AI policy checklist for mortgage brokers and lenders

Last reviewed: October 27, 2026. Free, no email required. General information, not legal advice. Each item notes the requirement it supports: Freddie Mac Guide Section 1302.8, Fannie Mae Supplement Section 4, or good practice.

Freddie Mac 1302.8 is shown as effective March 3, 2026, and Fannie Mae requires full implementation of Supplement Section 4 by January 18, 2027. These rules apply to the companies that sell to or service for Fannie Mae and Freddie Mac. Brokers may be asked the same questions by their wholesale lenders.

The 15-point checklist

1. Inventory: You keep a written list of every AI tool staff use, including AI built into your LOS, CRM and marketing tools. (Fannie Section 4: inventory of SI use cases)
2. Inventory: Each tool notes whether it touches borrower data or connects to a lender or investor system. (Freddie FAQ on scope; Fannie Section 4)
3. Policy: You have a written AI policy specific to your company. (Freddie 1302.8(a); Fannie Section 4)
4. Policy: The policy is approved by senior management, with names and dates. (Freddie 1302.8(a))
5. Policy: It says which uses are allowed, which need approval and which are prohibited. (Good practice)
6. Owner: One named person owns the policy. (Freddie 1302.8(a); Fannie Section 4)
7. Owner: A review at least once a year is on the calendar. (Freddie 1302.8(a); Fannie Section 4)
8. Staff: Everyone who uses AI has received the policy, and you can show when. (Freddie 1302.8(a); Fannie Section 4)
9. Staff: A person reviews AI output before it reaches a borrower. (Good practice)
10. Data: AI output created from borrower data is handled as confidential. (Fannie Section 4)
11. Vendors: You have asked each vendor how its AI uses your data, and filed the answers. (Freddie FAQ on vendors; Fannie Section 4)
12. Risk: Each AI use has a simple risk rating, the threats you considered and the controls you chose. (Freddie 1302.8(c); Fannie Section 4)
13. Monitoring: You check AI output on a schedule for accuracy, security problems and bias. (Freddie 1302.8(c); Fannie Section 4)
14. Disclosure: You can send a one-page summary of AI types, purpose and safeguards soon after a request. (Freddie 1302.8(a); Fannie Section 4)
15. Records: Policy versions, approvals, acknowledgments and reviews are kept on file. (Good practice)

Tip: use your browser's print command to save this page as a PDF.

How did you do?

Missing the policy, owner or staff items? Start with the free AI acceptable use policy template, or the $99 AI Policy Starter: an editable acceptable use policy, this 15-point checklist, a staff acknowledgment form and an approved AI tools list.

Missing the inventory, vendor, risk or disclosure items? Those are in the $349 AI Policy Kit: a full governance policy with risk tiers, a senior management approval memo, an AI use inventory with a disclosure summary, a vendor questionnaire and an annual review calendar. Want it tailored to your vendors and staff? See Governance Done-For-You.

Background: Fannie Mae 26-01 and Freddie Mac 1302.8, explained.

Frequently asked questions

Is the AI policy checklist free?

Yes. Use it on this page or print it to PDF. No email is required.

Who is the checklist for?

Mortgage brokers and lenders that use AI tools, including AI features inside their LOS, CRM and marketing software.

Which requirements does the checklist map to?

Freddie Mac Guide Section 1302.8, Fannie Mae Information Security and Business Resiliency Supplement Section 4, and general good practice.

Which BrokerLumen kit covers the inventory and vendor items?

The $349 AI Policy Kit. The $99 AI Policy Starter covers the written policy, this checklist, a staff acknowledgment form and an approved AI tools list.