How to Answer a Wholesale Lender's AI Questionnaire

Last reviewed: November 3, 2026. General information, not legal advice. Each lender writes its own form, so the wording you see will differ. This page covers the topics these forms commonly ask about and ties each one to the Freddie Mac and Fannie Mae text it traces back to. Confirm your obligations with counsel.

Why your lender is asking about AI

Freddie Mac Guide Section 1302.8, shown as Effective 03/03/2026, requires Seller/Servicers that use AI/ML in connection with origination or Servicing of Freddie Mac loans to have approved written policies, a governance framework and disclosure on request. Fannie Mae's Information Security and Business Resiliency Supplement, Section 4, sets Super Intelligence (SI) governance duties, and Bulletin 26-01 lists an Effective Date of January 18, 2027. Fannie Mae says the term SI replaces Artificial Intelligence and is not intended to change the scope of the requirements.

Both rules are written for the companies that sell to and service for Fannie Mae and Freddie Mac. Independent brokers are not named. But Freddie Mac's FAQ says a Seller/Servicer's third-party risk management program must address "the risk posed if the service provider uses artificial intelligence (AI)/machine learning (ML)", and Fannie Mae's Supplement says a Company "shall cause its third parties involved with Company's activities under the applicable Underlying Agreements to comply with the Supplement". That is why AI questions now show up in broker onboarding packets, annual recertification forms and due diligence requests.

"Upon Fannie Mae's request, promptly disclose to Fannie Mae the following: the types of Super Intelligence used; the purpose and manner for such SI Use; the safeguards the Company has implemented to mitigate risks related to the use of Super Intelligence; and such other information as Fannie Mae may require."Fannie Mae Supplement, Section 4

In plain English: Lenders may have to describe their AI use on request, and broker AI use can be part of that picture. A lender questionnaire is often how they collect it.

The short version

Answer every question with a short, factual sentence and a document you can send the same day. Keep answers in your own words, describe what you actually do today, and never claim more than your documents show. If something is not in place yet, say so and give a date.

Common questions and the document that answers each
Question	Document to keep on file	Included in
Do you have a written AI policy?	AI acceptable use policy; full AI and ML governance policy	Policy: AI Policy Starter. Governance policy: AI Policy Kit
Who owns the policy?	Owner named in the policy; AI governance annual calendar	AI Policy Kit
Who approved it?	Senior management approval memo	AI Policy Kit
Which AI tools touch borrower data?	Approved AI tools list; AI use inventory with a disclosure summary	Tools list: AI Policy Starter. Inventory: AI Policy Kit
How do you vet AI vendors?	Vendor AI due diligence questionnaire; AI vendor call checklist	AI Policy Kit
Are staff trained, and did they sign off?	Staff acknowledgment form; training facilitator guide; training sign-off log	Acknowledgment: AI Policy Starter. Training guide and log: AI Team Kit
How do you handle an AI incident?	AI incident response one-pager with an incident log	AI Policy Kit

1. Do you have a written AI policy?

Why lenders ask: Freddie Mac 1302.8(a) requires written policies and procedures for AI/ML, and Fannie Mae Section 4 requires a "Documented and implemented formal SI governance program".

Model answer: "Yes. We have a written AI policy, version 1.0, adopted on [date]. It lists the AI tools staff may use, what data may go into them, and the human review required before AI output is used with a borrower or a loan file. A copy is attached."

Back it up with: An AI acceptable use policy (in the AI Policy Starter) for a small shop, or the full AI and Machine Learning Governance Policy with risk tiers (in the AI Policy Kit) if your lender asks for a governance framework. Our free AI policy template is a starting point.

2. Who owns your AI policy, and how often is it reviewed?

Why lenders ask: Freddie Mac 1302.8(a) says the policies must "Have an owner(s) that implements, maintains and reviews the policies and procedures at least annually". Fannie Mae Section 4 says "A designated owner is responsible for implementing, maintaining and reviewing" them at least annually.

Model answer: "[Name, title] owns our AI policy. The owner reviews it at least once a year and after any material change in our AI tools. The last review was [date] and the next is scheduled for [date]."

Back it up with: The owner section of your policy plus the AI Governance Annual Calendar (in the AI Policy Kit), which puts the annual review, inventory refresh and training dates on one page.

3. Who approved the policy?

Why lenders ask: Freddie Mac 1302.8(a) says the policies must "Be approved by Senior Management, including, at a minimum, the Chief Information Officer, Chief Technology Officer, Chief Information Security Office or Chief Risk Officer (or the equivalents thereof)". In a small brokerage, the equivalent is often the owner or managing principal.

Model answer: "Our policy was approved on [date] by [name], [title], who serves as our senior management approver for technology and risk. The signed approval memo is attached."

Back it up with: A signed Senior Management Approval Memo (in the AI Policy Kit). Record the approver, date and version so the memo matches the policy you send.

4. Which AI tools do you use, and which ones touch borrower data?

Why lenders ask: Fannie Mae Section 4 requires "an inventory of SI use cases", and both Fannie Mae and Freddie Mac can ask for the types of AI used, the purpose and manner of use, and safeguards. Freddie Mac FAQs say simple automation that does not analyze data or make a decision is not AI/ML for Section 1302.8(a).

Model answer: "We keep an AI use inventory. Staff may use only the tools on our approved list. Nonpublic personal information (NPI) may be entered only into AI tools the company has approved for that data, under company accounts, never personal or free accounts. A one-page summary of our AI use, its purpose and our safeguards is attached."

