On this page
The problem: fewer people, higher pay, and the law sits where automation starts
- 8% fewer
US accommodation jobs in September 2026 than in September 2019: 1.92 million against 2.08 million (our arithmetic)[2]
- 41% more
Average hourly pay in accommodation, $25.35 in August 2026 against $17.98 in August 2019 (our arithmetic)[3]
- About 90%
Gross operating profit per available room against 2019, held down by rising operating costs[42]
- 10.1%
Accommodation and food services businesses using AI in a two-week period, against 23.8% of all US businesses[1]
US hotels run with fewer people than before the pandemic and pay each of them far more. Quits in accommodation and food services run at 3.5% a month, against 2.1% across private industry[4], so a short team also keeps training new people. The work that eats their hours is familiar: the same questions about parking and check-in time, reservation changes, RFPs, banquet orders and their revisions, room status calls between housekeeping and the desk, invoices, the night audit, the owner report.
Hotels have been slow to hand that work to AI. In the Census Bureau's survey only agriculture and mining reported lower AI use than accommodation and food services[1]. That figure lumps hotels in with far more numerous restaurants and counts a single motel the same as a chain, but the gap to the national rate is wide.
The sector's most consequential AI story so far is a court case. On 29 July 2026 a federal appeals court revived a price-fixing suit against Atlantic City casino-hotels that allegedly accepted their pricing software's rates 90% of the time and made overriding it hard[25]. The first things automation reaches in a hotel (quoting a price, selling a room, filling a housekeeping board, changing a rate) are already regulated by the FTC, the ADA, state emergency pricing laws and city hotel laws. An AI-native hotel group lets agents do that work inside those rules at every hotel, and keeps the records to show a regulator, an owner or a plaintiff's lawyer what happened.
The short version: 60 seconds
AI-enabled vs AI-native
Each hotel switches on the chatbot in its messaging tool and the autopilot in its revenue system. Every vendor keeps its own copy of the facts, nobody owns the limits, and the org chart stays the same.
The group decides once which facts, prices, limits and rules every agent must use at each hotel, who approves what, and what gets recorded. Then it changes jobs around that: fewer people answering repeat questions, more on the floor, in sales and in approvals.
One way to tell them apart: a guest says the chatbot quoted $199 and the folio says $238. An AI-native group can show which fact sheet the agent used, who approved it and whether the fee was in the answer, for any hotel, in minutes.
The missing layer: where OrchKernel fits
No hotel group will replace its PMS, central reservations, revenue system or sales and catering system to become AI-native, and at a branded hotel it often cannot. It will add agents that work across those systems. Those agents need the hotel's rules, someone to approve what matters, limits on what they can see, and a record. None of the existing systems covers an agent working across all of them.
OrchKernel is built to be that layer. It connects to the PMS, CRS, RMS and sales system and does not replace them; they remain the record for reservations, folios, rates and loyalty. Details are in the OrchKernel blueprint.
- Guest messaging and webchat
- AI voice reservations
- Sales and catering drafts
- Rate and restriction changes
- Housekeeping and work orders
- Invoices and owner reports
- Rules per hotel and jurisdiction
- Approvals by named role
- Acting on one person's authority
- Data access by role and field
- Human queue
- Tamper-evident log
- PMS and folios
- Central reservations and brand systems
- Revenue management
- Sales and catering, RFP channels
- Service, housekeeping, labor and payroll
- Payments, purchasing and accounting
Who decides what in a hotel: brand, owner, operator
In most hotels three companies have a say over any change in how work is done. Hilton, for example, counts 9,158 properties: 873 managed, 8,239 franchised and 46 owned[12]. Marriott manages the employment of about 414,000 associates, of whom about 266,000 are employed by hotel owners rather than by Marriott[10]. The people an agent works beside are often employed by a company whose name is not on the building.
- Brand
The franchisor. Marriott operates 2,017 of its 9,805 properties and franchises or licenses 7,644[10].
Sets- Brand standards and approved systems
- Central reservations, brand.com and loyalty
- Content and rate rules for brand channels
How it is paid: Franchise fees, typically 4% to 7% of rooms revenue at Marriott, plus reimbursed programs[10]. - Owner
Holds the real estate and the P&L. DiamondRock had 35 corporate employees for 35 hotels; hotel staff work for the managers[8].
Sets- Budgets and capital spending
- Approval of significant contracts and leases
- What it wants reported, and how often
How it is paid: Keeps the hotel's operating profit after fees, and carries the risk. - Operator
The management company, often a third party running a franchised hotel. It employs the staff under a management agreement of 10 to 50 years[6].
Sets- Hiring, schedules and labor rules
- Daily process at the desk, in housekeeping and in sales
- Which tools staff use day to day
How it is paid: Base fee of 2% to 3% of gross revenue, plus an incentive fee of 10% to 20% of operating profit[6].
It may only use systems the brand allows, may only commit money inside the owner's approvals, and acts for the operator's staff. A change to how an agent works at a branded, managed hotel can need sign-off from three companies.
What this means for AI. A GM cannot switch on a new tool because it looks useful. An AI-native group writes down, per hotel, whose rule applies to each agent action, and updates that list when a hotel changes flag or owner.
