wandzel