Back it up with: The Approved AI Tools List (in the AI Policy Starter) and the AI Use Inventory Worksheet with its AI Use Summary for disclosure requests (in the AI Policy Kit). List AI features inside your loan origination system, CRM, borrower portal and marketing tools, not just chat assistants.

5. How do you vet AI vendors?

Why lenders ask: Freddie Mac's FAQ says vendor AI/ML must be covered by the third-party risk management program. Fannie Mae Section 4 requires governance of third party SI use "that is no less protective of these requirements".

Model answer: "Before a tool is approved, we send the vendor our AI due diligence questionnaire covering data use, model training on our data, retention, security controls and incident notice. We keep the answers on file and re-review vendors each year or when the product changes."

Back it up with: The Vendor AI Due Diligence Questionnaire and AI Vendor Call Checklist (both in the AI Policy Kit). Our AI vendor due diligence guide lists the core questions for free.

6. Are staff trained on AI, and have they signed off on the policy?

Why lenders ask: Freddie Mac 1302.8(a) says the policies must "Be communicated to appropriate personnel who have job responsibility in areas that use AI/ML". Freddie Mac 1302.2 says "When necessary, the organization personnel and partners must receive AI risk management training". Fannie Mae Section 4 calls for "Controls and training to properly identify, classify and protect Confidential Information if using SI."

Model answer: "Every staff member who uses AI has read and signed our AI policy. We train new hires before they get tool access and run a refresher each year. Signed acknowledgments and training records are kept on file and can be provided on request."

Back it up with: Signed AI Policy Staff Acknowledgment forms (in the AI Policy Starter), plus the Staff AI Training Facilitator Guide and AI Training Sign-Off Log (in the AI Team Kit). The Free portal plan tracks sign-offs for up to 10 staff; the AI Policy Kit and AI Team Kit include Small Shop portal access with sign-off tracking.

7. How do you report and handle an AI incident?

Why lenders ask: Freddie Mac 1302.2 requires "playbooks for Incidents related to AI/ML". Fannie Mae's Supplement Section 5 requires initial notice of a Cybersecurity Incident within 36 hours, and lenders usually set their own notice terms in the broker agreement.

Model answer: "Staff report any AI problem, such as borrower data entered into an unapproved tool or wrong AI output sent to a borrower, to [owner] the same day. We follow a written AI incident playbook, log each incident, and notify affected lenders as our agreements require."

Back it up with: The AI Incident Response One-Pager with its incident log (in the AI Policy Kit). Check your broker agreement for the exact notice window your lender requires.

Tips for filling out the form

Answer for what you do today. If a control is planned, say "in progress, target date [date]" rather than "yes".
Use the same policy version and dates on every lender's form.
Attach summaries, not your whole file, unless the lender asks for full documents.
Do not copy wording from one lender's form into a public post or another lender's file. Each form is that lender's document.
Use "aligned to Freddie Mac 1302.8 and Fannie Mae Section 4" when describing your program. Do not claim a lender, Fannie Mae or Freddie Mac has approved it.
Calendar your next review so you can answer recertification questions with current dates.

For the full rule text in plain English, see Fannie Mae 26-01 and Freddie Mac 1302.8, explained, Freddie Mac 1302.8, Fannie Mae Section 4 and the rest of the AI Rules Library.

Start with the free template

Our free mortgage AI acceptable use policy template gives you a written policy to answer question 1 today. Check the rest of your gaps with the AI policy checklist.

Get the free template

Have every answer on file before your next recertification

The $349 AI Policy Kit includes the governance policy, senior management approval memo, AI use inventory with a disclosure summary, vendor questionnaire, incident response one-pager and a Freddie Mac 1302.8 and Fannie Mae Section 4 crosswalk, plus 3 months of Small Shop portal access for staff sign-off tracking. The $99 AI Policy Starter covers the written policy, approved tools list and staff acknowledgment. The $699 AI Team Kit adds the staff training guide and sign-off log. Every kit is priced under $1,000.

Get the AI Policy Kit, $349 AI Policy Starter, $99 AI Team Kit, $699 Compare kits

Frequently asked questions

Why are wholesale lenders asking brokers about AI?

Freddie Mac Guide Section 1302.8 and Fannie Mae Supplement Section 4 require the companies that sell to and service for the GSEs to govern AI use, including AI used by their third parties. Lenders often collect broker AI information through onboarding and recertification forms.

Do Freddie Mac 1302.8 and Fannie Mae Section 4 apply directly to mortgage brokers?

They are written for Freddie Mac Seller/Servicers and Fannie Mae counterparties. Independent brokers are not named, but lenders may pass expectations on through broker agreements and due diligence requests.

What should I send if a lender asks for proof?

Send a current copy or summary of your written AI policy, the signed approval memo, a one-page AI use summary, and staff acknowledgment records. Keep dates and version numbers consistent across lenders.

Can staff put borrower data into AI tools?

Only into AI tools the company has approved for that data, under company accounts. Personal or free accounts should never receive nonpublic personal information.

When does Fannie Mae Section 4 take effect?

Bulletin 26-01 lists an Effective Date of January 18, 2027. Freddie Mac Guide Section 1302.8 is shown as Effective 03/03/2026.

Is this legal advice?

No. This page is general information. Each lender sets its own form and terms, so confirm your obligations with qualified legal and compliance professionals.

How to answer a wholesale lender's AI questionnaire