Mortgage AI governance stopped being a best practice in 2026 and became a condition of doing business. Freddie Mac’s AI requirements took effect March 3, Fannie Mae’s took effect August 6, and on September 16 the Conference of State Bank Supervisors gave state examiners a structured framework for asking how you use AI. Two weeks later, a joint survey from state mortgage regulators and the Mortgage Bankers Association showed where the industry is weakest: most lenders have an AI policy, but far fewer actually monitor their AI tools once they go live.
If your institution uses AI anywhere in origination, servicing, or quality control, including inside a vendor’s platform, you now answer to three layers of oversight. Here is what each one requires and how to close the gaps before someone asks.
Layer One: The GSE Requirements Are Already in Force
Freddie Mac Guide Section 1302.8
Freddie Mac moved first. Section 1302.8 of the Seller/Servicer Guide, added through Bulletin 2025-16 and effective March 3, 2026, requires Seller/Servicers that use AI or machine learning to maintain documented governance, establish executive accountability, implement risk management practices, and provide information about their AI safeguards when Freddie Mac requests it.
Fannie Mae Lender Letter LL-2026-04
Fannie Mae published Lender Letter LL-2026-04, Governance framework on use of artificial intelligence and machine learning, on April 8, 2026, with an effective date of August 6, 2026. If you use AI/ML in connection with loans sold to or guaranteed by Fannie Mae, or loans you service for Fannie Mae, you must:
- Maintain written policies and procedures covering the AI/ML life cycle that reflect an understanding of applicable legal and regulatory requirements and sound risk management.
- Comply with the Fannie Mae Information Security and Business Resiliency Supplement.
- Manage the risks of subcontractor and vendor AI/ML use with governance that is no less protective than your own requirements.
- Promptly disclose, on request, the types of AI/ML you use, the purpose and manner of use, the safeguards you have implemented, and anything else Fannie Mae requires.
Two points deserve emphasis. First, neither GSE requires you to adopt AI. The requirements apply only if you use it. Second, “use” is broader than most lenders assume. An automated document classification engine, an income calculation tool, a chatbot answering borrower questions, a servicing call-summary tool, or a QC platform that flags defects with machine learning all count. If you are approved by both GSEs, you must satisfy both sets of requirements, and they are not identical (verify current text of each).
The enforcement mechanism is familiar: a loan that does not meet Guide requirements is a repurchase risk.
Layer Two: State Examiners Now Have an AI Playbook
On September 16, 2026, CSBS released its Artificial Intelligence Supervisory Framework for state financial examiners. It has four parts:
- Core Examiner Guide: scoping questions, a document request list, and procedures covering AI governance and oversight, AI inventories and use cases, and generative AI and other emerging uses.
- Examiner Work Program: detailed guidance for applying the core guide.
- Nonbank AI Supplements: focused on third-party and vendor risk, model risk, and consumer protection.
- AI Use Case Risk Tiering Worksheet: an optional tool for assessing individual AI applications and deciding whether deeper review is warranted.
CSBS describes the framework as a discretionary supervisory tool, not a new set of legal requirements, and each state agency will decide how much of it to adopt. Do not read that as permission to wait. State mortgage regulators, through the American Association of Residential Mortgage Regulators (AARMR), are evaluating it for the nonbank mortgage industry, and multistate exam tools tend to spread quickly once adopted. The document request list is effectively a preview of what you will be asked to produce.
There is also a federal gap the framework fills. The banking agencies’ 2026 revisions to model risk management guidance expressly exclude generative and agentic AI, so for many institutions the CSBS framework is the most specific supervisory roadmap available.
Layer Three: The Industry’s Own Report Card
On September 28, 2026, AARMR, the MBA, and Boston Consulting Group released The State of AI Among Mortgage Lenders and Servicers. The respondents were roughly 30 lenders and servicers representing about 40% of the market. Key findings:
- 87% have written AI policies or standards, but only 58% reported ongoing monitoring for issues such as accuracy and model drift.
- Among smaller lenders, only about 40% reported ongoing monitoring, compared with about 80% of larger lenders.
- 59% named regulatory and compliance uncertainty as their biggest barrier to scaling AI, ahead of unclear return on investment (45%) and data quality (24%).
- Only about a quarter had scaled at least one AI use case, and adoption is concentrated in productivity and document-processing work.
Read those numbers as an examiner would. The weakest point in mortgage AI governance is not the policy. It is what happens after deployment. Examiners and GSE reviewers will ask to see evidence of monitoring, not just a policy that promises it.
