Mortgage lenders face strict new AI governance under GSE mandates

Mortgage lenders and servicers are facing strict new artificial intelligence (AI) and machine learning guidelines from the government-sponsored enterprises (GSEs) that industry attorneys warn will significantly impact daily operations.

The requirements apply well beyond obvious applications like underwriting engines or credit decisioning models. They extend across multiple business areas and stakeholder touchpoints, creating new liability for companies that fail to follow the rules, they said. 

Fannie Mae issued its AI and machine learning governance standards through a lender letter on April 8, with the rules taking effect in August, 120 days after publication. This follows Freddie Mac‘s own AI requirements that became effective March 3.

In the case of Freddie Mac, companies must implement companywide controls to map, measure and manage AI risks related to bias, security vulnerabilities and performance. Documented roles, responsibilities and escalation paths must support this framework. It applies to any usage, including vendor tools embedded in document processing, fraud detection, quality control, customer communications and other operational workflows.

“Freddie Mac raised the bar on how approved Seller/Servicers govern artificial intelligence and machine learning,” Troy Garris, co-managing partner at Garris Horn LLP, wrote in a blog post. “Section 1302.8 will move beyond basic policy requirements and into a clear expectation: approved mortgage companies must operate an auditable AI governance program.”

Garris advised mortgage leaders to inventory all AI tools across their enterprise. This inventory should document the business purpose, owner, and connection to origination or servicing activities for each tool.

Companies also need governance structures to determine which executive owns AI risk, monitor model performance, assess specific threats and prepare for audits.

“AI governance is not a future compliance project. It is a present-tense operational requirement,” James Brody, a founder and managing partner at Brody Gapp LLP, wrote in a newsletter to clients. 

Brody and his partner, Ron Gapp, wrote in a guide for the new framework that Freddie Mac takes a prescriptive approach by telling companies exactly what to build, while Fannie Mae relies on a principles-based standard.

Under Fannie Mae‘s framework, companies must ensure transparency for personnel with AI responsibilities, incorporate ethical AI characteristics and reflect legal requirements. Lenders must also calibrate risk management to their tolerance levels and designate an owner to review policies at least annually.

Lenders and servicers must also comply with Fannie Mae’s security and business resiliency supplement starting Aug. 12, 2025. This covers cybersecurity controls, 36-hour incident notification and business continuity. Companies must manage vendor AI risks and prepare to disclose their AI governance practices upon request.

Brody and Gapp pointed out that Fannie Mae omits specific requirements for segregation of duties, audits, AI security threats or audit trails — all of which Freddie Mac requires. Consequently, lenders that build to Freddie Mac’s stricter standard will likely satisfy Fannie Mae’s rules.

According to them, every mortgage company must be ready to produce an AI tool inventory, operational documentation, safeguard descriptions and governance records on demand.