Where the hours and money go
Public hotel REITs give the clearest view of a full-service hotel's economics. Host Hotels & Resorts and DiamondRock own upper-upscale hotels run by Marriott, Hyatt and independent managers. Their 2025 statements, with our arithmetic[7,9]:
Two pools hold most of the work agents can take on: about a quarter of every rooms dollar, mostly desk and housekeeping labor, and about a quarter of all revenue in undistributed costs, where the phones, sales admin, accounting and reporting sit.
The labor squeeze sits under all of it. The industry employs 420,800 maids and housekeeping cleaners and 247,700 desk clerks, at a median of about $16.80 an hour[5]. Local wage floors go further: in Los Angeles, hotels with 60 or more rooms pay at least $25.00 an hour plus a $4.25 health benefit from July 2026[40].
Who keeps the savings. In a managed hotel the owner pays the staff, so labor savings raise the owner's profit. The operator earns a base fee of 2% to 3% of gross revenue and an incentive fee of 10% to 20% of operating profit, under agreements that run 10 to 50 years[6], so it shares in savings through the incentive fee and by keeping the contract. The brand's franchise fees, typically 4% to 7% of rooms revenue at Marriott[10], do not move with costs. We expect owners to ask for AI plans in the budget and for the operator to show results.
Distribution is the other cost. Marriott says intermediary bookings cost hotels more than its direct digital channels, and loyalty members booked 75% of its US room nights in 2025[10].
The stay end to end, and where AI already works
Six stretches of work run through a full-service hotel, from setting tomorrow's rate to sending the owner the month's numbers. At each one, some work is already sold and running, some is ready for drafts a person approves, and some should stay with a person.
- 01Demand and pricing
- AI works today
Forecasts and rate recommendations by night and room type
- AI drafts, person approves
Rate and restriction changes inside set limits; group displacement summaries
- Person only
The limits themselves, overrides, any rate after a declared emergency
Tools: Revenue management systems
- AI works today
- 02Booking
- AI works today
Answers on rates, fees and policies from approved facts; simple modifications
- AI drafts, person approves
Refunds, rate exceptions, waived cancellation fees
- Person only
Accessibility needs, service animal questions, identity doubts
Tools: Webchat, AI voice, central reservations
- AI works today
- 03Group sales and events
- AI works today
RFP intake, date and space checks against the diary
- AI drafts, person approves
Proposals, contracts on standard terms, banquet event orders and revisions
- Person only
Concessions, clause changes, allergen changes, guarantees
Tools: RFP marketplaces, sales and catering systems
- AI works today
- 04Pre-arrival and stay
- AI works today
Confirmations, upsells, check-in, guest requests by message
- AI drafts, person approves
Make-goods and credits for complaints
- Person only
Keys, folio disclosure, safety, welfare and medical calls
Tools: Messaging, mobile check-in, PMS
- AI works today
- 05Rooms operations and labor
- AI works today
Room status between housekeeping and the desk; work order routing
- AI drafts, person approves
Room assignment boards, schedules from forecasts
- Person only
Publishing boards and schedules where workload, notice or union rules apply
Tools: Housekeeping, service and labor tools
- AI works today
- 06Back office and owner
- AI works today
Invoice matching, night audit exceptions, daily revenue checks
- AI drafts, person approves
Owner reports and variance notes, capital request packs
- Person only
Spend above budget, new vendors, what goes to the owner
Tools: Accounting, procurement, BI
- AI works today
Who sells it
We list categories and a few examples, not recommendations. Every performance figure below is the vendor's own claim.
- Property management systems adding agents. Mews launched guest messaging and automations on 1 October 2026 so general managers can set their own workflows[48]. apaleo sells an API-first PMS with an app store of AI agents and says one operator, Numa, automated "over 80% of its internal processes"[49].
- Guest messaging, webchat and AI voice. Canary says more than 20,000 hotels use its check-in, messaging, payments and AI voice and webchat[46]. HiJiffy says its AI handles up to 90% of guest conversations without staff and answers only from verified knowledge[47].
- Revenue management. IDeaS says more than 34,000 properties use it[45].
- Operations, service and labor. Actabl combines service and housekeeping, labor management, business intelligence and maintenance tools[50]. Optii plans room attendant routes[51].
- Group sales and events. Cvent runs an RFP marketplace for meeting planners and hotels[52]. We found no public data on how well AI performs in group sales.
The brands are moving carefully. Marriott is adding AI to some processes, warns that AI output can be "factually inaccurate, misleading or otherwise flawed", and is partway through a multi-year transformation of its reservations, property management and loyalty systems[10].
Where the money went
Capital went to hotel software. Mews raised $110 million at a $1.2 billion valuation in March 2024 and $75 million more in March 2025[55]. Lighthouse raised $370 million at a $1 billion valuation in November 2024[56].
Tech-forward operators had mixed results. Sonder ran app-based, staff-light apartment hotels. In 2025 its booking moved onto Marriott's platforms, its revenue fell 10.6% in the second quarter, and it reported substantial doubt about continuing as a going concern[16]. Marriott ended the license on 7 November 2025 and Sonder filed for Chapter 7 liquidation on 14 November[17]. A lean, software-run operation did not fix lease-based unit economics. citizenM, a self-service select-service brand, was bought by Marriott for $355 million plus up to $110 million in earn-outs, with 36 open hotels and 8,544 rooms[11]. The value went to a brand with distribution.
