The most-examined answer on your mortgage AI governance program is no longer a policy promise. It is the answer to “show me your AI inventory, your vendor AI questionnaires, your risk tiering, and your monitoring evidence.” Here are the ten questions compliance officers, QC managers, and risk leaders are asking as Q4 2026 begins, with direct answers and the action each one calls for. Several items were still moving as this edition went to press; where an answer is dependent on a pending development, we say so and flag it to verify.
Building the AI Inventory
- Where do we start with our AI inventory?
Start with the inventory. It is the foundation of every other AI governance control, and the thing both GSEs and the CSBS AI Supervisory Framework ask for first. The inventory should list every AI or machine-learning use case, internal or vendor-supplied, that touches the mortgage lifecycle. For each entry, capture the business function, the system owner, the vendor (if any), what data the system consumes, whether it touches nonpublic personal information, what decision or output it influences, and whether a human reviews the output before it affects a borrower. If you cannot produce this list in a day, that gap is your first finding. - What counts as “AI” for purposes of the GSE requirements?
Both Fannie Mae and Freddie Mac define AI broadly, and “use” is broader than most lenders assume. The categories that count include automated underwriting systems, automated valuation models, fraud detection models, document classification and data extraction tools, income and asset calculation engines, chatbots answering borrower questions, servicing call-summary tools, marketing optimization models, lead scoring, and any QC platform that flags defects with machine learning. Rule-based decision engines that do not learn from data and standard business intelligence dashboards generally do not count. Verify the current text of LL-2026-04 and Guide Section 1302.8 for the precise scope. - How do we tier our AI use cases by risk?
Not every use case deserves the same level of scrutiny. A tool that summarizes internal policy documents is low risk. A tool that calculates qualifying income, influences pricing, decides which files get escalated, or drafts adverse action language is high risk because it can affect credit decisions, fair lending outcomes, or required disclosures. The CSBS AI Use Case Risk Tiering Worksheet is a reasonable starting template. The tier assignment itself is the documentation — record it, the reasoning, and the date. Tiering is not a one-time exercise. Reassess whenever a use case changes materially, when an examiner challenges a classification, or at least annually.
Vendor Oversight
4. What should be in our vendor AI questionnaire?
Most lender vendor questionnaires are not built to surface AI risk. The questions to add: Does the product use AI or machine learning anywhere in its workflow? For what specific function? How is the model tested, validated, and monitored? What data trains the model, and where is that data processed? Does the product use generative AI, agentic AI, or any large language model component? How are errors reported, and on what timeline? What does the vendor do before a material model change ships? Will the vendor cooperate with GSE or state regulator information requests? Fannie Mae’s “no less protective” standard means the vendor’s AI is your AI for governance purposes, so the questionnaire matters.
- Do the GSE AI requirements apply if we only use AI through vendors?
Yes. Freddie Mac Guide Section 1302.8 applies to your use of AI or machine learning in origination or servicing, regardless of who built it. Fannie Mae LL-2026-04 requires you to manage vendor and subcontractor AI/ML risk with governance no less protective than its own requirements. Both GSEs can request details about your AI use on demand, including your vendor AI. If a vendor’s tool touches loans you sell to or service for the GSEs, it belongs in your inventory, your tiering, and your oversight program. - How often should we monitor high-tier AI use cases?
Define what “monitoring” means for each high-tier use case, and the cadence should match the risk. For document extraction and income calculation tools, the cleanest control is QC sampling: compare AI outputs to human-verified results on a defined sample each month and trend the error rate. For models that influence pricing or adverse action, the standard is higher — pre-deployment testing, segment-level performance review at least annually, and ongoing monitoring for drift, accuracy, and bias proxies. The September 2026 AARMR, MBA, and BCG survey found that only 58% of lenders monitor AI tools after deployment; the lenders who do will be the ones that hold up in a GSE request or state exam.
Examiner and GSE Readiness
7. What does the CSBS AI Supervisory Framework actually ask for?
CSBS released the framework on September 16, 2026. It has four parts: a Core Examiner Guide with scoping questions and a document request list, an Examiner Work Program, Nonbank AI Supplements focused on third-party and vendor risk, model risk, and consumer protection, and an AI Use Case Risk Tiering Worksheet. CSBS describes it as a discretionary supervisory tool, not a new set of legal requirements, but in practice the document request list is a preview of what state examiners will ask for. Treat it as an exam-readiness checklist, and remember that state mortgage regulators (AARMR) are evaluating it for the nonbank industry.
- What documentation do we need ready for a GSE request or state exam?
Keep the inventory, the tiering decisions, the approvals, the vendor assessments, the monitoring results, and the incident logs in one place — and keep them current. Both GSEs can request this information. A practical binder contains: the AI inventory with tier assignments, governance policy and committee minutes approving the policy, vendor AI questionnaires and contract language for AI/ML products, monitoring results for high-tier use cases with defined cadence and thresholds, fair lending testing for high-tier tools that affect credit decisions, incident logs for any model error or bias finding, and a current attestation or sign-off from the accountable executive. - How do we handle the “less discriminatory alternative” question for AI tools?
If a state or federal examiner challenges an AI-driven decision, you may be asked to show that there is no less discriminatory alternative that would serve your legitimate interest. Document the alternatives you considered when adopting or changing any model that affects credit decisions, pricing, marketing, or servicing, and record why you chose the one you did. This is a documentation discipline, not a separate workstream. Build it into your model change management process: when a model goes live, when it is materially updated, or when a new use case is approved, the file should include the alternatives considered and the rationale. State laws are also moving — Colorado’s Department of Law published draft automated decision-making technology rules on August 11, 2026, with a public hearing scheduled for October 26 (verify current status).
The Most Common Failure
10. What is the most common AI governance failure you see in mortgage lender programs?
Treating the governance program as a documentation exercise rather than an operational one. A written policy that no one updates, an inventory that misses half the systems, vendor questionnaires that ask the wrong questions, tiering that nobody has documented the reasoning for, monitoring that exists in a slide deck but not in the production environment. The September 2026 survey found 87% of respondents have written AI policies, but only 58% monitor tools after deployment, and only about 40% of smaller lenders do. A policy without monitoring evidence will not hold up to a GSE request or state exam. The fix is not a longer binder. It is a working program with named owners, defined cadences, and evidence of operation in the files an examiner can pull.
Want help building an AI inventory, designing vendor questionnaires, or standing up monitoring that satisfies Fannie Mae, Freddie Mac, and state examiners? Synergy works with mortgage QC and compliance teams nationwide. Book a 30-minute call to map out your program.
