BrokerLumen logo, AI governance for mortgage brokersBrokerLumen logo, AI governance for mortgage brokers

Home / Rules Library / Freddie Mac 1302.2

Mortgage AI Rules Library

Freddie Mac 1302.2: the AI parts of the information security rules

Last reviewed: October 28, 2026. General information, not legal advice. Section 1302.2 is Freddie Mac's information security section. Most of it is not about AI. This page covers only the parts that name AI. Short quotes come from the Freddie Mac Single-Family Seller/Servicer Guide; each is followed by a plain-English line.

Section 1302.2(b)(ii): security awareness training

"At least annually, Seller/Servicers must provide information security awareness training to all employees and contractors who have access to Freddie Mac confidential information, Protected Information and/or Systems."Section 1302.2(b)(ii)

In plain English: Everyone who can see Freddie Mac loan data gets security training at least once a year.

"artificial intelligence (AI)-powered tactics (e.g., deepfakes, targeted phishing content) and threats to AI systems (e.g., model inversion, data poisoning, prompt injection)"Section 1302.2(b)(ii), topics the training should incorporate

In plain English: Your yearly training should cover AI-made scams, such as deepfake calls and convincing phishing emails, and attacks on AI tools themselves.

"When necessary, the organization personnel and partners must receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures and agreements."Section 1302.2(b)(ii)

In plain English: Staff and partners who use or manage AI need training on its risks, matched to their role and your AI policy.

Section 1302.2(b)(xvi): incident management

"Have documented action plans for remediation of Incidents, including playbooks for Incidents related to AI/ML (as defined in Section 1302.8)"Section 1302.2(b)(xvi)

In plain English: Your incident response plan needs a written playbook for AI problems, such as an AI tool leaking borrower data.

The same incident management list says the plan must be approved by Senior Management and tested annually unless it is formally activated.

A 1302.2 AI checklist for brokers and lenders

  1. Add deepfakes, AI phishing and attacks on AI tools to your annual security training.
  2. Record who took the training and when.
  3. Give AI risk training to the people who use or manage AI tools, matched to your AI policy.
  4. Write an AI incident playbook: who to call, how to cut tool access, how to assess borrower data exposure.
  5. Add the AI playbook to your incident response plan and to its annual test.
  6. If you are a broker, expect wholesale lenders to ask for proof of training.

Track who finished training and signed the policy

The $99 AI Policy Starter gives you an editable AI acceptable use policy, a readiness checklist and a staff acknowledgment form, and the Free portal plan tracks sign-offs for up to 10 staff. The $349 AI Policy Kit adds an incident response one-pager and annual calendar. Every BrokerLumen kit is priced under $1,000. The AI Policy Starter includes a staff acknowledgment form; the AI Policy Kit (3 months) and AI Team Kit (a full year) include Small Shop portal access with staff sign-off tracking built in.

Get the AI Policy Starter, $99AI Policy Kit, $349Compare kits

Frequently asked questions

Does Freddie Mac 1302.2 mention AI?

Yes. The training must incorporate AI-powered tactics such as deepfakes and targeted phishing content, and threats to AI systems such as model inversion, data poisoning and prompt injection. The incident plan must include playbooks for AI/ML Incidents.

How often is security training required under 1302.2?

At least annually, for all employees and contractors who have access to Freddie Mac confidential information, Protected Information and/or Systems.

When did the AI parts of Section 1302.2 take effect?

March 3, 2026. Freddie Mac Bulletins 2025-16 and 2025-17 announced the AI/ML governance framework effective March 3, 2026, with Guide impacts to Sections 1302.2 and 1302.8. The current version of the section is dated Effective 07/01/2026, and Freddie Mac also shows a version effective January 1, 2027 that keeps the same AI training and playbook language.

Where is AI/ML defined for Section 1302.2?

The playbook requirement points to Section 1302.8 for the definition of AI/ML.