BrokerLumen logo, AI governance for mortgage brokersBrokerLumen logo, AI governance for mortgage brokers

Home / AI readiness self-assessment

Free self-assessment

Mortgage AI readiness self-assessment

Last reviewed: November 3, 2026. General information, not legal advice. This self-assessment helps you find gaps in how your company governs AI. It does not certify that you meet any rule. Confirm your obligations with counsel.

Private by design: your answers stay in your browser. Nothing is sent to BrokerLumen or saved. Takes about three minutes. Answer Partly when something exists but is out of date, unsigned or incomplete.

1. Do you have a written AI policy that staff can find and that is in effect today?

Why it matters: Freddie Mac 1302.8(a) requires written AI/ML policies and procedures. Fannie Mae Section 4 requires a "Documented and implemented formal SI governance program".

Start from the free AI acceptable use policy template, or see the AI policy checklist for what a full policy covers.
2. Is one named person responsible for the AI policy, with a review at least once a year on the calendar?

Why it matters: Freddie Mac 1302.8(a) calls for an owner who reviews the policies at least annually. Fannie Mae Section 4 requires "A designated owner".

Name the owner in the policy itself and put the annual review date on a shared calendar. See Freddie Mac 1302.8 in plain English.
3. Has senior management approved the policy, with the approval dated and on file?

Why it matters: Freddie Mac 1302.8(a) says the policies must be approved by Senior Management.

Record approval in a short signed memo with the date and policy version. Lenders often ask who approved the policy; see how to answer a lender AI questionnaire.
4. Do you keep a list of every way AI is used: staff chat tools, AI features in your LOS, CRM and pricing tools, marketing tools and vendor systems?

Why it matters: Fannie Mae Section 4 requires policies that "Require the maintenance of an inventory of SI use cases".

List each use with its purpose, the data it touches and its owner. The Section 4 readiness plan schedules this in week 2.
5. Do you have an approved AI tools list, with a rule that borrower data goes only into approved company AI tools under company accounts?

Why it matters: The FTC Safeguards Rule and GLBA protect borrower nonpublic personal information. Fannie Mae Section 4 says SI outputs derived from Confidential Information should be treated as Confidential Information.

Publish an approved tools list and ban personal or free accounts for borrower data. See can I connect AI to my work email? and the FTC Safeguards Rule page.
6. Has every staff member who uses AI been trained on the policy and signed an acknowledgment?

Why it matters: Freddie Mac 1302.8(a) says the policies must be communicated to appropriate personnel. Freddie Mac 1302.2 adds AI to security awareness training when necessary.

Collect a signed acknowledgment from each person and keep the dates. The BrokerLumen portal tracks sign-offs; the Free plan covers up to 10 staff.
7. Do you ask your vendors how they govern the AI inside their products, and keep their answers on file?

Why it matters: Fannie Mae Section 4 requires governance of third party SI use that is "no less protective". The FTC Safeguards Rule requires oversight of service providers.

Send each vendor a short AI questionnaire and file the answers. See AI vendor due diligence for mortgage companies.
8. Have you reviewed each AI use for security risks such as data leakage and prompt injection, and written down the safeguards?

Why it matters: Fannie Mae Section 4 lists adversarial manipulation, model inversion, data leakage, prompt injection and training data integrity issues.

Do a one-page review per AI use and record the safeguard chosen. The AI controls checklist covers the six basics.
9. Is a new AI tool, or a new AI feature in a tool you already use, reviewed and approved before staff start using it?

Why it matters: Fannie Mae Section 4 requires change management controls for SI models, systems and use cases.

Add a simple request and approval step to the policy, and update the inventory when a change is approved.
10. Do staff know what to do, and who to tell, if borrower data goes into an unapproved AI tool or an AI tool produces a harmful result?

Why it matters: Freddie Mac 1302.2 requires playbooks for incidents related to AI/ML. Fannie Mae Section 5 sets a 36-hour initial notice for cybersecurity incidents.

Write a one-page AI incident playbook with a contact, a log and timelines. See the Freddie Mac 1302.2 page.
11. Does a person review AI-written ads, posts, emails and images for rate, payment and fair lending issues before they go out?

Why it matters: Regulation Z 12 CFR 1026.24 sets advertising disclosure rules, Regulation N bans misrepresentations, and Regulation B 1002.4(b) covers discouraging statements and images.

Use the AI marketing and fair lending checklist before anything AI-written is posted.
12. If a lender, Freddie Mac or Fannie Mae asked today, could you describe the AI you use, its purpose and your safeguards within a day?

Why it matters: Freddie Mac 1302.8 and Fannie Mae Section 4 both require disclosure of AI use on request, including types, purpose and manner of use, and safeguards.

Keep a one-page AI use summary built from your inventory, with the same dates and versions you give every lender.

How the score works

Each question is worth 2 points for Yes, 1 for Partly and 0 for No. The score is your total as a share of 24 points. Results are grouped as Early stage (under 50%), Partly in place (50% to 84%) and Strong foundation (85% or more). The suggested kit depends on which gaps you have and how many people use AI at your company.

The questions follow the topics in Freddie Mac Guide Section 1302.8, shown as Effective 03/03/2026, and Fannie Mae Supplement Section 4, which Bulletin 26-01 lists as effective January 18, 2027. Both are written for the companies that sell loans to or service loans for the GSEs. Brokers usually meet these expectations through their wholesale lenders' agreements and onboarding forms.

