Home / AI controls checklist
Free resourceAI controls checklist: six must-haves before borrower data goes in
Last reviewed: October 28, 2026. General information, not legal advice. These six controls are a practical baseline for a mortgage broker or lender. The "maps to" notes show which rule each control helps you document; doing all six does not by itself satisfy any rule, and no checklist can promise that outcome.
The six must-haves
- Approved tools on company accounts only. Keep a written list of approved AI tools and plans. Company data goes only into company-managed Business or Enterprise accounts, never personal accounts. Staff sign the personal-account attestation. Maps to: Freddie Mac 1302.8 and Fannie Mae Section 4 (know and govern AI use); Safeguards Rule 314.4(c)(2) (identify and manage systems).
- Signed DPA and current SOC 2 report for every AI vendor. Before borrower data goes in, the vendor has a signed Data Processing Addendum that covers the product you use, and you have its current SOC 2 Type 2 report (or Type I and II) on file with its period and scope noted. Maps to: Safeguards Rule 314.4(f) (oversee service providers by contract); Regulation P 1016.13 (service provider contracts).
- Single sign-on and multi-factor authentication. Staff sign in through your identity provider with MFA. Where SSO is not available on a plan, MFA is enforced on every AI account and the gap is logged as an exception. Maps to: Safeguards Rule 314.4(c)(5) (MFA for any individual accessing any information system).
- Least-privilege connectors and access. Email, drive and LOS connectors are off by default. They are turned on only on an Enterprise plan with a signed DPA, or for named users under a documented exception with an approver, conditions and a review date. Access is reviewed at least quarterly and removed the day someone leaves. Maps to: Safeguards Rule 314.4(c)(1) (access only to the information users need).
- Logging and retention set on purpose. Retention for chats, files and connector data is set to the shortest workable period and written down. Admin and activity logs are exported or reviewed on a schedule, and the review is recorded. Maps to: Safeguards Rule 314.4(c)(6) and (c)(8) (disposal, retention review, monitoring and logging).
- Trained staff and an AI incident playbook. Everyone who uses AI has signed the AI policy and finished training. The incident plan has an AI playbook with the notice clocks: a first notice to Fannie Mae within 36 hours under Bulletin 26-01, and FTC notice within 30 days for notification events involving 500 or more consumers. Maps to: Freddie Mac 1302.2 (AI training and playbooks); Fannie Mae Bulletin 26-01; Safeguards Rule 314.4(e), (h) and (j).
What the AI tool does vs. what we do
Buying a business plan moves some work to the vendor, not all of it. This table splits the job.
| Area | What the AI tool does | What we do |
|---|---|---|
| Training on your data | Business and Enterprise plans from OpenAI and x.ai say they do not train on your business data by default. | Confirm the setting in the admin console, keep a dated screenshot, and make sure the DPA says the same. |
| Encryption | Encrypts data in transit and at rest, as described in its security documentation and SOC 2 report. | Read the SOC 2 report, note its period and scope, and file it. Encrypt borrower files on your own systems too. |
| Sign-in security | Offers SSO and MFA on some plans (for example SAML SSO on ChatGPT Business; custom SSO on Grok Enterprise). | Turn SSO on, enforce MFA, and block personal accounts on work devices where you can. |
| User provisioning | Offers SCIM directory sync on Enterprise tiers. | Connect SCIM where available; otherwise remove users by hand the day they leave and record it. |
| Data retention | Provides retention settings (custom retention is listed for ChatGPT Enterprise and Grok Business and Enterprise). | Choose the retention period, write it in your policy, and check it each quarter. |
| Audit logs | Records admin and user activity; exportable logs depend on the plan (the Compliance API logs platform is Enterprise only on ChatGPT). | Decide who reviews logs and how often, export them where possible, and keep the review record. |
| Connectors | Builds connectors to email, drives and other systems, with admin controls on some plans. | Keep connectors off by default; allow them only under Enterprise plus a signed DPA, or a documented exception. |
| Output accuracy | Generates text that can be wrong or incomplete. | A person reviews every AI output before it reaches a borrower, a lender or a regulator. |
| Incident notice | Notifies you of a personal data breach under its DPA, typically "without undue delay". | Run your own incident plan and meet your notice clocks (36 hours to Fannie Mae under Bulletin 26-01; 30 days to the FTC for 500 or more consumers). |
| Policy and sign-off | Nothing. The vendor does not write or enforce your AI policy. | Write the policy, train staff, collect signed acknowledgments and keep the records. |
Vendor feature examples were read on OpenAI's and x.ai's pricing pages on October 28, 2026. See the plan comparison guide for the full lists.
How to use this checklist
- Score each control: in place, partly in place or not started.
- Give each one an owner. The AI controls owner (usually IT) holds 2 to 5; the policy admin holds 1 and 6.
- Anything not in place by your rollout date becomes a documented exception with an approver, conditions and a review date.
- Recheck every quarter and before the Fannie Mae Supplement date of January 18, 2027.
In the BrokerLumen portal, the same checklist sits under AI controls, Checklist, where you can mark each control and see open exceptions beside it. Related: Can I connect AI to my work email? and the vendor quote checklist.
Put the six controls on paper
The $349 AI Policy Kit includes an AI/ML governance policy, an AI use inventory, a vendor questionnaire and an incident response one-pager, plus 3 months of Small Shop portal access with the AI controls area and staff sign-off tracking.
Get the AI Policy Kit, $349AI Policy Starter, $99AI Team Kit, $699Compare kitsFrequently asked questions
What are the six must-have AI controls?
Approved tools on company accounts only; a signed DPA and current SOC 2 report for every AI vendor; SSO and MFA; least-privilege connectors and access; logging and retention set on purpose; and trained staff with an AI incident playbook.
Does the AI vendor handle security for us?
Partly. The vendor secures its platform; you still choose settings, control access, review logs, train staff, review outputs and meet your own incident notice clocks.
Do these controls guarantee we meet the rules?
No checklist can promise that. The controls help you document an AI program aligned to Freddie Mac, Fannie Mae and GLBA expectations. Confirm your obligations with counsel.