Fannie Mae Section 4 countdown: an 11-week AI readiness plan

Last reviewed: November 3, 2026. General information, not legal advice. The plan below is one practical way to organize the work; it is not a Fannie Mae document and does not mean any company meets the Supplement. Confirm your obligations with counsel.

Who needs to be ready by January 18, 2027

Independent brokers are not named in Section 4. Section 3.14 says a Company "shall cause its third parties involved with Company's activities under the applicable Underlying Agreements to comply with the Supplement". That is why wholesale lenders send AI questions to brokers at onboarding and recertification. See how to answer a wholesale lender's AI questionnaire.

Bulletin 26-01 says "Super Intelligence" is used in place of "Artificial Intelligence" and that the change "is not intended to alter the scope, meaning, or applicability of the requirements." Read SI as AI throughout this plan.

The 11-week plan

Each week has one goal, a short task list and the evidence to file. Small shops can combine weeks. If you start late, see the two-week version below.

1. Week 1 · November 2 to 8

   Name the owner and take stock

   • Name one person as the AI program owner, as Section 4 requires a designated owner.
   • Gather what already exists: any AI policy, tool approvals, vendor answers and training records.
   • Take the free AI readiness self-assessment to see your gaps.

   Evidence to file: A short memo naming the owner, and your self-assessment printout.

2. Week 2 · November 9 to 15

   Build the AI use inventory

   • List every AI use: staff chat tools, AI features in your LOS, CRM and pricing tools, marketing tools and vendor systems. The free AI use inventory builder walks you through it.
   • For each one, note the purpose, the data it touches, the owner and whether borrower data is involved.
   • Ask each team lead to confirm nothing is missing.

   Evidence to file: AI use inventory, version 1, with the date.

3. Week 3 · November 16 to 22

   Write or update the governance policy

   • Cover the Section 4 program elements: risk identification and tolerance, data governance, model testing or vendor assurance, monitoring and retirement, change management, segregation of duties, transparency to staff and ethics.
   • Add the Confidential Information rule: AI output derived from borrower data is treated as confidential.
   • Keep the language aligned to Freddie Mac 1302.8 so one policy serves both.

   Evidence to file: Draft governance policy with a version number.

4. Week 4 · November 23 to 29 (Thanksgiving week)

   Lock down tools and borrower data

   • Publish an approved AI tools list.
   • State that borrower nonpublic personal information goes only into approved company AI tools under company accounts.
   • Turn off or remove personal and free AI accounts used for work.

   Evidence to file: Approved AI tools list and the borrower data rule in the policy.

5. Week 5 · November 30 to December 6

   Run the security risk review

   • For each inventory item, check the risks Section 4 names: adversarial manipulation, model inversion, data leakage, prompt injection and training data integrity issues.
   • Record the safeguard chosen for each risk, or why the risk does not apply.
   • Use the AI controls checklist for the six basics.

   Evidence to file: One-page security review per AI use, with safeguards documented.

6. Week 6 · December 7 to 13

   Cover vendors and third parties

   • Send each vendor that uses AI a short questionnaire on how it governs that AI.
   • Check contracts for data use, retention and incident notice terms.
   • Section 3.14 makes the Company responsible for its third parties under the Supplement, so file every answer.

   Evidence to file: Vendor AI questionnaire answers and a contract review note for each vendor.

7. Week 7 · December 14 to 20

   Add change control and monitoring

   • Write a simple request and approval step for any new AI tool or new AI feature.
   • Set how you monitor each AI use after go-live and how a tool is retired.
   • Split duties so the person who requests a tool is not the only one who approves it.

   Evidence to file: Change request form and a monitoring and retirement procedure.

8. Week 8 · December 21 to 27 (holiday week)

   Write the AI incident playbook

   • Define an AI incident: borrower data in an unapproved tool, a harmful or wrong output sent to a borrower, or a vendor AI breach.
   • Name who to tell and when. Section 5 of the Supplement sets a 36-hour initial notice for cybersecurity incidents, and the FTC Safeguards Rule has its own notice rule.
   • Keep an incident log. A free template: the AI incident response playbook.

   Evidence to file: AI incident response one-pager and an empty incident log.

9. Week 9 · December 28 to January 3

   Get senior management approval

   • Finalize the policy, inventory and procedures.
   • Have senior management approve them in writing, with the date and version.
   • Publish the final policy where staff can find it.

   Evidence to file: Signed approval memo with the policy version.

10. Week 10 · January 4 to 10

    Train staff and collect sign-offs

    • Walk staff through the approved tools list, the borrower data rule and the incident playbook.
    • Collect a signed acknowledgment from every person who uses AI.
    • Follow up with anyone who has not signed.

    Evidence to file: Training record and staff acknowledgments with dates.

11. Week 11 · January 11 to 17

    Get disclosure-ready and calendar the review

    • Write a one-page AI use summary: types of AI, purpose and manner of use, and safeguards. Fannie Mae can ask for these on request.
    • Put the annual owner review on the calendar.
    • Keep the evidence in one folder so you can answer any lender questionnaire the same way.

    Evidence to file: AI use summary and the next review date. Section 4 takes effect January 18, 2027.

Section 4 elements mapped to this plan

Every element below comes from the Section 4 list of program requirements in the Supplement published with Bulletin 26-01.

Starting late? The two-week minimum

If you have only two weeks, cover the items a lender is most likely to ask about first, then finish the rest on a dated plan.

1. Days 1 to 3: name the owner, list every AI use and publish an approved tools list with the borrower data rule.
2. Days 4 to 7: adopt a written governance policy that covers the Section 4 elements, and get senior management approval in writing.
3. Days 8 to 10: collect staff acknowledgments and send vendor AI questionnaires.
4. Days 11 to 14: write the incident playbook and the one-page AI use summary, and date a plan for the security reviews still open.

Also on your calendar

• January 1, 2027: Colorado SB 26-189 applies to consequential decisions made on or after this date. See Colorado SB 26-189.
• January 1, 2027: California businesses already using ADMT for significant decisions must meet the CPPA ADMT article. See California CPPA ADMT.
• Other states: see state AI laws that affect mortgage brokers.

Frequently asked questions

When does Fannie Mae Section 4 take effect?

Fannie Mae Supplement Bulletin 26-01 lists an Effective Date of January 18, 2027, and Fannie Mae says companies must complete full implementation by that date.

How long does it take to get ready for Section 4?

It depends on how many AI tools and vendors you use. This plan spreads the work over 11 weeks from early November 2026. A small shop that already has a written AI policy can often move faster.

Does Section 4 apply to mortgage brokers?

Section 4 applies to a Company subject to the Fannie Mae Supplement that uses SI. Brokers are not named, but Section 3.14 requires Companies to cause their third parties to comply, so lenders often pass expectations on to brokers.

What documents should I have on file by January 18, 2027?

A governance policy approved by senior management, an AI use inventory, security reviews with documented safeguards, vendor AI answers, change and monitoring procedures, an AI incident playbook, staff acknowledgments and a one-page AI use summary.

Is Freddie Mac 1302.8 already in effect?

Freddie Mac Guide Section 1302.8 is shown as Effective 03/03/2026. A policy written for Section 4 can be aligned to both.