New PMS platforms are AI-first: intelligence sits at its core, across every guest, task, and ledger entry. Pre-AI systems bolt it on through third parties, pay more, expose accessible data via APIs, and see less. That gap will decide who is still standing in five years.
Every PMS vendor in short-term rental now has “AI” on its homepage. Very few of them built it from scratch as a foundation model. For most platforms that grew up before 2023, the AI messaging, task automation, and business intelligence their customers now expect come from a third party. That third party reads the PMS through an API, does the clever work somewhere else, and writes a little of it back.
Many of these PMS systems are far older than their websites suggest. The best-known legacy PMSs were built between 1998 and 2008, a generation before ChatGPT. Several date from the closing years of the last century: Barefoot and Maxxton in 1998, Escapia in 1999. Streamline followed in 2005, Kigo and LiveRez a few years later. Across Europe, systems date back much further, too, even to the 1970’s and 80s, although they were refactored several times.
That looks like innovation. It is actually an admission. The PMS is meant to be the system of record for the whole business. When the intelligence lives outside the record, the record stops being the centre of the business, and the vendor that owns it becomes a challenge.
The industry is splitting in two. On one side are the AI-first platforms, built in the last few years with agents at the centre of the data model. On the other are the pre-AI systems: trapped by old architecture, held in place by customers who don’t want to retrain their teams, and renting their future from someone else’s API. One group builds intelligence in. The other bolts it on.
Its a growing industry with a long tail
Market data is mentioned below but the words “long tail” are increasingly used in this industry as these new historical inflection points impact (Internet, smart phones, economic crashes, Covid and now AI). The market is substantial and we will see winners in both cases and this will be driven by marketing power, the challenges to legacy PMS systems and on the other hand, fully native AI and system of record businesses.
A PMS is not an app. It is the ledger. It is the source of truth.
Strip away the marketing and a PMS does one job that nothing else can: it holds the truth. Which property, which dates, which guest, what they paid, what the owner is owed, what tax is due, who cleans it, and when.
That is why operators so rarely switch. The PMS sits under the reservations, the trust account, the owner statements and the channel connections. Moving it is like changing the foundations as people are still living in the house.
For twenty years, that stickiness was a moat. In the AI era, it has become a trap. An AI agent is only as good as the context it can see and the actions it can take. If the system of record cannot supply both, natively and in real time, the AI has to sit outside it. And whatever sits outside the record starts to own the customer relationship.
The bolt-on AI layer terminology
It’s hard to determine what we should actually call these additional connected AI systems; these are some of the terms from their websites and the press:
- AI operations layer / AI layer
- Orchestration layer
- AI agent platform / agentic layer
- Guest experience platform (GXP)
- Vertical AI
- Middleware/overlay
- An AI Wrapper
In the context of this article, “system of engagement”, set against the PMS as the “system of record”, seems appropriate.
The bolt-on economy and its four hidden costs.
The bolt-on model is now an industry in its own right. AI guest messaging, AI task routing, AI review responses and AI reporting, all sold as layers over somebody else’s PMS. For a legacy vendor, it is a necessary aid. For the operator paying for it, it carries costs that rarely appear on the sales deck.
The bolt-on economy, by the numbers.
The scale shows up on PMS vendors’ own marketplaces. In November 2026, about one in ten third-party tools on Guesty’s marketplace, and nearly one in five on Hostaway’s, sold itself as AI.
The same names show up on both lists: e.g., Besty AI, Conduit, ProhostAI, Proptonomy, etc., all pitching the same promise of adding AI to your PMS. One describes itself as running operations across every tool in your stack and a little presumptuous. That is not a feature. It describes the problem. On Hostaway alone, roughly two dozen separate vendors compete to answer the same guest message.
Don’t misunderstand this article. We are in a growing industry, and the early adoption of AI and the acceptance of the historical API approach to data exchange are making use of these companies’ products, and the legacy PMS systems are benefiting. But evolution usually tends to favour those with better genes and bigger sticks, eventually.
1. The cost stack. The operator pays the PMS. Then pays the AI layer. Then often pays again, indirectly, because many PMS vendors charge integration partners for API access, and those fees pass down the line. A 2025 survey of STR software vendors by Hospitable found that 89% had delayed or cancelled product launches because of PMS integration fees, with some reporting over $10,000 for basic access and others giving up to 20% of revenue each quarter. Hospitable has a commercial interest in that finding, but nobody in the industry disputes that pay-to-play exists. As the author, I too can confirm this is normal practice snd to a degree makes sense. Acquiring customers is expensive.
