Fannie Mae and Freddie Mac AI requirements, explained

Last reviewed: October 24, 2026. General information, not legal advice. Read the official sources linked below and confirm your obligations with counsel.

The short version

In 2026 both Fannie Mae and Freddie Mac put written AI governance requirements on the companies that sell loans to them or service loans for them (their seller/servicers). If those companies use AI or machine learning in origination or servicing, they need written AI policies with a named owner, a governance framework, oversight of how their vendors use AI, and the ability to explain their AI use when asked.

Freddie Mac Guide Section 1302.8

Section 1302.8, "Use of artificial intelligence and machine learning", announced in Guide Bulletin 2025-17 (December 10, 2025), has been effective since March 3, 2026. For Seller/Servicers using AI/ML on loans sold to or serviced for Freddie Mac, it requires:

• Written AI/ML policies and procedures approved by senior management (at minimum the CIO, CTO, CISO or CRO, or equivalents).
• Communication of those policies to staff who work in areas that use AI/ML.
• A policy owner who reviews them at least annually.
• Prompt disclosure, on Freddie Mac's request, of the AI/ML used, its purpose, and the safeguards in place.
• Indemnification of Freddie Mac for losses arising from the Seller/Servicer's AI/ML use.
• A governance framework for mapping, measuring and managing AI risk, with documented legal requirements, monitoring, audits, and defined roles.

Fannie Mae Security Supplement, Section 4

Fannie Mae first set AI governance expectations in Lender Letter LL-2026-04 (April 8, 2026). On October 21, 2026 that letter was superseded by a new edition of the Information Security and Business Resiliency Supplement, announced in Supplement Bulletin 26-01. Section 4 of the Supplement covers AI (Fannie Mae now uses the term "Super Intelligence"; it states the rename does not change scope) and must be fully implemented by January 18, 2027.

The duties carried over from LL-2026-04 include: written AI policies and procedures that are communicated to staff, reflect legal requirements and the lender's risk tolerance, incorporate trustworthy and ethical AI, and have an owner who reviews them at least annually; governance of subcontractor and vendor AI use that is no less protective; and disclosure of AI use and safeguards on request. Read Section 4 directly for the full program requirements.

Side by side

What this means for mortgage brokers

These rules bind Fannie Mae and Freddie Mac seller/servicers. Most brokers are not seller/servicers, so they usually feel the rules through their wholesale lenders: broker agreements, onboarding and recertification questionnaires, and due diligence requests that ask whether you have a written AI policy, who owns it, and which AI tools touch borrower data. Separately, the FTC Safeguards Rule (16 CFR Part 314) already applies to non-bank mortgage brokers and covers the borrower data that flows through AI tools.

Practical next steps

1. List every AI tool your team uses, including AI features inside your LOS, CRM, and marketing tools.
2. Write an AI policy with a named owner and an annual review date.
3. Record what each vendor's AI does with borrower data.
4. Train staff, and keep a short summary ready for when a wholesale lender asks.

Start with our free AI policy checklist for mortgage brokers and vendor questions, get the AI Policy Kit ($497) (or the $149 Starter), or send an intake for a done-for-you policy aligned to both GSEs. Questions are answered in the FAQ.