The OTAs are worried about AI agents. Booking Holdings warns that AI assistants and agents that search, compare and book travel "may reduce consumers choosing to visit dedicated online travel platforms"[13]. Expedia says generative and agentic AI "is likely to further intensify competition"[14]. Uber began selling hotels in its US app through Expedia, with AI voice booking, in April 2026[54]. If AI assistants become where guests shop, the hotel's own facts, total prices and accessible-room details have to be right in every feed those assistants read.
We found no AI-native hotel management company at scale. The likely candidate is an existing management company that already holds the brand approvals, the owner contracts and the staff, and changes how its hotels work.
The staged path
Six stages. Start with facts and prices, because most of the failures below start there. Then the guest-facing volume where vendors already work, then group sales, then rooms operations and labor where city law applies, then revenue where antitrust applies, then the back office and the org chart. Durations are rough for a group of 10 to 100 hotels, and different hotels can be at different stages.
- Stage 0Hotel facts, prices and rules
Write down, per hotel, what is true, what it costs and which rules apply.
- Stage 1Guest questions, messages and booking changes
Answer and change bookings from approved facts. Anything with money is a draft.
- Stage 2Group sales and events
RFP to proposal to banquet event order, with every commitment approved.
- Stage 3Rooms operations, maintenance and labor
Coordinate housekeeping, work orders and schedules inside local and contract rules.
- Stage 4Revenue and distribution
Agents apply rate changes inside limits a named person sets, and stop in emergencies.
- Stage 5Back office, owners and the operating model
Night audit, invoices, close and owner reporting, then the org chart.
- 0
Stage 0: Hotel facts, prices and rules
Write down, per hotel, what is true, what it costs and which rules apply.
About 4 to 8 weeks for the first group of hotels
What to do
- One approved, dated fact sheet per hotel: room types, every mandatory fee, pet and service animal policy, accessible room features by room type, deposit and cancellation terms.
- A rule map per hotel: fee display, emergency pricing, bot disclosure, call and text consent, housekeeping and scheduling rules, panic buttons, training, union terms on technology.
- An inventory of AI features already switched on in every system. Many arrive in a vendor update that nobody chose.
- What the brand requires and what the owner must approve, per hotel.
Why now
The FTC fee rule has applied to hotels since 12 May 2025[19]. Every answer an agent gives about price is an advertised price, and an agent repeats whatever it is fed.
In place first
- A named owner for each fact sheet, and the GM's sign-off.
What to measure
- Hotels with an approved fact sheet dated in the last 90 days
- Channels that show the total price, including every mandatory fee
- Accessible room types with a full feature description
Common mistakes
- Letting each vendor keep its own copy of the facts, so the webchat, the voice agent and the OTA listing disagree.
- Leaving accessible room details to a brand template that does not describe the actual room.
- 1
Stage 1: Guest questions, messages and booking changes
Answer and change bookings from approved facts. Anything with money is a draft.
Starts once the fact sheets for the pilot hotels are approved
What to do
- Messaging, webchat and voice that answer only from the fact sheet, with the bot disclosed.
- Simple modifications such as dates, arrival time and special requests.
- Drafts for a person to approve for anything involving money: refunds, waived fees, credits.
- An identity check before revealing a room number, folio or points.
- A human queue for safety, accessibility requests and anything the agent is unsure of.
Why now
Vendors already run this at scale: Canary says more than 20,000 hotels use its tools (vendor claim)[46]. The main risk is wrong facts, which Stage 0 fixes.
In place first
What to measure
- Median time to a correct first reply
- Share answered without staff, and the hand-off rate with reasons
- Price, policy and accessibility accuracy on a weekly sample read by a person
Common mistakes
- Measuring the automation rate and never reading the answers.
- Letting the agent invent make-goods to calm a complaint.
- Treating messages that arrive through an OTA channel as trusted instructions.
- 2
Stage 2: Group sales and events
First stage that drafts contractsRFP to proposal to banquet event order, with every commitment approved.
Can run alongside Stage 1 with one sales team
What to do
- RFP intake with date and space checked against the diary, and a displacement summary for the revenue manager.
- Proposal and contract drafts on standard terms; option-date follow-ups.
- Banquet event order (BEO) drafts and revisions with every change marked.
- Pickup tracking against the block and attrition statement drafts.
Why now
The work is document-heavy and repetitive, and each final step already has a human approver. Food and beverage was 25% to 30% of hotel revenue at Host and DiamondRock in 2025 and kept about 32 cents of each dollar (our arithmetic)[7,9]. A wrong guarantee count comes off the owner's margin, and a missed tree-nut allergy on a revised BEO can send a guest to the hospital.
In place first
- Clean diary and space data, and standard clauses with the ones a draft may never change marked.
- Allergen and dietary needs as their own fields on the BEO, not free text.
What to measure
- RFP response time; BEO errors caught before the event; attrition collected against attrition due
- No public benchmark exists for any of these, so record your own baseline
Common mistakes
- A draft that changes a clause without saying so.
- Allergen changes lost between BEO versions.
- Proposals sent before the revenue manager has approved the group rate.
- 3
Stage 3: Rooms operations, maintenance and labor
First stage that touches a worker's loadCoordinate housekeeping, work orders and schedules inside local and contract rules.
After Stage 0's rule map has been checked by HR and counsel for each city
What to do
- Room status between housekeeping and the front desk without phone calls.