What each gap means

What each gap means and how to close it
GapWhere it comes fromHow to close it
1. No written AI policy in effectFreddie Mac 1302.8(a) requires written AI/ML policies and procedures. Fannie Mae Section 4 requires a "Documented and implemented formal SI governance program".Start from the free AI acceptable use policy template, or see the AI policy checklist for what a full policy covers.
2. No named owner or annual reviewFreddie Mac 1302.8(a) calls for an owner who reviews the policies at least annually. Fannie Mae Section 4 requires "A designated owner".Name the owner in the policy itself and put the annual review date on a shared calendar. See Freddie Mac 1302.8 in plain English.
3. No recorded senior management approvalFreddie Mac 1302.8(a) says the policies must be approved by Senior Management.Record approval in a short signed memo with the date and policy version. Lenders often ask who approved the policy; see how to answer a lender AI questionnaire.
4. No AI use inventoryFannie Mae Section 4 requires policies that "Require the maintenance of an inventory of SI use cases".List each use with its purpose, the data it touches and its owner. The Section 4 readiness plan schedules this in week 2.
5. No approved tools list or borrower data ruleThe FTC Safeguards Rule and GLBA protect borrower nonpublic personal information. Fannie Mae Section 4 says SI outputs derived from Confidential Information should be treated as Confidential Information.Publish an approved tools list and ban personal or free accounts for borrower data. See can I connect AI to my work email? and the FTC Safeguards Rule page.
6. Staff not trained or acknowledgments missingFreddie Mac 1302.8(a) says the policies must be communicated to appropriate personnel. Freddie Mac 1302.2 adds AI to security awareness training when necessary.Collect a signed acknowledgment from each person and keep the dates. The BrokerLumen portal tracks sign-offs; the Free plan covers up to 10 staff.
7. No vendor AI due diligenceFannie Mae Section 4 requires governance of third party SI use that is "no less protective". The FTC Safeguards Rule requires oversight of service providers.Send each vendor a short AI questionnaire and file the answers. See AI vendor due diligence for mortgage companies.
8. No AI security risk reviewFannie Mae Section 4 lists adversarial manipulation, model inversion, data leakage, prompt injection and training data integrity issues.Do a one-page review per AI use and record the safeguard chosen. The AI controls checklist covers the six basics.
9. No review before new AI tools or features go liveFannie Mae Section 4 requires change management controls for SI models, systems and use cases.Add a simple request and approval step to the policy, and update the inventory when a change is approved.
10. No AI incident playbookFreddie Mac 1302.2 requires playbooks for incidents related to AI/ML. Fannie Mae Section 5 sets a 36-hour initial notice for cybersecurity incidents.Write a one-page AI incident playbook with a contact, a log and timelines. See the Freddie Mac 1302.2 page.
11. No human review of AI marketingRegulation Z 12 CFR 1026.24 sets advertising disclosure rules, Regulation N bans misrepresentations, and Regulation B 1002.4(b) covers discouraging statements and images.Use the AI marketing and fair lending checklist before anything AI-written is posted.
12. No disclosure summary readyFreddie Mac 1302.8 and Fannie Mae Section 4 both require disclosure of AI use on request, including types, purpose and manner of use, and safeguards.Keep a one-page AI use summary built from your inventory, with the same dates and versions you give every lender.

What to do next

  1. Close the basics first: a written policy, a named owner, an approved tools list and staff acknowledgments.
  2. Build your AI use inventory, then run the security review and vendor questions against it.
  3. Follow the week-by-week Section 4 readiness plan to finish before January 18, 2027.
  4. Check the state AI laws for each state where you are licensed.
  5. Repeat this self-assessment after your annual review or when a new AI tool comes in.

Close your gaps with documents you can send a lender

The $349 AI Policy Kit covers the full program: governance policy, senior management approval memo, AI use inventory with a disclosure summary, vendor questionnaire, incident response one-pager and a Freddie and Fannie crosswalk, plus 3 months of Small Shop portal access for staff sign-off tracking. The $99 AI Policy Starter covers the written policy, staff acknowledgment and approved tools list.

Get the AI Policy Kit, $349AI Policy Starter, $99AI Team Kit, $699Compare kits

Frequently asked questions

Is the AI readiness self-assessment free?

Yes. It is free, takes about three minutes and runs in your browser. Your answers are not sent to BrokerLumen or saved.

Does a high score mean my company meets Freddie Mac and Fannie Mae requirements?

No. The score reflects your own answers to twelve questions. It is not an audit, a certification or legal advice. Use it to find gaps, then confirm your obligations with counsel.

Which rules are the questions based on?

The questions follow the topics in Freddie Mac Guide Section 1302.8 and 1302.2, Fannie Mae Supplement Section 4, the FTC Safeguards Rule and the federal advertising and fair lending rules in Regulations Z, N and B.

Do these rules apply to mortgage brokers?

Freddie Mac 1302.8 and Fannie Mae Section 4 are written for the companies that sell to and service for the GSEs. Brokers are not named, but wholesale lenders often pass these expectations on through broker agreements and due diligence forms.

What should I fix first?

Start with a written AI policy, a named owner, an approved AI tools list with a borrower data rule, and signed staff acknowledgments. Then build an AI use inventory and work through vendors, security, change control and incidents.