Last reviewed: October 28, 2026. General information, not legal advice. Each page quotes the official text briefly, explains it in plain English, gives a broker checklist and links the official source first. Every date and quote was checked against the official source on the review date.
| Rule | Topic | Effective date and status |
|---|---|---|
| Freddie Mac Guide Section 1302.8 | AI/ML governance | Effective March 3, 2026 |
| Freddie Mac Guide Section 1302.2 | AI in security training and incident response | AI duties effective March 3, 2026; current version dated July 1, 2026 |
| Fannie Mae Supplement Section 4 | Super Intelligence (SI) governance | Effective January 18, 2027 |
| Fannie Mae Supplement Bulletin 26-01 | What changed in the Supplement | Effective January 18, 2027 |
| Colorado SB 26-189 | ADMT in consequential decisions | Takes effect January 1, 2027 |
| California CPPA ADMT regulations | Automated decisionmaking technology | ADMT compliance by January 1, 2027 |
| ECOA and Regulation B | Adverse action reasons and fair lending | In force; CFPB AI circulars withdrawn |
| Gramm-Leach-Bliley Act (GLBA) | Borrower data privacy and the service provider contract rule | In force; Regulation P, 12 CFR Part 1016 |
| FTC Safeguards Rule | Information security program and 30-day FTC notice | In force; FTC notice required since May 13, 2024 |
GSE rules
Freddie Mac's Section 1302.8 sets AI/ML governance requirements, and Section 1302.2 adds AI to security training and incident playbooks. Fannie Mae's Supplement Section 4, announced in Bulletin 26-01, takes effect January 18, 2027.
State rules
Colorado SB 26-189 covers automated decision-making technology in lending decisions starting January 1, 2027. The California CPPA ADMT regulations require businesses already using ADMT for significant decisions to comply by January 1, 2027.
Federal fair lending
ECOA and Regulation B still require specific adverse action reasons when AI is involved. The CFPB's AI adverse action circulars (2022-03 and 2023-03) were withdrawn on May 12, 2025, so they have no separate page; their status is explained on the Regulation B page.
Federal privacy and security
The Gramm-Leach-Bliley Act sets the privacy duties for borrower data, including the contract you need before an AI vendor processes it. The FTC Safeguards Rule requires a written security program for mortgage brokers, with MFA, logging, vendor oversight and a 30-day FTC notice for events involving 500 or more consumers.
How we review
We read each rule on the issuing body's own site: Freddie Mac's Guide, Fannie Mae's published PDFs, the Colorado General Assembly, the California Privacy Protection Agency, eCFR and consumerfinance.gov. Anything we could not confirm there was left out.
Turn these rules into a written policy
The $99 AI Policy Starter, $349 AI Policy Kit and $699 AI Team Kit are each priced under $1,000. The AI Policy Starter includes a staff acknowledgment form; the AI Policy Kit and AI Team Kit include Small Shop portal access with staff sign-off tracking built in.
Get the AI Policy Kit, $349AI Policy Starter, $99AI Team Kit, $699Compare kitsFrequently asked questions
Which AI rules apply to mortgage brokers?
It depends on who you sell to and where you lend. Freddie Mac Guide Sections 1302.8 and 1302.2, Fannie Mae Supplement Section 4, Regulation B, and state rules such as Colorado SB 26-189 and the California CPPA ADMT regulations are covered in this library.
When do the Fannie Mae AI requirements take effect?
Bulletin 26-01 states an effective date of January 18, 2027.
Why is there no page for the CFPB AI circulars?
The CFPB lists Circulars 2022-03 and 2023-03 as withdrawn on May 12, 2025. Their status is explained on our Regulation B page.
How often is the library reviewed?
Each page shows its last reviewed date. All pages were last reviewed on October 28, 2026.