The number is real.

Three independent surveys of CRE-AI pilots in 2024 and 2025 — JLL Tech Pulse, CBRE PropTech Watch, and IFMA Foundation's institutional procurement track — converge on a number that should embarrass the field: roughly nineteen of every twenty AI pilots in commercial real estate fail to clear a six-month renewal review.^[01][02][03] The framing varies — "stalled in pilot," "did not justify renewal," "abandoned post-Phase 1" — but the bottom line does not. The field is shipping demos that do not survive contact with operations.

The diagnosis varies, too, and most diagnoses are wrong. Model quality gets blamed first; sales motions get blamed second; integration scope gets blamed third. None of these are the real problem. We have read fifteen post-mortem decks from owner-operators who killed AI pilots in 2024–2025, and the actual failure pattern is structural in a way the vendor's pipeline never sees.^[04]

"The field is not failing because the models are wrong. It is failing because the architecture surrounding the models cannot compound."

The four root causes below are not novel. They have been described in adjacent fields — observability, search, biotech assay design — for decades. What is novel is that the CRE-AI cohort has imported all four at once, packaged them as features, and sold them to operators who do not have the architectural vocabulary to detect the smell. The result is the 95%.

Silo accretion.

Most CRE-AI vendors did not build an architecture. They built a pipeline. A dashboard here, an alert there, a chatbot bolted on at month four, a "co-pilot" added at month nine, an AI-HVAC module in the next quarter. Each piece is fine in isolation. The aggregate is brittle, because nothing was designed against the existing system — only against a slide deck.

Silo accretion produces a predictable failure curve. The first detection works in pilot because it is the only detection. The second detection works almost as well because it is paired with one earlier piece. By the fifth detection, every operator complaint sounds like "why doesn't this connect to that?" and every vendor sprint sounds like "we need to write an integration". The compound rule fails — fleet-level intelligence does not amplify; it fractures.

The fix is not better integration tooling. The fix is a coherence gate at the substrate layer that refuses to land any new piece without proving it composes with everything before it. We run a five-gate Coherence Loop on every upgrade^[05] — manifest validity, surface-conflict scan, cross-reference lint, golden-corpus smoke test, Expert Council broadcast. If any gate fails, the upgrade does not pause; it auto-queues for repair and tries again. The OS stays one OS no matter how many detections land.

Paraphrase drift.

The dominant LLM-knowledge failure mode is not hallucination. It is hardened-incorrect-summary: a confident paraphrase, written once, then quoted back to itself across iterations until the original source disappears. By cycle ten, the model is collapsing on its own output. The phenomenon was formalised in the model-collapse literature in 2024 and has been replicated against ICLR 2025 anti-collapse benchmarks across every major foundation model.^[06][07]

What CRE-AI vendors have done is import this failure mode directly into their operating layer. A vendor's CRE knowledge engine summarises ASHRAE Guideline 14 in week one. The summary lands in the agent's prompt context. By month three, the original ASHRAE document is no longer in the loop — only the paraphrase, plus a few rewrites of the paraphrase. By month six, the engine is confidently citing numbers that nobody can trace back to a primary source. Anchor density drops below 50%; orphan claims exceed 25%; the operator's confidence in the system collapses with the underlying provenance.

"By month six, the engine is confidently citing numbers that nobody can trace back to a primary source. Trust dies on that timeline, every single pilot, exactly as predicted."

The fix is not better summarisation. The fix is an immutable raw landing layer with content-addressed SHA-256 hashes, file-permissions chmod 444, and a per-claim citation contract enforced at the brain-write boundary.^[08] Every numeric claim must carry an inline anchor of the form [Source: raw/{domain}/{hash}] or it is quarantined as tentative until it earns one. Tentative claims live in a separate section. Append-only ledgers grow but never shrink. The field has the tools — they have just been used to dress demos rather than govern operations.

Alert overload.

