Fannie Mae Section 4: AI (Super Intelligence) Rules

Last reviewed: October 28, 2026. General information, not legal advice. Quotes come from Fannie Mae's published PDFs linked in the sources box. Confirm your obligations with counsel.

The short version

Fannie Mae moved its AI governance rules into a new Section 4, Super Intelligence (SI), of its Information Security and Business Resiliency Supplement. Bulletin 26-01 announced the new Supplement. Lender Letter LL-2026-04, which first set out AI/ML governance duties in April 2026, is now marked as superseded by the Supplement. Section 4 keeps the LL duties and adds specific program elements: a use case inventory, data and model controls, security testing, monitoring and Confidential Information rules.

What Bulletin 26-01 says

"Effective Date: January 18, 2027 (90 Days from publication)"Bulletin 26-01

In plain English: Section 4 and the other Supplement changes take effect January 18, 2027.

"The term “Super Intelligence” is used in place of “Artificial Intelligence” to align with evolving industry terminology. This terminology update is not intended to alter the scope, meaning, or applicability of the requirements."Bulletin 26-01, footnote 1

In plain English: “Super Intelligence” is Fannie Mae's new label for what most people call AI. Fannie Mae says the scope of the rules is unchanged.

Other changes the bulletin lists include: a new Section 4 on SI governance; initial notice of a cybersecurity incident to Fannie Mae within a 36-hour period (Section 5); an "independent third-party security professional" for independent security assessments (Section 3.3); "third party" replacing "vendor" throughout (Section 3.14); NIST 800-53 named as an example standard and a new insurance policy requirement (Section 3); a business impact analysis in the business continuity plan (Section 6.1); and deemed acceptance of amendments if not rejected in time (Section 7).

Who Section 4 applies to

"To the extent a Company uses an SI System in connection with activities performed under, or relating to, its Underlying Agreements, the Company is subject to and must comply with all requirements set forth in this section"Supplement, Section 4

In plain English: If your company is subject to the Supplement and uses AI in work tied to its Fannie Mae agreements, all of Section 4 applies.

Brokers that are not Fannie Mae counterparties are not named. Section 3.14 says a Company "shall cause its third parties involved with Company's activities under the applicable Underlying Agreements to comply with the Supplement". Lenders you work with may pass those expectations on to you.

What Section 4 requires

"Company must implement an SI Governance Program"Supplement, Section 4

In plain English: Have a written, working AI governance program, not just a one-page rule sheet.

"Require the maintenance of an inventory of SI use cases"Section 4

In plain English: Keep a list of each way you use AI, with its purpose and scope.

"Assess Super Intelligence for security risks, such as adversarial manipulation, model inversion, data leakage, prompt injection, and training data integrity issues"Section 4

In plain English: Check each AI use for the ways it could leak data or be manipulated, and document the safeguards you chose.

"Govern model design, training, testing and validation"Section 4

In plain English: If you build or tune AI, test it before use. If you buy it, ask the vendor how they do this.

"Include change management controls for SI models, systems and use cases"Section 4

In plain English: Review and record changes before a new AI feature or use goes live.

"SI outputs derived from Confidential Information should be treated as Confidential Information."Section 4

In plain English: An AI summary of a borrower file is as sensitive as the file. Train staff on this.

"A designated owner is responsible for implementing, maintaining and reviewing the policies, processes and procedures at least annually"Section 4

In plain English: Name one owner and review the program every year.

"Manage risks and appropriate governance of third party use of SI that is no less protective of these requirements"Section 4

In plain English: Your vendors' AI use must be governed to the same standard as yours.

Section 4 also requires risk tolerance, data governance, monitoring and retirement, documented safeguards, transparency to staff, segregation of duties, trustworthy and ethical SI principles, and compliance with applicable law. On Fannie Mae's request, a Company must promptly disclose the types of SI used, the purpose and manner of use, its safeguards and other information Fannie Mae requires.

What changed from LL-2026-04

The table compares the April 2026 Lender Letter with Supplement Section 4 as published with Bulletin 26-01.