2. The security surface. Every connection is another company holding guest names, phone numbers, addresses, door codes and payment references. Under GDPR, each one is a processor that needs a contract, a security review and a breach plan. Access is often all-or-nothing, so a tool that only needs to read messages may be granted far more. Ten integrations mean ten doors. The operator is responsible for all of them.
3. The partial picture. A third-party AI sees only what the API exposes. Legacy APIs were designed to sync calendars and push rates, not to give an agent the entire context of a business. Owner rules, maintenance history, cleaner notes and the conversation from the guest’s last stay are often missing, or live in yet another connected app the AI cannot reach.
4. The fragile pipe. Rate limits, delayed webhooks, endpoints that read but don’t write, version changes nobody announced. When the connection fails, the AI answers a guest with yesterday’s data. And when it goes wrong, the PMS blames the partner and the partner blames the PMS. The operator owns the problem.
AI needs the whole picture, or it is just a faster autoresponder.
Take the most ordinary guest message in the business: “Can we check in at 1 pm instead of 4 pm?”
To answer it properly, an agent needs to know whether there is a checkout that morning, whether the cleaner is booked and how long the turnover takes, whether the owner allows early check-in, what to charge for it, whether the guest is a repeat visitor worth a free upgrade, and whether the door code can be moved forward. Then it needs to act: change the task, adjust the lock, add the fee, confirm to the guest.
That is six data sources and four write actions. In an AI-native system, they sit in one data model. In a legacy stack, they are spread across the PMS, a cleaning app, a lock platform, a pricing tool and an upsell tool, with the AI layer peering in from outside. It can compose a polite reply. It cannot make the decision.
This is the real dividing line. Bolt-on AI automates conversations and, to a degree, some automations. Native AI can automate a whole suite of operations, booking variables, pricing options, and access a whole budgetary and distribution record set. Only the second changes the economics of running a portfolio.
The market is already voting.
If the bolt-on model were enough, independent PMS vendors would be thriving. They are not. They are being bought and losing customers. But there are a lot of them.
In September 2026, Guesty announced it had acquired Smily, the French PMS and channel manager formerly known as BookingSync. Smily is no minnow: it has run since 2010, processed EU billions in bookings, and built strong OTA partner rankings. Its customers will now get Guesty’ s AI tools, including its Agent Hub. Read that again: the acquired platform’s AI future arrives through its acquirer.
Smily is part of a pattern. Guesty has also absorbed other companies including, Rentals United, who service competitors to their own business. Its CEO has said openly that the industry is too fragmented and needs consolidating. Hostaway supposedly became the first STR PMS unicorn in 2025, and with Guesty has been, displacing both the large and small incumbents.
The lesson is not that the big players were born AI-native. Most were not. They have the capital to rebuild their core; the long tail doesn’t. Scale buys time. Everyone else is running out of it.
Built in, not bolted on.
The AI-native challengers start from the opposite end. Boom, founded in 2023 and backed by a $12.7 million Series A in October 2025, puts guest messaging, task management, maintenance, reviews and finance inside one platform, with agents working across all of them. Operators in 40+ countries now use it.
The interesting part is not what Boom builds. It is what Boom chooses not to build. Its rule is simple: integrate only where the partner has a moat you can’t replicate yourself.
- Distribution. Airbnb, Booking.com and Vrbo own demand. You connect to them; you don’t compete. LLMs are on the horizon too, and as a PMS with the System of Record, they are ideally placed to remain the “Source of Truth”.
- Pricing data. A dedicated revenue tool sees millions of listings across markets. That network effect is the product.
- Insurance. Underwriting needs a licence and a balance sheet, so Boom partners with embedded insurers rather than pretending to be one.
- Websites. Yes these are internally offered too, but humans are fickle and continue to have wide ranging independent approaches so APIs are available.
Everything else, from messaging and upsells to cleaning schedules and owner reporting, CRM, loyalty programs etc is a feature, not a partner. Each of those categories was once a separate app with its own login, invoice and API key. In an AI-native PMS, they collapse into the core because the agent needs them there.
That is the strategic difference in one sentence. Legacy platforms treat the connectivity marketplace as their strength. AI-native platforms treat most of it as necessary technical debt.
