Home / Rules Library / Fannie Mae Bulletin 26-01
Mortgage AI Rules LibraryFannie Mae Bulletin 26-01: what changed in the Supplement
Last reviewed: October 28, 2026. General information, not legal advice. Quotes come from the Bulletin 26-01 PDF published by Fannie Mae; each is followed by a plain-English line.
What the bulletin does
"The purpose of this Bulletin is to notify Companies subject to the Supplement that a new version of the Supplement has been published."Bulletin 26-01
In plain English: Fannie Mae rewrote its security Supplement. The bulletin is the change list; the Supplement holds the rules.
The new AI section
"Added new section on SI governance requirements for Companies that use SI in connection with the activities performed under, or relating, to its Underlying Agreements"Bulletin 26-01, Section 4 - Super Intelligence (SI) (NEW)
In plain English: If you use AI on Fannie Mae business, you now need an SI governance program, vendor oversight and the ability to disclose your use to Fannie Mae.
"This terminology update is not intended to alter the scope, meaning, or applicability of the requirements."Bulletin 26-01, footnote 1
In plain English: Super Intelligence is Fannie Mae's new word for AI. Read SI as AI.
Incident notice and other security changes
"Revised requirements for initial notification to Fannie Mae within 36-hour period"Bulletin 26-01, Section 5 - Cybersecurity Incident Management
In plain English: Plan to give Fannie Mae a first notice of a cybersecurity incident within 36 hours, then follow up promptly with details.
"Replaced the term “vendor” with the term “third party”"Bulletin 26-01, Section 3.14 - Supply Chain Risk Management
In plain English: Oversight now reaches every third party, not only vendors, and the Company is responsible for their compliance with the Supplement.
The bulletin also adds NIST 800-53 as an example standard, an insurance policy requirement, updated MFA and encryption requirements, and a business impact analysis in business continuity planning.
How amendments are accepted
"Updated to clarify that Company is deemed to accept amendments if no rejection within applicable period"Bulletin 26-01, Section 7 - General Requirements; Issued Bulletins; Amendments
In plain English: If you do nothing, you are treated as accepting the new Supplement.
AI tools, email connectors and vendor paperwork
In practice, the new Supplement turns into a few concrete decisions about tools like ChatGPT and Grok: which plan to buy (see the plan comparison), whether staff may connect AI to work email, what to ask in a vendor quote, and the six must-have controls to have in place. Plan to have them in place, with any gaps logged as documented exceptions, before January 18, 2027.
A Bulletin 26-01 checklist for brokers and lenders
- Read the new Supplement, starting with Section 4.
- Build an AI (SI) use case inventory and name a policy owner.
- Update your incident plan for a first notice within 36 hours.
- Rename vendor oversight to third party oversight and widen its scope.
- Check MFA, encryption and insurance against the new text.
- Calendar January 18, 2027 for full implementation.
Get ready for January 18, 2027
The $349 AI Policy Kit includes a full AI/ML governance policy, an AI use inventory with a disclosure summary, a vendor questionnaire, an incident response one-pager and a Freddie and Fannie crosswalk, plus 3 months of Small Shop portal access for staff sign-off tracking.
Get the AI Policy Kit, $349AI Policy Starter, $99AI Team Kit, $699Compare kitsFrequently asked questions
What is Fannie Mae Bulletin 26-01?
It is the Information Security and Business Resiliency Supplement bulletin that announces a new version of the Supplement, including a new Section 4 on Super Intelligence (SI).
When does Bulletin 26-01 take effect?
The bulletin states "Effective Date: January 18, 2027 (90 Days from publication)".
Does Super Intelligence change what the AI rules cover?
No. The bulletin says the terminology update is not intended to alter the scope, meaning, or applicability of the requirements.
What is the new incident notice timing?
The bulletin says Section 5 revises the initial notification to Fannie Mae to within a 36-hour period, followed by prompt notification of supplemental details.