Topic	LL-2026-04 (April 2026)	Supplement Section 4 (Bulletin 26-01)
Status	Issued April 8, 2026, "Effective: 120 days from publication". Now marked as superseded by the Supplement published October 21, 2026.	Section 4 of the Supplement. Bulletin 26-01 gives an effective date of January 18, 2027, and Fannie Mae says companies must complete full implementation by that date.
Term used	Artificial intelligence and/or machine learning (AI/ML).	Super Intelligence (SI). Bulletin 26-01 says the new term is "not intended to alter the scope, meaning, or applicability of the requirements."
Who it covers	Seller/servicers using AI/ML on loans sold to or guaranteed by Fannie Mae, or serviced for Fannie Mae.	A "Company" subject to the Supplement that uses an SI System "in connection with activities performed under, or relating to, its Underlying Agreements".
Program	Written policies and procedures for AI/ML development, use, maintenance and risk.	A "Documented and implemented formal SI governance program".
Use case inventory	Not listed.	New: policies must "Require the maintenance of an inventory of SI use cases".
Risk identification and tolerance	Risk management based on risk tolerance.	Kept, plus risk identification, assessment and remediation processes.
Data, models and change control	Not listed.	New: data governance, retention, classification and quality; model design, training, testing and validation; change management controls.
Monitoring and retirement	Not listed.	New: monitoring, auditing and performance assessment, including post-deployment monitoring and retirement.
Security risks	Not listed.	New: assess "adversarial manipulation, model inversion, data leakage, prompt injection, and training data integrity issues", and document safeguards.
Segregation of duties	Not listed.	New: controls for segregation of duties.
Staff communication, ethics, legal	Policies transparent and communicated to staff; trustworthy and ethical AI/ML; legal and regulatory understanding.	Kept, worded for SI.
Policy owner	Owner reviews at least annually.	A designated owner reviews at least annually.
Confidential Information	Not listed.	New: controls and training to protect Confidential Information when using SI. "SI outputs derived from Confidential Information should be treated as Confidential Information."
Vendors and third parties	Govern subcontractor and vendor AI/ML use "no less protective".	Govern third party SI use "no less protective", and Section 3.14 makes the Company responsible for third party failures to comply.
Disclosure on request	Types, purpose and manner, safeguards, other information.	Same four items, for SI.

Next steps

Build or update your AI use case inventory.
Run a short security risk review on each use: data leakage, prompt injection and manipulation.
Add data, change management and monitoring rules to your AI policy.
Train staff that AI output from borrower data is confidential.
Update vendor due diligence to ask how each third party governs its AI.
Keep a disclosure summary ready, and calendar the annual owner review.

Compare with Freddie Mac 1302.8 in plain English, see the full list of changes in Bulletin 26-01, or start with our free AI acceptable use policy template.

Get Section 4 ready before January 18, 2027

The $349 AI Policy Kit includes a full AI/ML governance policy with risk tiers, an AI use inventory with a disclosure summary, a vendor questionnaire, an incident response one-pager and a Freddie and Fannie crosswalk, plus 3 months of Small Shop portal access for staff sign-off tracking. The $99 AI Policy Starter covers the written policy and acknowledgment.

Get the AI Policy Kit, $349 AI Policy Starter, $99 AI Team Kit, $699 Compare kits

Frequently asked questions

When do the Fannie Mae Section 4 AI requirements take effect?

Bulletin 26-01 lists an Effective Date of January 18, 2027, and Fannie Mae says companies must complete full implementation by January 18, 2027.

What does Super Intelligence mean in the Fannie Mae Supplement?

It is the term Fannie Mae now uses in place of Artificial Intelligence. Bulletin 26-01 says the change is not intended to alter the scope, meaning or applicability of the requirements.

Does LL-2026-04 still apply?

Fannie Mae marks Lender Letter LL-2026-04 as superseded by the Information Security and Business Resiliency Supplement published on October 21, 2026.

What is new in Section 4 compared with LL-2026-04?

Section 4 adds a use case inventory, data governance, model testing and validation, monitoring and retirement, change management, a security risk assessment, documented safeguards, segregation of duties and Confidential Information controls.

Does Section 4 cover vendors?

Yes. A Company must govern third party use of SI in a way that is no less protective, and Section 3.14 makes it responsible for third party failures to comply with the Supplement.