Three doors, and only one is comfortable.
A legacy PMS without deep pockets now faces three options.
- Rebuild the core. Re-architect the data model so AI agents can see and act across the whole business. It is the right answer and the hardest one: two or three years of engineering, while competitors ship and customers wait.
- Sell. Find a consolidator who wants your customers, your local knowledge and your OTA relationships, as Smily did. For many founders, this is the rational exit, and the window is open now, while the customer base still has value.
- Become a toll booth. Keep the ledger, let third-party AI layers own the experience, and charge them for the privilege. Many PMS platforms already do: AI vendors pay for API access, often as a percentage of the fees they charge their own clients. That keeps the PMS in control as the system of record, and keeps the revenue coming. But the operator now pays twice for the same intelligence, and a toll only works while there is no other road. Once the AI layer owns the operator’s daily workflow, it can move that operator to a different PMS underneath.
The third door is where most legacy vendors are heading by default, and it is the one they should fear most. The company that owns the intelligence will own the customer. The system of record that cannot think will be valued like a utility. Intelligence via API connections, however, can be throttled to reduce dependencies and switch for better commercial reasons.
The open-source mirage. Crossing the Rubicon.
This “toll” is why the open-source idea keeps resurfacing: an open PMS, the WordPress of short-term rental, with no rev share, no licence fees and no lock-in. A thousand developers improving one shared core. Could it replace the legacy systems, or even the AI-native newcomers?
Almost certainly not, and explained below.
Conjuring up an open-source PMS through a company that has any relationship to an existing Intelligence layer which is connected to a PMS for their existing business is the equivalent of the Rubicon idiom. Or in more 21st-century speak, you can’t have your cake and eat it. No matter how eloquently it is positioned.
CMS system publish words. A PMS moves money. When a plugin breaks, a page looks wrong. When a PMS breaks, a family arrives at a property that was sold twice, an owner is paid the wrong amount, or card data leaks. Trust accounting, tax remittance and payment compliance need one accountable owner, not a contributors’ forum.
In the Wordfence 2024 annual report: vulnerabilities disclosed increased by 68% from 2023, and plugin vulnerabilities remain the biggest software threat to WordPress, accounting for 96% of all vulnerabilities disclosed. In the Q4 2025 quarterly report, 2,213 total vulnerabilities were published, up 19.2% from the previous quarter.
PatchStack (data covering 2025) showed that 91% of new vulnerabilities were found in plugins and 9% in themes. Only 6 vulnerabilities were reported in WordPress core, and they were low-priority issues. This highlights the need for a core approach to secure ledger and transaction management.
All this indicates that as third parties get involved and especially leverage AI and Vibe coding, we will see an explosion of code variants where important Systems of Record data exists. With the recent mass exploits of connected systems to PMSs and some PMSs themselves under fire, this is probably a very poor idea!
Managers are not Software Developers
Yes, we have enjoyed the ability to develop our own tools, and many will by connecting to their PMS API, MCPs, etc.; provided they know what they are doing, can maintain it, and ringfence it securely, then it’s a bonus. However, the 140K-plus managers worldwide generally want software that works out of the box. It’s like buying a car; not many of us take out the straight-four engine and plug in a V8!
The OTAs will not connect to a crowd. Airbnb, Booking.com and Vrbo run connectivity programmes that certify specific companies, measure their performance and hold them to account. In reality, they don’t want more connections; they too have technical debt from third parties and would prefer less connections, not more. They are their own siloes too, built up over 15-20 years.
They will not hand API access to a thousand self-hosted forks of varying quality, without certified distribution, compliance and approved, strong architecture and management companies that validate owners.
An open core would depend on an ecosystem of extensions for messaging, cleaning, pricing and payments. That is the fragmented, bolt-on stack the industry is trying to escape, now with no vendor responsible for any of it. In the ultimate open-source system, open code security records is a warning: most vulnerabilities come from third parties. And most recently we have seen epic scale hacks on connected systems.
An AI-first PMS improves because one company owns the whole data model and sees every guest message, task and payout across thousands of properties. Its agents learn from all of it. An open core split across self-hosted installs and community plugins has no shared data and no one to train on it. It would arrive as another pre-AI system, needing the same bolt-ons it was meant to replace.
There is a version of “open” that would help, though. Not an open PMS, but an open data standard: a common schema for reservations, guests, tasks and owner ledgers that every PMS must export cleanly.
