Freddie Mac 1302.8: AI/ML Requirements Explained

Last reviewed: October 28, 2026. General information, not legal advice. Short quotes below come from the Freddie Mac Single-Family Seller/Servicer Guide; each is followed by a plain-English line. Read the full section and confirm your obligations with counsel.

Who Section 1302.8 applies to

"Seller/Servicers that use artificial intelligence and/or machine learning (together, “AI/ML”) in connection with the origination of Mortgages sold to or guaranteed by Freddie Mac or Servicing Mortgages on behalf of Freddie Mac must ensure compliance with Applicable Law and their Purchase Documents."Section 1302.8(a)

In plain English: If your company is a Freddie Mac Seller/Servicer and uses AI on Freddie Mac loans, that use has to follow the law and your Freddie Mac contract.

Mortgage brokers that are not Freddie Mac Seller/Servicers are not named in the section. In practice, the wholesale lenders you sell through are Seller/Servicers, and they may ask you about your AI use in onboarding, recertification or due diligence. Having the same documents ready makes those requests easy to answer.

What counts as AI/ML

"A system that automates a manual process without analyzing data or making a decision is not AI/ML for the purposes of Section 1302.8(a)."Freddie Mac FAQ, May 21, 2026

In plain English: Simple automation, such as a rule that moves a file to the next queue, is not covered. Tools that analyze data or make or suggest decisions are.

The same FAQ says that, at a minimum, Seller/Servicers are expected to identify AI/ML that uses Freddie Mac confidential information or Protected Information, or that connects to a Freddie Mac System, in origination or servicing. It also says Seller/Servicers "may document their reasons for excluding specific tools or applications". Writing those reasons down is a cheap way to show you thought about scope.

Section 1302.8(a): written policies and procedures

Use of AI/ML is "conditioned upon" policies and procedures that, at a minimum, meet three tests.

"Be approved by Senior Management, including, at a minimum, the Chief Information Officer, Chief Technology Officer, Chief Information Security Office or Chief Risk Officer (or the equivalents thereof)"Section 1302.8(a)

In plain English: A senior leader signs off on the AI policy. The words 'or the equivalents thereof' matter for small companies: record which person fills that role, and the date they approved.

"Be communicated to appropriate personnel who have job responsibility in areas that use AI/ML"Section 1302.8(a)

In plain English: Staff who use AI must actually receive the policy. A dated acknowledgment from each person is the simplest proof.

"Have an owner(s) that implements, maintains and reviews the policies and procedures at least annually"Section 1302.8(a)

In plain English: Name one owner and put a yearly review date on the calendar.

"prompt disclosure of the types of AI/ML used, the purpose and manner for such use, safeguards to mitigate risks related to the use of AI/ML, and such other information as Freddie Mac may require."Section 1302.8(a), upon request by Freddie Mac

In plain English: If Freddie Mac asks, you must quickly explain which AI you use, why and how, and what safeguards you have. A one-page AI use summary kept current makes this a same-day task.

A Freddie Mac FAQ adds that this reporting applies when the AI use relates to Freddie Mac loans and Freddie Mac requests the information.

Section 1302.8(b): indemnification

"arising directly or indirectly out of or relating to its use of AI/ML."Section 1302.8(b)

In plain English: The Seller/Servicer agrees to cover Freddie Mac's losses and costs connected to the Seller/Servicer's own AI use. That makes careful AI controls a financial issue, not only a policy one.

Section 1302.8(c): the governance framework

The section asks for "clear governance frameworks for AI/ML adoption". The framework items include documented legal requirements, trustworthy AI characteristics, and risk management sized to your risk tolerance. It then lists specific duties.

"Assess AI/ML for specific threats such as data poisoning and adversarial inputs"Section 1302.8(c)

In plain English: Before and while you use an AI tool, consider how it could be fed bad data or tricked, and write down what you found.

"Regularly monitor AI systems for performance, security breaches and biases"Section 1302.8(c)

In plain English: Check AI output on a schedule for accuracy, security problems and unfair results, and keep a short record of each check.

