AI vendor due diligence for mortgage companies: 12 questions to ask

Last reviewed: October 27, 2026. General information, not legal advice. Send these questions to each LOS, CRM, pricing, point of sale and marketing vendor and file the answers with your AI inventory.

Why vendor AI is your problem too

Freddie Mac says its Seller/Servicers "must have a third-party risk management program" that addresses the risk "if the service provider uses artificial intelligence (AI)/machine learning (ML)". Fannie Mae Supplement Section 4 requires a Company to "Manage risks and appropriate governance of third party use of SI that is no less protective of these requirements". If your wholesale lenders must govern their vendors' AI, expect them to ask you how you govern yours.

The 12 questions

1. Which features in your product use AI or machine learning, and which are on by default?
   Why it matters: You cannot govern AI you do not know about. Fannie Mae Section 4 requires an inventory of SI use cases.
2. Does any of our borrower data go to an AI model? Which model, operated by whom, and where is it hosted?
   Why it matters: Section 4 requires controls to protect Confidential Information when using SI.
3. Is our data used to train or improve your models or anyone else's? Can we opt out in writing?
   Why it matters: Training on borrower data can expose it beyond your control.
4. How long do you keep prompts, outputs and uploaded documents, and how are they deleted?
   Why it matters: Section 4 says SI outputs derived from Confidential Information should be treated as Confidential Information, so output retention matters too.
5. Which subcontractors or AI providers process our data?
   Why it matters: Fannie Mae requires governance of third party SI use that is "no less protective", and Section 3.14 makes the Company responsible for third party failures to comply.
6. Do you have a written AI governance policy, and who owns it?
   Why it matters: Freddie Mac 1302.8 and Fannie Section 4 both expect a named owner who reviews AI policies at least annually.
7. How do you test AI features for accuracy, bias and security risks such as prompt injection or data leakage?
   Why it matters: Section 4 lists prompt injection, data leakage, model inversion and adversarial manipulation. Section 1302.8(c) calls for monitoring for performance, security breaches and biases.
8. Can AI output reach a borrower without a person reviewing it first?
   Why it matters: Human review is the main safeguard for borrower-facing AI.
9. How will you notify us of material changes to your AI features or AI providers?
   Why it matters: Section 4 requires change management controls for SI models, systems and use cases.
10. Which security certifications or independent audit reports cover the AI features?
    Why it matters: Section 1302.8(c) names NIST 800-53 and ISO 27001 as example standards for audits.
11. How do you handle an AI-related incident, and how fast will you tell us?
    Why it matters: Bulletin 26-01 sets initial notice to Fannie Mae within a 36-hour period for Cybersecurity Incidents, so you need fast notice from vendors.
12. Will you help us answer a lender or investor request about the AI in your product?
    Why it matters: Both GSEs can ask for the types of AI used, its purpose and manner of use, and safeguards.

What to do with the answers

1. Record each answer next to the tool in your AI use inventory.
2. Flag any vendor that sends borrower data to a model you have not approved, or trains on your data without an opt out.
3. Decide: approve, approve with limits, or stop using the feature. Write down who decided and when.
4. Re-ask at every contract renewal, and when a vendor announces a new AI feature.

Background: Freddie Mac 1302.8 in plain English, Fannie Mae Section 4 and Bulletin 26-01, and the AI policy checklist.

Frequently asked questions

Do Fannie Mae and Freddie Mac require vendor AI oversight?

Freddie Mac says Seller/Servicers must have a third-party risk management program that covers service provider AI/ML. Fannie Mae Supplement Section 4 requires governance of third party SI use that is no less protective of its requirements.

Which vendors should get these questions?

Any vendor whose product uses AI and touches your loans or borrower data, such as LOS, CRM, pricing, point of sale, document processing, call recording and marketing tools.

How often should I re-ask vendors about AI?

At least at each contract renewal and whenever a vendor adds or changes an AI feature. Fannie Mae says third party re-assessments should be conducted on a risk-based frequency.

Is the vendor disclosure request letter free?

Yes. Enter your work email to download it. It is not emailed to you.