Fannie Mae and Freddie Mac AI Governance
Understand the GSE AI Rules. Prove How Your AI Is Controlled.
Fannie Mae and Freddie Mac now expect covered mortgage organizations to govern artificial intelligence and machine learning through documented policies, risk controls, oversight, and evidence. Fannie Mae's updated security supplement now folds AI governance - under the name Super Intelligence - into its information-security program requirements, with full implementation expected by January 18, 2027.
Can you prove what your AI was authorized to do—or what it did?
A policy establishes intent. Execution evidence shows whether a system stayed within approved purpose, data access, tools, actions, and human-approval boundaries.
Direct Answer
What are the GSE AI governance requirements for mortgage lenders and servicers?
Fannie Mae and Freddie Mac require covered sellers and servicers to govern AI and machine-learning use through documented policies, legal and regulatory compliance, risk management, oversight, review, and disclosure when requested. Freddie Mac sets its expectations in Guide Section 1302.8. Fannie Mae sets its expectations in Lender Letter LL-2026-04 and, effective January 18, 2027, in the Information Security and Business Resiliency Supplement, which adds Super Intelligence governance requirements. The documents differ, so organizations should evaluate each applicable source separately.
Choose the guidance that applies
Fannie Mae Security Supplement
The updated Information Security and Business Resiliency Supplement adds Super Intelligence governance for lenders, document custodians, and integrators, vendor AI flow-down, and a 36-hour incident-notice standard.
Review the SupplementFannie Mae LL-2026-04
Review the Single-Family AI and machine-learning governance expectations for covered Fannie Mae sellers and servicers.
Review Fannie MaeFreddie Mac Section 1302.8
Review Freddie Mac's AI and machine-learning governance, monitoring, audit, accountability, and disclosure requirements.
Review Freddie MacFannie Mae vs. Freddie Mac
See the shared control foundation and the enterprise-specific differences that should remain traceable.
Compare RequirementsCrittora's execution-control layer
From policy to provable execution control
Make authority explicit
Connect an approved use case to the actor, purpose, operation, target system, permitted scope, and applicable time window.
Enforce before commit
Evaluate whether a requested AI-enabled action is within approved authority before it can make a sensitive change.
Produce reviewable evidence
Retain a decision record that helps security, risk, compliance, and technology teams understand why an action was allowed or denied.
Governance must reach the moment of action
An AI inventory identifies where AI is used.
A policy defines the intended guardrails.
A vendor questionnaire records a supplier's representation.
A sensitive action still needs a decision about the actor, operation, target system, purpose, scope, and time window.
Scoped authority should be evaluated before an AI-enabled system calls a sensitive tool, API, or system of record.
Reviewable evidence should explain both allowed and denied actions.
“[A]t a minimum a baseline inventory of its own AI use cases.”
— MISMO President Brian Vieaux, speaking with Scotsman Guide
MISMO Winter Summit 2027
Let's Meet at MISMO!
Winter Summit 2027: January 11–15, 2027 in New Orleans, LA
Bring the AI-governance questions your team is facing. We can discuss how documented policy connects to authority, safeguards, and evidence when AI-enabled mortgage systems act.
Schedule a MISMO ConversationAI Governance Questions
Questions Mortgage Leaders Ask About GSE AI Governance
Each answer stands alone and identifies the enterprise or source it addresses.
No. Fannie Mae LL-2026-04 and Freddie Mac Guide Section 1302.8 share themes such as documented governance, risk management, review, and disclosure, but their dates and detailed provisions differ. Freddie Mac is more explicit in several monitoring, audit, accountability, and threat-management areas.
#are-fannie-and-freddie-ai-rules-the-sameAn organization working with both enterprises should assess both Fannie Mae LL-2026-04 and Freddie Mac Guide Section 1302.8. A shared enterprise control program can support both, but its control map should preserve each GSE's distinct language and obligations.
#gse-ai-rules-for-both-enterprisesYes. Both Fannie Mae LL-2026-04 and Freddie Mac Guide Section 1302.8 expressly address artificial intelligence and machine learning, so the scope is not limited to generative AI or public chatbot tools.
#gse-rules-cover-machine-learningYes, within the scope of each enterprise's document. Both Fannie Mae and Freddie Mac address covered AI or machine-learning use in mortgage origination and servicing activities connected to their businesses.
#gse-rules-origination-and-servicingA mortgage lender should consider maintaining an AI use-case inventory, accountable owners, documented purpose and manner of use, risk assessments, legal and compliance reviews, vendor records, safeguards, approvals, monitoring results, incidents, and evidence of allowed or denied actions. Exact records should be mapped to the applicable GSE and other legal obligations.
#mortgage-ai-documentationThe official sources should be read carefully before calling a named inventory an express universal requirement. Operationally, a current inventory is a practical foundation for identifying AI use, managing risk, overseeing vendors, and responding accurately when a GSE requests information about AI types, purpose, use, or safeguards.
#gse-ai-inventoryPrimary sources
Use the current official documents when assessing applicability, contractual duties, and implementation decisions.
- Fannie Mae Information Security and Business Resiliency Supplement (effective January 18, 2027)
- Fannie Mae Lender Letter LL-2026-04
- Freddie Mac Guide Section 1302.8
- MISMO FRAME announcement
Crittora provides technology controls and operational information. It does not provide legal advice, certify compliance, or guarantee satisfaction of Fannie Mae, Freddie Mac, MISMO, or other requirements. No endorsement by Fannie Mae, Freddie Mac, or MISMO is implied.
Free Consultation
Schedule a Free AI Readiness Call
Talk with Crittora about your AI-governance priorities, the questions your team is facing, and a practical next step. No lengthy preparation is required.