Fannie Mae 26-01 and Freddie Mac 1302.8 AI Rules Explained

Last reviewed: October 27, 2026. General information, not legal advice. Read the official sources linked below and confirm your obligations with counsel.

The short version

Freddie Mac announced its AI/ML rules in December 2025 bulletins, effective March 3, 2026. Fannie Mae issued Lender Letter LL-2026-04 in April 2026, then moved its AI rules into Section 4 of its Information Security and Business Resiliency Supplement with Bulletin 26-01, effective January 18, 2027. Both expect the companies they do business with to have written AI policies with a named owner, a governance framework, oversight of vendor AI and the ability to explain their AI use when asked.

Freddie Mac Guide Section 1302.8

Section 1302.8, "Use of artificial intelligence and machine learning", was announced in Bulletin 2025-16 and Bulletin 2025-17. For Seller/Servicers using AI/ML on loans sold to or serviced for Freddie Mac, it requires:

Written AI/ML policies and procedures approved by senior management (at minimum the CIO, CTO, Chief Information Security Office or Chief Risk Officer, or equivalents).
Communication of those policies to staff who work in areas that use AI/ML.
A policy owner who reviews them at least annually.
Prompt disclosure, on Freddie Mac's request, of the AI/ML used, its purpose and manner, and the safeguards in place.
Indemnification of Freddie Mac for losses arising directly or indirectly out of or relating to the Seller/Servicer's AI/ML use.
A governance framework for mapping, measuring and managing AI risk, with documented legal requirements, threat assessment, monitoring, audits and defined roles.

Freddie Mac FAQs published May 21, 2026 add that simple automation that does not analyze data or make a decision is not AI/ML for Section 1302.8(a), and that vendor AI must be covered by the third-party risk program. Full walk-through: Freddie Mac 1302.8 in plain English.

Fannie Mae Supplement Section 4 and Bulletin 26-01

Bulletin 26-01 announced a new version of the Information Security and Business Resiliency Supplement with a new Section 4, Super Intelligence (SI). Fannie Mae says the term SI replaces "Artificial Intelligence" and "is not intended to alter the scope, meaning, or applicability of the requirements." Section 4 requires an SI governance program with an inventory of use cases, risk identification, data governance, model testing, monitoring, change management, security risk assessment, safeguards, segregation of duties and a designated owner who reviews it at least annually. It adds Confidential Information controls, third party SI governance and disclosure on request.

Lender Letter LL-2026-04 (April 8, 2026) set out the earlier AI/ML governance duties and is now marked as superseded by the Supplement. See the change table in Fannie Mae AI requirements: Section 4 and Bulletin 26-01.

Side by side

Topic	Freddie Mac 1302.8	Fannie Mae Section 4 (26-01)
Where it lives	Single-Family Seller/Servicer Guide, Section 1302.8	Information Security and Business Resiliency Supplement, Section 4 (Super Intelligence)
Announced	Bulletin 2025-16 (Selling, December 3, 2025) and Bulletin 2025-17 (Servicing, December 10, 2025)	Supplement Bulletin 26-01; earlier duties in Lender Letter LL-2026-04 (April 8, 2026), now superseded
Date	Shown as effective March 3, 2026	Effective January 18, 2027; full implementation by that date
Applies to	Seller/Servicers using AI/ML on Freddie Mac loans	A Company subject to the Supplement using SI in activities under or relating to its Underlying Agreements
Written policies	Approved by senior management, communicated to staff, owner reviews at least annually	Formal SI governance program; designated owner reviews at least annually
Inventory	Not listed in 1302.8; an FAQ says Seller/Servicers should at a minimum identify AI/ML using Freddie Mac confidential or Protected Information or connecting to Freddie Mac Systems	Inventory of SI use cases required
Security testing	Assess for threats such as data poisoning and adversarial inputs	Assess for adversarial manipulation, model inversion, data leakage, prompt injection and training data integrity issues
Monitoring and audits	Monitor for performance, security breaches and biases; internal and external audits; standards like NIST 800-53 and ISO 27001	Monitoring, auditing, post-deployment monitoring and retirement
Vendors	FAQ: third-party risk program must cover service provider AI/ML	Third party SI governance no less protective; Company responsible for third party failures (Section 3.14)
Disclosure on request	Types, purpose and manner, safeguards, other information	Types, purpose and manner, safeguards, other information
Other	Indemnification of Freddie Mac for losses relating to the Seller/Servicer's AI/ML use	SI outputs derived from Confidential Information treated as Confidential Information

What this means for mortgage brokers

Both rules are written for the companies that do business directly with Fannie Mae and Freddie Mac. Most independent brokers are not named. In practice, brokers may feel the rules through their wholesale lenders: broker agreements, onboarding and recertification questionnaires, and due diligence requests that ask whether you have a written AI policy, who owns it and which AI tools touch borrower data. Fannie Mae's Supplement says a Company shall cause its third parties involved in its Fannie Mae activities to comply with the Supplement.

Practical next steps

List every AI tool your team uses, including AI features inside your LOS, CRM and marketing tools.
Write an AI policy with senior approval, a named owner and an annual review date. Start with our free template.
Record what each vendor's AI does with borrower data, using our vendor due diligence questions.
Train staff, collect acknowledgments, and keep a short summary ready for when a lender asks.
Check your gaps with the AI policy checklist.

Aligned to both GSEs, priced under $1,000

The $349 AI Policy Kit includes a full governance policy, a senior management approval memo, an AI use inventory with a disclosure summary and a Freddie Mac 1302.8 and Fannie Mae Section 4 crosswalk, plus 3 months of Small Shop portal access for staff sign-off tracking. Start with the $99 AI Policy Starter if you only need the written policy and acknowledgment.

Get the AI Policy Starter, $99 AI Policy Kit, $349 Compare kits

Frequently asked questions

When do the Fannie Mae and Freddie Mac AI requirements take effect?

Freddie Mac Guide Section 1302.8 is shown as effective March 3, 2026. Fannie Mae Supplement Bulletin 26-01, which adds Section 4 on Super Intelligence, is effective January 18, 2027.

What is Fannie Mae Bulletin 26-01?

The Information Security and Business Resiliency Supplement Bulletin 26-01 announced a new version of the Supplement, including a new Section 4 on Super Intelligence (SI) governance, with an Effective Date of January 18, 2027.

Is Super Intelligence different from AI?

Fannie Mae says it uses Super Intelligence in place of Artificial Intelligence to align with evolving industry terminology and that the change is not intended to alter the scope, meaning or applicability of the requirements.

Do these rules apply to mortgage brokers?

They apply to the companies that do business directly with Fannie Mae and Freddie Mac. Brokers are not named, but wholesale lenders may ask brokers about AI use.

What is the main difference between the two?

Freddie Mac 1302.8 focuses on approved written policies, indemnification and a governance framework. Fannie Mae Section 4 adds detailed program elements such as a use case inventory, data and model controls and Confidential Information rules.