FTC Safeguards Rule for Mortgage Brokers Using AI

Last reviewed: October 28, 2026. General information, not legal advice. Short quotes come from eCFR; each is followed by a plain-English line, with a note on what it means for AI tools.

What the rule requires

"Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program"16 CFR 314.4(a)

In plain English: Name one person who owns security. For AI tools, this is usually your AI controls owner in IT.

"The risk assessment shall be written"16 CFR 314.4(b)(1)

In plain English: Write down your risks. Add each AI tool, what data it sees and what could go wrong.

"Limit authorized users' access only to customer information that they need to perform their duties and functions"16 CFR 314.4(c)(1)(ii)

In plain English: Give people, and their AI connectors, only the access they need. A connector that can read a whole mailbox needs a strong reason.

"Implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls"16 CFR 314.4(c)(5)

In plain English: Turn on MFA for AI accounts too.

"Implement policies, procedures, and controls designed to monitor and log the activity of authorized users"16 CFR 314.4(c)(8)

In plain English: Keep and review activity logs. This is one reason audit log features matter when you choose an AI plan.

"Periodically review your data retention policy to minimize the unnecessary retention of data"16 CFR 314.4(c)(6)(ii)

In plain English: Set AI chat, file and connector retention on purpose, and recheck it.

The rule also requires regular testing or monitoring, including annual penetration testing and vulnerability assessments at least every six months unless you have effective continuous monitoring (314.4(d)(2)), and security awareness training for staff (314.4(e)).

"Requiring your service providers by contract to implement and maintain such safeguards"16 CFR 314.4(f)(2)

In plain English: Your AI vendors are service providers. Have a contract, usually a DPA, that requires them to protect the data, and check on them periodically.

"Establish a written incident response plan"16 CFR 314.4(h)

In plain English: Write an incident plan, and include AI incidents such as a connector exposing borrower email.

"Require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body"16 CFR 314.4(i)

In plain English: Your security owner reports to leadership at least once a year. The BrokerLumen leadership briefing deck can support that report.

The 30-day FTC notice

"if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event"16 CFR 314.4(j)(1)

In plain English: If unencrypted customer information on 500 or more people is acquired without authorization, tell the FTC within 30 days of discovery, using the form on its website.

That clock runs alongside others. Fannie Mae Bulletin 26-01 plans for a first notice to Fannie Mae within 36 hours of a cybersecurity incident. See our 26-01 page.

Small company relief

"Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."16 CFR 314.6

In plain English: If you hold data on fewer than 5,000 consumers, the written risk assessment, the specific testing schedule, the written incident plan and the annual board report are not required by this rule. The other elements, including MFA, access limits, vendor contracts and the FTC notice, still apply, and Fannie Mae and Freddie Mac may expect more.

A Safeguards Rule checklist for AI tools

Name your Qualified Individual and make AI tools part of their remit.
Add AI tools to the written risk assessment.
Enforce MFA, and SSO where the plan allows, on every AI account.
Keep connectors off by default; allow them only with a signed DPA on an Enterprise plan, or a documented exception.
Set retention and review logs on a schedule.
File a signed DPA and current SOC 2 report for each AI vendor.
Add an AI playbook to the incident plan with the 30-day FTC and 36-hour Fannie Mae clocks.
Report to leadership at least annually.

Turn the rule into a working program

The $349 AI Policy Kit includes an incident response one-pager, a vendor questionnaire and an AI use inventory, plus 3 months of Small Shop portal access with the AI controls area.

Get the AI Policy Kit, $349 AI Policy Starter, $99 AI Team Kit, $699 Compare kits

Frequently asked questions

Does the FTC Safeguards Rule apply to mortgage brokers?

Yes. The rule’s definitions say a mortgage broker is a financial institution, and mortgage brokers are listed among the entities under FTC jurisdiction.

When must we notify the FTC?

As soon as possible and no later than 30 days after discovering a notification event involving the information of at least 500 consumers. The requirement took effect May 13, 2024.

Do AI vendors count as service providers?

When they receive customer information to provide a service to you, yes. The rule requires service providers to implement and maintain safeguards by contract, and you must assess them periodically.

Is there an exception for small companies?

Yes, partly. Under 16 CFR 314.6, four elements do not apply if you hold customer information on fewer than 5,000 consumers. The rest still apply.