- Room assignments and schedule drafts inside local workload, daily-cleaning, notice and union rules.
- Work order intake and routing; preventive maintenance reminders.
Why now
Housekeeping is the largest job in the industry[5], and the radio calls between housekeeping and the desk about which rooms are ready are time a short team does not have.
In place first
What to measure
- Room-ready time, inspection pass rate, overtime, late schedule changes, work order days
- No public benchmark for minutes per room or hours per occupied room
Common mistakes
- Optimizing credits past a local cap to cut overtime.
- Publishing schedules without a person looking at them.
- Ignoring the union contract's notice clause for new technology.
- 4
Stage 4: Revenue and distribution
Where antitrust and emergency pricing law applyAgents apply rate changes inside limits a named person sets, and stop in emergencies.
After counsel has reviewed the pricing tools and what data they use
What to do
- Agents apply rate changes only inside floors, ceilings and step sizes a named revenue manager sets.
- An emergency flag per hotel that holds every increase for a person.
- Total price on every channel, including AI assistants.
- A monthly review of override rates and reasons, by hotel and person.
Why now
After the Atlantic City ruling[25], who sets the limits and how often people override the software is part of the legal record. Set that up before an agent touches a rate, not after a subpoena.
In place first
- Documented limits per hotel, with a named owner.
- The vendor's written answer on whether its models use other hotels' non-public data, and counsel's review.
What to measure
- RevPAR index against the competitive set (a paid STR benchmark)
- Override rate and reasons; a rate near zero usually means nobody is looking
- Emergency-flag events and what happened to rates during them
Common mistakes
- Turning on the revenue system's "autopilot" with the vendor's default limits, so it pushes rates to the channel manager without passing any of your rules.
- Making an override harder than accepting the recommendation.
- Feeding the agent scraped or shared competitor data that is not public.
- 5
Stage 5: Back office, owners and the operating model
Night audit, invoices, close and owner reporting, then the org chart.
After two or three quarters of stable results in Stages 1 to 4
What to do
- Invoice matching, night audit exceptions and daily revenue reconciliation.
- Owner report drafts with variance notes, and capital request packs.
- Cluster roles and a hotel standards and systems owner; a quarterly review of agent rules with owners and brands.
Why now
Undistributed and other costs, which include admin, sales, IT, repairs and utilities, were about 24% of hotel revenue at Host and DiamondRock in 2025 (our arithmetic)[7,9], and owners hold approval rights over budgets and significant contracts[6].
In place first
- Approval limits per owner, taken from each management agreement. They differ.
What to measure
- Days to close, invoice exceptions, owner reports on time
- Gross operating profit per available room against 2019; the industry is at about 90%[42]
- No public benchmark for close days or departmental cost per occupied room
Common mistakes
- One approval limit for every owner.
- Changing the org chart before owners know; they will see it in the payroll lines first.
Your first 90 days
Stage 0 for a handful of hotels, then Stage 1 and a slice of Stage 2. Pick hotels that make the rules easy to learn: one or two brands, one or two states, owners who will engage.
- Days 1 to 30
Pick 3 to 6 hotels. Build approved fact sheets with every fee and accessible-room detail. Map each hotel's rules. Inventory the AI already switched on. Name the approvers per hotel: GM, manager on duty, revenue manager, director of sales, catering manager, housekeeping manager, controller. Agree with each owner which approvals they keep. Record a baseline for response time, RFP turnaround and BEO errors.
- Days 31 to 60
Put a control layer (for us, OrchKernel) between agents and the PMS, messaging and sales systems for those hotels. Turn on guest questions and simple booking changes, with drafts for anything involving money. Start RFP intake and proposal drafts with one sales team. Read 50 guest conversations a week for price, policy and accessibility accuracy, and record every hand-off and its reason.
- Days 61 to 90
Add BEO drafts and revisions with approval, and room status between housekeeping and the desk. Set the emergency pricing flag and override reporting now, before any agent changes a rate. Compare the pilot with the baseline and decide what to widen and what to stop.
How jobs change
This is our reading of the evidence, not a survey finding. The industry is still hiring: AHLA expects more than 30,000 added hotel jobs in 2026[42]. The evidence points to the same people doing different work more than to fewer people.
- 1
Front desk
Self-service check-in and messaging take routine transactions. Desk agents spend more time on problems, VIPs, accessibility needs and safety, and on approving the credits and changes agents draft. In New York City someone must still cover the desk continuously and confirm guests' identity[39].
- 2
Housekeeping
The work stays human. What changes is coordination: room status, assignments and inspection routes. Local workload and daily-cleaning rules decide how far the board can be optimized, and the housekeeping manager owns it.
- 3
Revenue management
Less time pushing rates, more time setting limits and reviewing overrides. After Atlantic City, who sets the limits and how often they are overridden is part of the job's legal record.
- 4
Sales and catering
Agents take RFP intake, date checks, first drafts and follow-ups. Sales managers spend more time with planners and on the terms that matter; catering managers approve every BEO change.
- 5
Cluster finance
Night audit exceptions, invoice matching and report drafts move to agents, so one controller covers more hotels. The controller decides what goes to each owner.
- 6
A new role: hotel standards and systems owner
Someone has to keep each hotel's fact sheet, fees, accessible-room details, policies, city rules and agent settings current across brand standards. In a small group it is part of an existing job; in a large one it is a team.