Building a Mortgage AI Governance Program That Holds Up
You do not need a large data science team to meet these expectations. You need a disciplined program with six components.
1. An AI inventory you can produce on demand
List every AI or machine-learning use case, internal or vendor-supplied. For each one, capture the business function, the owner, the vendor (if any), what data it consumes, whether it touches nonpublic personal information, what decision or output it influences, and whether a human reviews the output before it affects a borrower. Both GSEs and the CSBS framework start here. If you cannot produce the list in a day, that is your first finding.
2. Risk tiering
Not every use case deserves the same scrutiny. A tool that summarizes internal policy documents is low risk. A tool that calculates qualifying income, influences pricing, decides which files get escalated, or drafts adverse action language is high risk because it can affect credit decisions, fair lending outcomes, or required disclosures. The CSBS risk tiering worksheet is a reasonable starting template. Document the tier and the reasoning.
3. Accountability at the executive level
Name an accountable executive and a governance forum that approves new use cases, reviews tier assignments, and receives monitoring results. Record it in board or committee minutes. “IT handles it” will not satisfy Freddie Mac’s executive accountability expectation.
4. Vendor oversight that is “no less protective”
This is where most lenders are exposed, because most mortgage AI arrives inside vendor products. Update vendor due diligence questionnaires to ask whether the product uses AI/ML, for what, how it is tested and monitored, what data trains it, where that data is processed, and how errors are reported. Add contract language requiring notice before material model changes and cooperation with GSE or regulator information requests. Fannie Mae’s “no less protective” standard means a vendor’s AI is your AI for governance purposes.
5. Post-deployment monitoring
This is the gap the survey exposed. For each high-tier use case, define what accuracy means, how often you test it, and what threshold triggers escalation. For document extraction and income calculation tools, the cleanest control is QC sampling: compare AI outputs to human-verified results on a defined sample each month and trend the error rate. Your existing QC function is already built for this kind of testing. Use it.
6. Records
Keep the inventory, tiering decisions, approvals, vendor assessments, monitoring results, and incident logs in one place. Both GSEs can request this information, and CSBS’s document request list assumes it exists.
The Fair Lending and Disclosure Overlay
AI governance is not a separate silo. Any tool that influences underwriting, pricing, or adverse action still has to work within ECOA and Regulation B, including the requirement to give specific principal reasons for adverse action. If a model contributes to a denial, you must still be able to explain the reasons in terms the borrower can understand. State laws are moving too. Colorado’s Department of Law published draft automated decision-making technology rules on August 11, 2026, with a public hearing scheduled for October 26 (verify current status). Build your program so it can absorb state requirements without a rebuild.
Where to Start This Quarter
If you are behind, sequence the work: inventory first, tiering second, vendor questionnaires third, monitoring for your top three high-tier use cases fourth. That order gives you something defensible to show within 60 days. Our compliance services team can help you build the inventory and design QC-based monitoring that fits your existing review cycle.
Frequently Asked Questions
Do the GSE AI requirements apply if we only use AI through vendors?
Yes. Fannie Mae requires you to manage vendor and subcontractor AI/ML risk with governance no less protective than its requirements, and Freddie Mac’s Section 1302.8 applies to your use of AI or machine learning regardless of who built it. If a vendor’s tool touches loans you sell to or service for the GSEs, it belongs in your inventory and your oversight program.
Is the CSBS AI Supervisory Framework binding?
No. CSBS calls it a discretionary supervisory tool, and each state decides how to incorporate it. In practice, it tells you what state examiners are likely to ask for, so treat its document request list as an exam-readiness checklist.
What is the most common gap in mortgage AI governance?
Ongoing monitoring. The September 2026 AARMR, MBA, and BCG survey found 87% of respondents had written AI policies but only 58% monitored tools after deployment, with smaller lenders at roughly 40%. A policy without monitoring evidence will not hold up in a GSE review or state exam.
Does using AI change our adverse action obligations?
No. ECOA and Regulation B still require specific principal reasons for adverse action. If an AI tool contributes to a credit decision, you need to be able to identify and explain those reasons accurately, which is one reason high-impact tools belong in your highest risk tier.
Need help building an AI inventory or designing monitoring that satisfies Fannie Mae, Freddie Mac, and state examiners? Synergy works with mortgage QC and compliance teams nationwide. Book a 30-minute call to map out your program.
