Home / AI incident response playbook
Free templateAI incident response playbook for mortgage companies
Last reviewed: November 5, 2026. General information, not legal advice. This playbook is a starting point you can adapt. It is not a Fannie Mae or Freddie Mac document, and using it does not by itself meet any requirement. Have counsel review your final plan and your notice duties.
Lenders and the GSEs now expect an incident plan that covers AI, not only ransomware and lost laptops. A borrower file pasted into a personal chatbot, a call transcript emailed to the wrong person or a cloned voice asking for a wire are all incidents. This page gives you a complete, plain-English playbook: what counts, who does what, the first hour, the notice clocks and the log to keep.
Why you need an AI playbook
"Have documented action plans for remediation of Incidents, including playbooks for Incidents related to AI/ML (as defined in Section 1302.8)"Freddie Mac Guide Section 1302.2(b)(xvi)
In plain English: Freddie Mac Seller/Servicers need a written playbook for AI incidents. Wholesale lenders often ask brokers the same question.
"Maintain an up-to-date incident response plan that includes incident response policies, standards and procedures that: identify required resources for the plan ... identify roles and responsibilities for incident response stakeholders; provide mobilization contact and call trees; offer severity assessment requirements; log recording steps and processes for evidence collection; and provide steps for executing incident response capabilities."Fannie Mae Information Security and Business Resiliency Supplement, Section 3.6
In plain English: The plan needs named roles, a call tree, severity levels, an evidence log and step-by-step actions. The Supplement also requires a test of the plan at least once a year.
"Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control."16 CFR 314.4(h), FTC Safeguards Rule
In plain English: Mortgage brokers and non-bank lenders already need a written incident plan under the Safeguards Rule. Add the AI incidents below to it.
What counts as an AI incident
Treat any event where an AI tool exposes, changes or misuses borrower information, or where AI is used to deceive your staff or borrowers, as an incident until you decide otherwise.
| Incident | Example | Starting severity | First move |
|---|---|---|---|
| Borrower data pasted into a personal AI account | A processor pastes a borrower's pay stubs into a free chatbot to summarize income. | High | Stop use, save what was entered, delete the chat only after you record it, check the tool's data terms |
| AI notetaker transcript shared by mistake | A call summary with account numbers is emailed to everyone on a meeting invite, including an outside party. | High | Ask recipients to delete, revoke the share link, list the data exposed |
| AI connector over-shares | An AI assistant connected to a shared mailbox or drive surfaces borrower files to a user who should not see them. | High | Disconnect the connector, revoke its tokens, review access logs |
| Prompt injection | Instructions hidden in an emailed document make an AI assistant forward data or change a task. | High | Disable the assistant's actions, preserve the document, review what it did |
| Voice clone or deepfake impersonation | A caller using a cloned voice asks a borrower to wire closing funds to a new account. | Critical | Follow the wire fraud steps, check your mailbox for compromise |
| Wrong AI output sent to a borrower | An AI-drafted email states a rate or fee you do not offer. | Medium | Correct in writing, keep both versions, review the approval step |
| Vendor AI breach | Your CRM or LOS vendor reports an incident in its AI feature. | High | Get the vendor's facts in writing, list your borrowers affected, check your contract notice terms |
| Unapproved AI tool found | An AI browser extension with access to every web page is found on a loan officer's laptop. | Medium | Remove it, check what it could read, add the decision to your inventory |
Roles and call tree
| Role | What they do | Usually |
|---|---|---|
| Incident lead | Runs the response, keeps the log, makes the call on severity | Owner or operations manager |
| Qualified Individual | Oversees the information security program under the FTC Safeguards Rule | Named in your security program |
| AI program owner | Knows the AI inventory and the approved tools list | Named in your AI policy |
| Senior manager | Approves notices, spending and borrower communications | Owner, president or equivalent |
| IT or managed service provider | Cuts access, preserves logs, resets credentials | Internal or outside IT |
| Outside counsel | Advises on notice duties under federal and state law and your contracts | Your attorney |
| Lender and vendor contacts | Receive notices required by broker agreements and vendor contracts | Account executives and vendor support |
Keep this table printed and saved somewhere that does not depend on the systems that might be down, such as a shared document plus a paper copy.
Severity levels
- Critical. Money has moved or may move, borrower data was taken by an outsider, or systems are locked. Start the full playbook now and call counsel the same day.
- High. Borrower nonpublic personal information reached a person or system that should not have it, or an AI tool acted without authorization. Start the full playbook and decide on notices within 24 hours.
- Medium. No borrower data left your control, but a rule was broken or a borrower got wrong information. Contain, correct and record it.
- Low. A near miss caught before any harm. Record it and use it in training.
The playbook, step by step
- First hour
Contain and preserve
- Stop the AI tool or feature involved for the affected users.
- Revoke connector tokens and API keys, turn off share links, and reset passwords for affected accounts.