What not to fully automate
An agent can prepare each of these. A named person with authority at that hotel decides, and the decision is recorded.
The rules that bite
Seven groups of rules recur across hotel groups: the total price, pricing software, emergency pricing, accessibility in booking, guest data and payments, honesty about bots and consent for calls, and workplace rules for housekeeping, scheduling and safety. Each one lands on something an agent does.
Showing the total price
- United States (FTC)
- Since 12 May 2025 a business offering short-term lodging may not show any price without clearly and conspicuously showing the total price, and the total must be more prominent than other prices[18,19]. In the FTC's own example, a $199 nightly rate with a mandatory $39 resort fee must be shown with the fee in the total. Taxes may come later but before payment, and when a guest picks options that change the rate, the total must update[20].
- California, Colorado
- California requires advertised prices to include all mandatory fees except government taxes, from 1 July 2024[21]. Colorado's HB25-1090 requires total price disclosure from 1 January 2026, with no exemption for hotels[22].
- New York City
- City rules require the total price in any offer for a stay in the city and a fee breakdown before payment, including on third-party travel sites. From January 2027 hold and deposit terms must be disclosed too[39].
- Resort fee litigationPart to be confirmed
- Private suits over resort fees have been brought against Hyatt and Hilton in the District of Columbia[23]. State attorney general settlements are to be confirmed.
For agents: Every chatbot answer, voice quote, offer email and listing on an AI assistant is an advertised price. A rule should block any price message that does not carry the mandatory fees.
Pricing software and antitrust
- Third Circuit (Atlantic City)
- On 29 July 2026 the court revived price-fixing claims against Atlantic City casino-hotels using the same revenue software. The plaintiffs alleged 90% acceptance of its recommendations, an override reserved for "need and extreme circumstances", scoring of each hotel's overrides, and access to each other's non-public data. This is a ruling on the pleadings, not a finding of liability[25].
- Ninth Circuit (Las Vegas)
- On 15 August 2025 the court affirmed dismissal of similar claims against Las Vegas Strip hotels, where the software did not share any hotel's confidential information and no agreement was alleged. A footnote warns that not being required to accept recommendations would not protect hotels that all agreed to follow them[24].
- California
- AB 325 makes it unlawful to use or distribute a "common pricing algorithm" (one used by two or more people that uses competitor data to recommend or set a price) as part of a conspiracy, or to coerce someone to adopt its recommended price[26]. It was chaptered on 6 October 2025 with no urgency clause, so under the state constitution it took effect on 1 January 2026[27].
For agents: The difference between the two cases is in facts a hotel group controls: who sets the limits, how easy it is to override, and whether competitors' non-public data goes in. A pricing agent that applies recommendations automatically and makes overrides hard recreates the Atlantic City allegations.
Emergency pricing
- California
- After a declared state or local emergency, a hotel or motel may not raise its regular rates by more than 10% for 30 days, with exceptions for added costs and regular seasonal changes. It is a misdemeanor punishable by up to one year and $10,000[28], and the Attorney General can seek civil penalties of up to $2,500 per violation[29].
- FloridaPart to be confirmed
- During a declared emergency it is unlawful to rent at an "unconscionable price" essential commodities or "any dwelling unit or self-storage facility" needed because of the emergency[30]. The text does not mention hotels or transient lodging, so whether it reaches a hotel room is to be confirmed with counsel.
For agents: A revenue system set to follow demand will raise rates by itself after a hurricane or wildfire. Set an emergency flag per hotel that holds every increase for a person, and decide who may switch it on at 2 a.m., before any agent touches rates.
Accessibility in booking
- United States (ADA)
- Hotels must let people with disabilities reserve accessible rooms in the same way and during the same hours as others, describe accessible features in enough detail for a guest to judge independently whether the room meets their needs, hold accessible rooms until other rooms of that type are gone, and guarantee the specific accessible room reserved. Staff may ask only two questions about a service animal, and may not charge a fee for it even where pets pay[31].
- Litigation
- One tester filed more than 600 suits against hotels over missing accessibility information on reservation websites. The Supreme Court dismissed her case as moot in December 2023 without deciding whether she could sue[32].
For agents: An AI booking agent, voice agent or chatbot is a reservation channel. It must be able to book accessible rooms, describe their features from approved data, and never quote a pet fee for a service animal.
Guest data, cards and social engineering
- FTC order against Marriott and Starwood
- After the Starwood breaches (see when it goes wrong), the 2024 order requires a security program with assessments every two years, data minimization, deletion on request and review of loyalty accounts, with obligations running 20 years; Marriott also paid $52 million to 49 states and DC[33].
- Card data
- PCI DSS v4.0 replaced v3.2.1, and its new requirements became effective after 31 March 2025[43]. Card numbers sent in emails, chats and group credit authorization forms are a familiar gap.
For agents: A guest-facing agent that can reveal a room number, send a payment link or reset access is a new target for the same tricks. It needs identity checks and the fewest guest fields it can work with.
Bots, AI voice and consent
- California
- It is unlawful to use a bot to mislead someone about its artificial identity to drive a sale, unless it discloses that it is a bot in a clear and conspicuous way[35].
- United States (FCC)
- AI-generated voices count as "artificial" under the Telephone Consumer Protection Act, which requires prior express written consent for telemarketing robocalls[36].