Operator dashboards are graveyards of weak signals. Twenty alerts a day, three of them real, none of them prioritised — and the operator learns within a week to ignore the whole stream. We have watched this happen in three different CRE pilots in the last twelve months. The operator does not consciously choose to ignore the system; the system trains them to, by punishing attention with noise.^[09]

The vendor's metric for the dashboard usually optimises for the wrong axis. Alert volume is mistaken for value because alerts are easy to count. Time-to-decision is the metric that actually matters, and it is rarely measured. By month four, the vendor's quarterly review shows 14,000 alerts surfaced; the operator's quarterly review shows the same dashboard on the same browser tab being closed every morning because none of the alerts compounded into action.^[10]

The fix is the inverse default. Stillness over noise. A weak signal is not a signal. A low-confidence recommendation is not delivered. Every consequential recommendation passes a Bayesian gate before it reaches an operator: posterior must clear 0.60, self-efficacy must clear 0.50, otherwise the system stays quiet and queues clarifying questions instead.^[11] Suppressed alerts are published on the receipts ledger so the operator can audit the suppression. Stillness is the harder discipline. It is also what makes the dashboard worth opening on day 180.

Vendor-KPI gaming.

The fourth root cause is the most uncomfortable: most CRE-AI vendors are paid against KPIs that customers can't independently verify. Cleaning vendors report 97% inspection-pass rates while occupant NPS for cleaning runs negative on the same floor. Construction managers report 87% schedule completion against earned-value baselines while last-planner percent-plan-complete on the same activities sits at 54%. Energy-performance contracts report verified savings against baselines the vendor selected.^[12][13]

This is not necessarily fraud. It is a measurement system whose KPIs are gamed by the people whose pay depends on hitting them. Goodhart's Law in a $9 trillion asset class. The vendor's quarterly report says everything is green; the operator's experience says nothing is. The pilot fails not because the AI is wrong but because the AI has been pointed at the gameable metric and ignored the un-gameable one.

The fix is what we call KPI-Theater detection. The OS continuously cross-checks every vendor-reported KPI against an independent un-gameable signal — occupant NPS, work-face progress, IPMVP CV(RMSE), code-trigger lookups — and surfaces statistically significant divergence as a Theater alert.^[14] The detection does not punish the vendor; it surfaces the divergence to the owner with three-source evidence so the SLA conversation is data-led, not vibes-led.

Substrate, not surface.

If the four root causes are structural, the fix has to be structural. Not better demos, not bigger sales teams, not a fresh round of integrations. Four substrate gates running underneath every consequential decision the OS makes:

One — Coherence Loop.

Five-gate audit on every upgrade before it lands. Manifest validity, surface-conflict scan, cross-reference lint, golden-corpus smoke test, Expert Council broadcast. No silo accretion.^[05]

Two — Provenance Hardening.

Immutable raw/ landing per domain. Content-addressed SHA-256. Per-claim citation anchor enforced at brain-write boundary. ICLR-2025 anti-collapse audit runs daily. No paraphrase drift.^[08]

Three — Adversarial defaults.

Pessimism Gate inverts ship-gate default for four scoped output classes (trade proposals, deal recommendations, engineering calculations, public claims). BLOCK by default, two affirmative-evidence signals required to flip to PASS. Expert Council (Harper, Benjamin, Lucas) holds veto power. No unverified output.^[15]

Four — Stillness gates.

Bayesian posterior + self-efficacy thresholds before any recommendation reaches the operator. Suppressions published on the public ledger. No alert overload.^[11]

On top of those four substrate gates sit nine named detections — keystone CRE-KE Claim Classifier, plus eight production squads — each with its own Tier-1 standards anchor (ASHRAE, IPMVP, CORENET X, AACE TCM, NFPA, IBC). The detections fire only when the failure mode is real. Each result has a citation chain back to a Tier-1 source. Each result is published.

The only honest pilot artifact.

What separates the surviving 5% from the failed 95% is not the model. It is whether the operator can, six months in, point at a citation chain that produced an action. Vendors who built around demos cannot show this. Vendors who built around substrate can. The receipts page is our test of that distinction made public.^[16]

If a CRE-AI vendor will not publish their operating receipts, treat that as a primary data point. If they will, read the receipts before the pitch deck. The receipts will tell you whether you are looking at the 5% or the 95% inside thirty minutes — long before the procurement cycle starts.

"If your AI vendor cannot show you a coherence-gate audit log, a per-claim citation chain, or a public ledger of suppressed alerts — they are not selling you an operating system. They are selling you a feature collection."

The 95% is the field's mirror. We do not think the field will close it by trying harder on the same demo. We think the closure runs through the substrate. One OS, not silos. Provenance over polish. Adversarial by default. Stillness over noise.^[17] Four invariants. Five years. The pilot that survives renewal review is the pilot whose architecture obeys the four. Everything else compounds the gap.