- Preserve evidence: screenshots, chat history, prompts, the AI output, sign-in logs and emails. Do not delete anything until it is recorded.
- Open the incident log and call the incident lead.
- Hours 1 to 24
Assess
- What data was involved: names, Social Security numbers, account numbers, income documents?
- How many borrowers, and whose loans: any sold to or serviced for Fannie Mae or Freddie Mac?
- Was the data encrypted, and was it acquired by an unauthorized person?
- Which vendor holds it, and what does the vendor confirm in writing?
- Set the severity level and record why.
- By 36 hours
Make the time-critical notices
- If your company is subject to the Fannie Mae Supplement, it requires notice to Fannie Mae without undue delay and no later than 36 hours after identifying a Cybersecurity Incident, or reasonably concluding one may have occurred. The Supplement names the email address [email protected] and lists the details to send.
- Freddie Mac Guide Section 1302.5 also uses a 36-hour notice window, requires immediate notice if an Incident causes systems used in origination or servicing to be shut down or disabled, and has a quarterly path for small privacy incidents that affect fewer than 10 Freddie Mac Borrowers. For the side-by-side windows, see Incident notice windows.
- Notify your wholesale lenders as your broker agreements require. Many agreements set their own notice periods.
- Notify vendors and your cyber insurer as your contracts require.
- Within 30 days
Regulatory and borrower notices
- FTC: if a notification event involves the information of at least 500 consumers, notify the FTC as soon as possible and no later than 30 days after discovery, using the form on ftc.gov. A notification event is the acquisition of unencrypted customer information without the consumer's authorization.
- States: state data breach laws may require notices to borrowers and state officials. Ask counsel which states apply.
- Fraud: if money moved, borrowers file at ic3.gov, and your company considers whether a suspicious activity report is required.
- Within 2 weeks of closing the incident
Fix and learn
- Write down the root cause and what you changed.
- Update the AI use inventory and the approved AI tools list.
- Retrain the people involved and share the lesson with the team.
- Update this playbook and record the date.
The incident log: what to record
- Date and time found, who found it and how.
- The AI tool, feature or vendor involved, and the account used.
- What happened, in plain words.
- Data involved and the number of borrowers affected.
- Severity level and the reason.
- Each action taken, with the time and the person.
- Every notice sent: to whom, when, and a copy.
- Evidence saved and where it is stored.
- Root cause, fixes and the date the incident was closed.
Test it once a year: three tabletop scenarios
A 45-minute tabletop exercise is enough for a small shop. Read a scenario, walk through the playbook, and write down what was unclear.
- Personal chatbot. A loan officer tells you he pasted three borrowers' bank statements into a personal AI account last week. Who decides whether the data was "acquired," and what do you tell your lenders?
- Shared transcript. An AI notetaker emailed a call summary with a borrower's account numbers to a real estate agent. Who asks for deletion, and what goes in the log? See AI notetakers and call recording.
- Cloned voice. A borrower calls to say she wired her down payment after a call that sounded like her loan officer. Walk the first hour minute by minute. See AI voice clone wire fraud.
Record who attended, the date and the changes you made. That record is your evidence of the annual test.
Next steps: check your gaps with the AI readiness self-assessment, see the full list of program pieces in the Fannie Mae Section 4 readiness checklist, and read the training and playbook rules in Freddie Mac 1302.2.
Get the incident one-pager with the full governance program
The $349 AI Policy Kit includes an incident response one-pager, an annual review calendar, the AI use inventory, a vendor AI due diligence questionnaire and the full governance policy, plus 3 months of Small Shop portal access to track staff sign-offs. It is marked for review by your own counsel before you adopt it.
Get the AI Policy Kit, $349AI Policy Starter, $99AI Team Kit, $699Compare kitsFrequently asked questions
What is an AI incident at a mortgage company?
Any event where an AI tool exposes, changes or misuses borrower information, or where AI is used to deceive staff or borrowers. Examples include borrower data pasted into a personal AI account, an AI call summary sent to the wrong person, a prompt injection and a cloned voice used to redirect a wire.
Does Freddie Mac require an AI incident playbook?
Yes, for Seller/Servicers. Freddie Mac Guide Section 1302.2(b)(xvi) requires documented action plans for remediation of Incidents, including playbooks for Incidents related to AI/ML.
How fast must a Fannie Mae seller/servicer report a cyber incident?
The Fannie Mae Information Security and Business Resiliency Supplement requires notice without undue delay and no later than 36 hours after identifying a Cybersecurity Incident, or reasonably concluding one may have occurred.
When does the FTC need to be notified?
Under the FTC Safeguards Rule, if a notification event involves the information of at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery.
How often should the incident plan be tested?
The Fannie Mae Supplement requires a test of the incident response plan at least annually, and Freddie Mac 1302.2 calls for an annual test of the incident response plan unless it was formally activated. A tabletop exercise with the three scenarios on this page is a practical way to do it.