- European UnionPart to be confirmed
- Article 50 of the AI Act requires telling people they are dealing with an AI system unless it is obvious. The tracker we used shows it applying from 2 August 2026[44]. Whether the Digital Omnibus changes that timing is to be confirmed.
- Liability for what the bot saysPart to be confirmed
- A Canadian tribunal held Air Canada to its chatbot's wrong answer about a fare policy and rejected the idea that the bot was a separate entity, according to a secondary summary; we did not open the decision itself[57]. We know of no published hotel case yet, but a hotel bot quoting cancellation terms is in the same position.
For agents: Disclose the bot on every conversation and call. No outbound AI call or marketing text without consent on record.
Housekeeping, scheduling and safety
- New York City
- Local Law 104 of 2024, in force from 3 May 2025, requires a license for each hotel. Occupied rooms must be cleaned daily unless the guest declines, with no fee or incentive to decline. The desk must be covered continuously. Hotels of 100 or more rooms must employ housekeeping, front desk and bell staff directly or through a single operator. Staff who enter occupied rooms get panic buttons, and trafficking training within 60 days of hire. Room assignment reports and cleaning logs are kept for three years[39].
- Washington and California
- Washington requires a panic button for each isolated hotel employee, simple to use without a password, plus a harassment policy and training[37]. California requires at least 20 minutes of trafficking awareness training for hotel staff likely to meet victims, within six months of hire and every two years[38].
- Chicago
- The Fair Workweek ordinance names hotels as a covered industry. It applies to employers primarily in a covered industry with 100 or more employees (250 for nonprofits) and at least 50 covered employees, and requires schedules 14 days ahead and predictability pay for late changes[41].
- Los AngelesPart to be confirmed
- Hotels with 60 or more rooms (50 near the airport) pay a hotel worker minimum wage of $25.00 an hour plus a $4.25 health benefit from 1 July 2026[40]. The city's housekeeping workload limits and panic-button rules are to be confirmed; we could not open the ordinance text.
- ElsewherePart to be confirmed
- Panic-button laws in Illinois, New Jersey and other cities, and technology clauses in hotel union contracts such as the 2023 Las Vegas agreements, are to be confirmed. AI tools used to screen hourly applicants fall under the AI hiring laws covered in our staffing playbook.
For agents: Local rules decide how far an optimizer may go. A room-assignment agent must apply credits, daily-cleaning and notice rules before any board is published, and a person publishes it.
Records to keep, and what to minimize
- Every rate change, the limits in force and who set them, and every override with its reason. That is the evidence for both antitrust and emergency pricing questions.
- The price each guest was shown, with its fees.
- Accessible-room descriptions and holds, with dates.
- In New York City, three years of hotel license records, including room assignment reports, cleaning logs and panic-button records[39].
- Fewer guest identity and payment fields in agent hands, and deletion on schedule, as the Marriott order and PCI expect[33,43]. Guest registry retention rules by state and city are to be confirmed.
When it goes wrong
Real cases first, with what each teaches a hotel group.
Atlantic City casino-hotels and their pricing software
Revived on appeal in July 2026 on allegations of near-automatic acceptance, hard overrides and pooled non-public data; not a finding of liability[25]. Similar claims against Las Vegas Strip hotels were dismissed a year earlier[24]. Details are under pricing software and antitrust.
The lesson: The difference sits in facts a hotel group controls. A named person sets price limits, overrides stay easy and are recorded, and no competitor non-public data goes in.
MGM Resorts cyberattack
MGM estimated a hit of about $100 million to Adjusted Property EBITDAR at its Las Vegas Strip resorts, plus under $10 million in one-time costs, and said some guest personal data was taken[15].
The lesson: Any person or agent that can reset access or reveal guest data needs identity checks and limits.
Marriott and Starwood breaches
339 million guest records in one breach, 5.25 million unencrypted passport numbers, and an FTC order with 20 years of compliance obligations that requires data minimization[33].
The lesson: Agents should see the fewest guest fields they need. Passports and cards stay out of agent context.
Booking.com-themed phishing aimed at hotel staff
Staff likely to work with Booking.com were sent lures that installed credential-stealing malware, with financial fraud as the aim (vendor research)[53].
The lesson: Messages arriving through OTA channels are untrusted input. Payment links and card requests come only from approved templates.
600 suits over hotel booking websites
One tester sued hotels more than 600 times over missing accessible-room information on reservation sites[32].
The lesson: Every AI booking channel inherits the accessibility rules. It must carry the accessible-room facts.
We did not find a published case of a hotel chatbot or voice agent held to a wrong price or policy, of an AI housekeeping tool breaking a workload law, or of enforcement over a revenue system raising rates in a declared emergency. We do not claim these have happened. The scenarios below are what an agent with too much access could do.
Agent failures to design against
Each is a scenario, not a reported case, and each maps to one of the control points.
One scenario, step by step: a rate change during a wildfire
- 01Limits set· People and systems
The revenue manager sets floors, ceilings and a maximum daily move for each hotel, logged under her name.
- 02Emergency flag· People and systems
At 2 a.m. the county declares a wildfire emergency. The night manager sets the emergency flag on both California hotels.
- 03Proposed change· AI agent
Demand jumps. The revenue system recommends +35% for four nights, and the agent prepares the change.