"Conduct audits to ensure compliance with standards like National Institutes of Standards and Technology 800-53 and International Organization for Standardization 27001"Section 1302.8(c)

In plain English: Your audit approach should be measured against a recognized security standard. Section 1302.8 names NIST 800-53 and ISO 27001 as examples.

"Apply segregation of duties to prevent conflicts of interest"Section 1302.8(c)

In plain English: The person who approves an AI tool should not be the only person checking it. Write down who does what.

The framework also calls for "regular internal and external audits" and for roles and lines of communication on AI risk to be "documented and are clear to individuals and teams throughout the organization".

Vendors and related Guide sections

A Freddie Mac FAQ states that Seller/Servicers "must have a third-party risk management program" that addresses the risk "if the service provider uses artificial intelligence (AI)/machine learning (ML)". See our AI vendor due diligence guide for the questions to send.

Guide Section 1302.2 also touches AI (see our Section 1302.2 page): annual security training "should incorporate ... artificial intelligence (AI)-powered tactics (e.g., deepfakes, targeted phishing content)" and threats to AI systems, and the incident response plan must include "playbooks for Incidents related to AI/ML".

AI tools, email connectors and vendor paperwork

In practice, Section 1302.8 turns into a few concrete decisions about tools like ChatGPT and Grok: which plan to buy (see the plan comparison), whether staff may connect AI to work email, what to ask in a vendor quote, and the six must-have controls to have in place. Borrower data in an AI tool also brings in GLBA and the FTC Safeguards Rule.

A 1302.8 checklist for brokers and lenders

List every AI tool in use, including AI built into your LOS, CRM and marketing tools.
Mark which tools touch borrower data or connect to investor systems, and document why any tool is out of scope.
Write an AI policy and have the senior leader (or equivalent) approve it, with name and date.
Collect a dated acknowledgment from each person who uses AI.
Name a policy owner and schedule an annual review.
Keep a one-page AI use summary: types, purpose and manner, safeguards.
Ask each vendor how its AI uses your data, and file the answers.
Assess each AI use for threats such as data poisoning and adversarial inputs.
Monitor output for accuracy, security problems and bias on a schedule.
Document roles so approval and checking are not done by the same person.

Compare this with the Fannie Mae rules in Fannie Mae Supplement Section 4, or read both side by side in our explainer.

Turn 1302.8 into signed documents

The $349 AI Policy Kit includes a full AI/ML governance policy, a senior management approval memo written for Section 1302.8, an AI use inventory with a disclosure summary, a vendor questionnaire and a Freddie and Fannie crosswalk, plus 3 months of Small Shop portal access for sign-off tracking. Starting smaller? The $99 AI Policy Starter covers the written policy and staff acknowledgment.

Get the AI Policy Kit, $349 AI Policy Starter, $99 AI Team Kit, $699 Compare kits

Frequently asked questions

When did Freddie Mac Section 1302.8 take effect?

The Guide shows Section 1302.8 as effective March 3, 2026. It was announced in Bulletin 2025-16 (Selling, December 3, 2025) and Bulletin 2025-17 (Servicing, December 10, 2025).

Does Section 1302.8 apply to mortgage brokers?

The section applies to Freddie Mac Seller/Servicers that use AI/ML on Freddie Mac loans. Brokers are not named, but wholesale lenders that are Seller/Servicers may ask brokers about their AI use through their own agreements and due diligence.

Who has to approve the AI policy under 1302.8?

Senior Management, including at a minimum the CIO, CTO, Chief Information Security Office or Chief Risk Officer, or the equivalents. In a small company, record who fills that role and when they approved.

Is every automation tool AI/ML under 1302.8?

No. A Freddie Mac FAQ says a system that automates a manual process without analyzing data or making a decision is not AI/ML for Section 1302.8(a).

What must be disclosed to Freddie Mac?

On request, the types of AI/ML used, the purpose and manner of use, the safeguards in place and any other information Freddie Mac requires.