That would let operators own their data, move between systems without a six-month migration, and give AI agents a consistent view of the business. It would also remove much of the lock-in that keeps legacy platforms alive. Which is precisely why legacy platforms will not champion it. It has been an ongoing discussion for years.
Follow the money.
Mews, Hostaway, Guesty and others have raised roughly $1.75 billion between them. The best-funded AI layers raise single-digit millions. Investors are not betting on who answers the guest. They are betting on who holds the ledger, the payments and the data the AI needs.
| Company | Type | Latest round | Total raised (approx.) |
| Mews | Hotel PMS | $300m, Jan 2026 | $811m |
| Hostaway | STR PMS | $365m, Dec 2024 | $543m |
| Guesty | STR PMS | $130m, Apr 2024 | $410m |
| Apaleo | Open, PMS | €20m, Nov 2024 | $31–38m |
| Boom | AI-native PMS | $12.7m, Oct 2025 | $12.7m |
The logic is simple. A system of record sits in the money flow: These PMSs already process $billions in bookings, and Mews is spending its new round on AI and payments together. It is painful to leave. It holds the data every AI agent needs. And it can copy any feature an AI layer proves is valuable, as Guesty did with its own AI messaging and Agent Hub. An AI layer rents all of that through an API, from a landlord who can raise the rent.
Two details stand out. Apaleo, the most open PMS in the table, has raised a fraction of what the bundled platforms have: openness does not attract the big cheques. And the AI layers know where the value sits. Several now describe themselves as an “operating system” for short-term rentals, which is another way of saying they want to become the system of record. Boom started there, which is why it was funded as a PMS rather than as a layer.
The market is large but closing as the new PMS companies gain ground.
PriceLabs claims to have connected to 160 PMSs, and these are all nearly pre-AI; therefore, most properties sit in non-AI-first systems, and the opportunity for intelligence layers is large but likely to shrink. 160 is not exhaustive; hundreds more exist around the globe, and astonishingly more appear each month.
Even on the most generous reading, Guesty and Hostaway and a handful of others together run perhaps a third of professionally managed units on commercial software. The rest sits on dozens of older platforms that will either bolt AI on, sell, or charge tolls for access.
Operators also want choice, and changing PMS systems has previously been more painful than divorce and taxes, but AI is making it much easier. However, if it works, “don’t break it” is often many operators’ mindset. Bolt-ons may be an option, but in such a fragmented industry, a lack of software knowledge, limited options, hard sells, and poor analysis of available tools are challenges.
It’s Your Choice – Decide on your future.
It would be unfair to completely disregard PMS third-party “intelligence layers”, or “system of engagement” as they are popular. If your business needs modest messaging improvements and varying levels of automation, many systems are available. The next challenge is identifying the best bolt-on for you: functionality, support, price, data security, and integration with your existing PMS.
However, the biggest PMSs have the most connections and also provide their own AI tools. In commercial terms, this raises a question for the future: will the PMS AI layers themselves replace these tools slowly or just terminate connections leaving the legacy customers in place.
What happens when legacy PMSs fail to support their customer base, costs rise, and growth stalls? Third-party suppliers will also suffer. These companies will not be able to sell their technology, just their customer bases and with that often comes a change of technology imposed on managers.
Summary
Right now, it’s a “bun fight” in an open, fragmented, overly noisy market where 90% of managers would never read an article like this or speak to other managers, nor attend conferences and live in isolated environments. Yes, no one can hear you scream in space.
Follow the money is often the best advice; after all, the world is dominated by global data-first organisations, and we use them all daily. The PMs market will be no different. It is just a matter of time.
I have heard the words “open API” far too ofte with a confidence of opportunity to build on anothers system of record. But An ‘open API’ is open the way a shop is open: until the owner decides otherwise. Access can be priced, throttled, deprecated or withdrawn. Only a shared standard or a contractual right to your data is truly open and that is extremely unlikely. So choose your partners wisely!
Disclaimer: But give me a call!
Yes, I’m an advisor to Boom and see the future as the way the world works across all other industries. It follows the money, the data controls, and now an AI-first approach to leverage increasingly smart LLMs. It’s the future.
I’m more than happy to talk PMSs, but I’ve also done a fair amount of research on the top six or seven alternative AI layer companies, if that’s your preference. I’m happy to comment and chat too.