- 04Check· OrchKernel
The emergency flag is on, so the rule holds every increase for a person. This one is also above the 10% cap.
- 05Decision· People and systems
At 7 a.m. the revenue manager keeps rates where they are and adds a block for evacuees.
- 06Record· OrchKernel
The recommendation, the hold, her decision and her reason go into the tamper-evident log.
The OrchKernel blueprint for a hotel group
OrchKernel is the layer between AI agents and the systems your hotels run on, as drawn in the missing layer. Agents send their actions through it; it checks the rules for that hotel, holds what needs a person, and records what happened.
What it is not. OrchKernel is not a PMS, a revenue system or a messaging tool, and it does not decide prices. Your PMS, central reservations and the brand's systems stay the systems of record. OrchKernel governs the actions sent through it. An autopilot inside a revenue system that pushes rates straight to the channel manager, or a vendor chatbot that answers guests on its own, is outside OrchKernel unless those actions are routed through it. Part of the Stage 0 inventory is deciding which ones must be.
The mechanisms
- Approvals
- The action waits for a named person, who sees exactly what will happen: the rate change and the limit it breaks, the BEO revision with the allergen line marked. It runs once, as approved.
- Rules
- Checked at the moment of action, the same way at every hotel and in every tool: no price without its fees, no increase under an emergency flag, no disclosure before an identity check. A rule allows, holds or denies, with a reason.
- Acting on a named person's authority
- A rate change goes out under the revenue manager who set the limits, a credit under the manager on duty. The agent has no more access than that person, and loses it when they do.
- Data access by role and field
- Card and passport fields stay hidden from agents that do not need them. Allergies are visible to catering, not to marketing. Owners see only their own hotels.
- Tamper-evident audit log
- Every request, rule result, approval and outcome, with its inputs, chained so an edited or deleted entry shows.
- Human queue
- Safety reports, accessibility requests, identity doubts, disputes and legal threats land with a named owner and a response time. An agent may raise a case's priority, never lower it.
- Connections to your systems
- The group connects its PMS (OPERA Cloud, Mews, Cloudbeds, apaleo, Stayntouch or others), central reservations and brand systems, revenue management, sales and catering, messaging and voice, housekeeping and labor, payments and accounting. OrchKernel holds the credentials so agents never do.
Sixteen control points
Where a hotel group needs a control whatever tools it uses, who owns it, and what enforces it.
What guests are told and charged
Prices, contracts and money
Safety, people and the floor
Data, records and tools
What belongs elsewhere
- Reservations, folios, rates and loyalty
- The PMS, the central reservation system and the brand's systems stay the systems of record. OrchKernel does not replace any of them.
- What a pricing model is trained on
- The revenue system vendor and your counsel. OrchKernel can require that a named person set the limits and record every override; it cannot audit a vendor's model.
- Card storage and tokenization
- The payment processor and your PCI scope. OrchKernel keeps card fields out of agent views.
- Brand standards
- The franchisor sets them. OrchKernel can check agent actions against the ones written down as rules.
- Physical safety and staff security training
- Panic buttons, security staff, trafficking training and phishing defenses belong to the hotel, its people and its security tools.
- Legal judgment and food safety
- Counsel decides contracts, disputes and emergency pricing questions; the culinary team and the health code decide kitchen practice.
OrchKernel is source-available under the Business Source License and runs on your own servers, so you can read the code that enforces these controls.
Scorecard by stage
Record your baseline before Stage 1, then track the same numbers at each stage. Most hotel operating benchmarks are paid (STR, HotStats and others) or do not exist, and we have not quoted any we could not source.
What we could not find
Open questions from our research. If you have good data on any of them, write to support@prefero.ai.
- An independent survey of AI use in hotels alone. The Census figure combines hotels with restaurants, and the industry body surveys we looked for were not public.
- Hours per occupied room and minutes per room cleaned; the benchmarks sit behind paywalls.
- Typical OTA commission rates, and which AI assistants now book hotels directly and on what terms.
- Los Angeles housekeeping workload limits and panic-button rules; panic-button laws in Illinois, New Jersey and other cities; technology clauses in hotel union contracts.
- Whether Florida's emergency pricing law reaches hotel rooms; state attorney general resort-fee settlements.
- Allergen disclosure rules for banquets and menus by state, and which states have adopted which FDA Food Code.
- Guest registry retention laws by state and city, and biometric rules (such as Illinois BIPA) for face matching at check-in.
- Whether the EU's Digital Omnibus changes when Article 50 of the AI Act applies.
- Who owns guest data between brand, owner and operator, who may use it to tune agents, and what franchise agreements say about tools the brand has not approved.
- How guests feel about AI agents in hotels. We found no independent survey.
Sources
Sources were read in October 2026; dates are publication or data dates.
Primary sources
Government agencies, regulators, legislatures, courts and SEC filings. Ratios marked as our arithmetic are calculated from the filed statements.
- 1Business Trends and Outlook Survey, sector and national data. US Census Bureau, reference period 24 August to 6 September 2026.
- 2All employees, accommodation (CES7072100001), 2019 to 2026. US Bureau of Labor Statistics, September 2026, preliminary.
- 3Average hourly earnings of all employees, accommodation (CES7072100003). US Bureau of Labor Statistics, August 2026, preliminary.
- 4Job Openings and Labor Turnover Survey, Table 4: quits by industry. US Bureau of Labor Statistics, August 2026.
- 5Industries at a glance: accommodation (NAICS 721). US Bureau of Labor Statistics, 2025 occupational data.
- 6Host Hotels & Resorts, annual report on Form 10-K for 2025. SEC EDGAR, filed 25 February 2026.
- 7Host Hotels & Resorts, consolidated statements of operations, 2025. SEC EDGAR (10-K financial data), filed 25 February 2026.Ratios are our arithmetic
- 8DiamondRock Hospitality, annual report on Form 10-K for 2025. SEC EDGAR, 2026.
- 9DiamondRock Hospitality, consolidated statements of operations, 2025. SEC EDGAR (10-K financial data), 2026.Ratios are our arithmetic
- 10Marriott International, annual report on Form 10-K for 2025. SEC EDGAR, filed 10 February 2026.
- 11Marriott International, quarterly report on Form 10-Q, first quarter 2025. SEC EDGAR, filed 6 May 2025.
- 12Hilton Worldwide, annual report on Form 10-K for 2025. SEC EDGAR, 2026.
- 13Booking Holdings, annual report on Form 10-K for 2025. SEC EDGAR, 2026.
- 14Expedia Group, annual report on Form 10-K for 2025. SEC EDGAR, 2026.
- 15MGM Resorts International, current report on Form 8-K (cybersecurity incident). SEC EDGAR, 5 October 2023.
- 16Sonder Holdings, quarterly report on Form 10-Q, second quarter 2025. SEC EDGAR, filed 14 October 2025.
- 17Sonder Holdings, current report on Form 8-K (license termination and Chapter 7). SEC EDGAR, November 2025.
- 1816 CFR Part 464, Rule on Unfair or Deceptive Fees. Code of Federal Regulations (Cornell LII).
- 19Federal Trade Commission announces bipartisan rule banning junk ticket and hotel fees. Federal Trade Commission, 17 December 2024.
- 20Rule on Unfair or Deceptive Fees: frequently asked questions. Federal Trade Commission.
- 21SB 478 (2023), advertised prices must include mandatory fees. California Legislature.
- 22HB25-1090, protections against deceptive pricing practices. Colorado General Assembly, signed 21 April 2025.
- 23Travelers United, Inc. v. Hyatt Hotels Corporation (docket). US District Court for the District of Columbia, via CourtListener, 2023.
- 24Gibson v. Cendyn Group, No. 24-3576. US Court of Appeals for the Ninth Circuit, 15 August 2025.
- 25Cornish-Adebiyi v. Caesars Entertainment, No. 24-3006 (precedential). US Court of Appeals for the Third Circuit, 29 July 2026.
- 26AB 325 (2025), Cartwright Act: common pricing algorithms. California Legislature, chaptered 6 October 2025.
- 27California Constitution, Article IV, Section 8 (when statutes take effect). California Legislature.
- 28California Penal Code Section 396 (price increases after a declared emergency). California Legislature.
- 29Price gouging during disasters. California Attorney General.
- 30Florida Statutes Section 501.160, rental or sale of essential commodities during a declared emergency. Florida Senate, 2025 statutes.
- 3128 CFR 36.302, modifications in policies, practices or procedures (reservations, service animals). Code of Federal Regulations (Cornell LII).
- 32Acheson Hotels, LLC v. Laufer, No. 22-429. Supreme Court of the United States, 5 December 2023.
- 33FTC takes action against Marriott and Starwood over multiple data breaches. Federal Trade Commission, 9 October 2024.
- 34Scattered Spider, advisory AA23-320A. Cybersecurity and Infrastructure Security Agency, 16 November 2023, updated 29 July 2025.
- 35California Business and Professions Code Section 17941 (bot disclosure). California Legislature.
- 36FCC makes AI-generated voices in robocalls illegal (declaratory ruling). Federal Communications Commission, 8 February 2024.
- 37RCW 49.60.515, hotels and motels: panic buttons, harassment policies and training. Washington State Legislature.
- 38California Government Code Section 12950.3 (human trafficking awareness training). California Legislature.
- 39Hotel Licensing Law frequently asked questions (Local Law 104 of 2024). NYC Department of Consumer and Worker Protection, 8 April 2026.
- 40Citywide Hotel Worker Minimum Wage rate chart. City of Los Angeles, Office of Wage Standards, revised 27 May 2026.
- 41Fair Workweek frequently asked questions. City of Chicago, Office of Labor Standards, 2025.
Industry bodies and independent research
The American Hotel & Lodging Association (a trade body; only the public summary of its 2026 report was read), the PCI Security Standards Council and an independent EU AI Act tracker.
- 422026 State of the Industry (public summary). American Hotel & Lodging Association, 2026.Full report is paywalled
- 43Countdown to PCI DSS v4.0. PCI Security Standards Council.
- 44EU AI Act, Article 50: transparency obligations. artificialintelligenceact.eu (independent tracker).
Vendor sources
Published by companies that sell software or security to hotels. Directional, not an industry benchmark.
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware. Microsoft Threat Intelligence, 13 March 2025.Vendor source
Company and press
News coverage and an encyclopedia summary of a tribunal decision we did not open.
- 54Uber is in the hotel business now, thanks in part to AI. TechCrunch, 29 April 2026.
- 55Mews coverage (funding rounds, 2024 and 2025). TechCrunch.
- 56
- 57