AI Governance for Mortgage Lenders

For the past two years, the mortgage industry talked about AI as an opportunity. In 2026, it’s an obligation for survival, with daunting governance expectations. Freddie Mac, Fannie Mae, MISMO, and CSBS all put AI governance expectations in writing within nine months, and state examiners now have a framework for testing them.

Mortgage lenders now face four overlapping sets of AI expectations, and two of them are already binding. Freddie Mac and Fannie Mae both require documented AI governance programs, MISMO has published an industry toolkit, and state regulators, some with their own jurisdiction specific obligations, now have a framework for testing all of it. In short, the question is no longer whether your company uses AI. It is whether you can show an examiner how you govern it.

Four Sets of AI Expectations Arrived in 2026

Source	What it requires or provides	Date	Applies to
Freddie Mac Bulletin 2025-16 (Guide Sections 1302.2 and 1302.8)	Policies to map, measure, and manage AI risk; monitoring for performance, security, and bias; segregation of duties; AI risk training	Effective Mar 3, 2026	Freddie Mac Seller/Servicers
Fannie Mae Lender Letter LL-2026-04	AI/ML policies and procedures; designated owners with annual review; vendor governance that is “no less protective”; disclosure on request	Effective Aug 6, 2026	Fannie Mae sellers and servicers
MISMO FRAME	Governance toolkit for mortgage companies of any size	Released Jun 11, 2026	Voluntary
CSBS AI Supervisory Framework	Examiner guide, scoping questions, document request list, and nonbank supplements	Released Sept 16, 2026	State-chartered banks and state-licensed nonbanks, as each state adopts it

Fannie Mae and Freddie Mac are the government-sponsored enterprises (GSEs) that buy and guarantee most conforming mortgages, so their requirements set the obligations for most lenders. The CSBS framework is how state examiners will test them.

What State Examiners Will Ask About AI Governance

The CSBS framework gives examiners scoping questions, a document request list, and procedures covering AI governance, inventories, generative and agentic AI, third-party risk, and consumer protection. It is discretionary: each state decides how to use it, and AI questions may appear inside routine exams rather than separate reviews.

Be ready to produce:

• An inventory of every AI tool in use, including AI inside vendor systems, with risk tiers outlined
• A written AI policy with a named owner and procedures you actually perform in your day-to-day operations
• An approved tool list and a process for disclosing anything else
• AI-related employee guidance or training materials
• Evidence of continued monitoring for performance, security, and bias

Shadow AI is the Gap Most Lenders Have Not Closed

In a peer session at the Uniquely TMC 2026 conference, mortgage compliance leaders agreed on one principle: if AI causes a compliance error, the lender owns it.

The unsolved problem is shadow AI: loan officers and staff using consumer AI accounts on personal devices, outside any monitored system. It creates fair lending and data-handling exposure that leadership often does not see until an exam surfaces it. It also leaves a hole in the AI inventory both GSEs now expect.

For example, one lender in that session tied its AI policy to payroll: staff had to disclose every AI tool they used before payroll would release. As a result, it surfaced dozens of undisclosed tools, and the approved list is now two. Others are adding AI training with policy sign-off, now available as a one-credit NMLS elective, and tracking which tools each loan officer uses.

Consumer-facing AI Carries the Most Risk

Consumer-facing AI, such as chatbots & phone voice assistants, is top of mind for regulators, as well as any AI used in credit worthiness determinations. Without guardrails, a borrower-facing chatbot can drift into solicitation or pricing, which are licensed activities. AI in lending decisions opens risk for potential fair lending issues. For consumer-facing communication tools, limit what it can discuss, hand pricing and eligibility questions to licensed staff, log every conversation, and review its scripts like any other advertising material.

You Own What Your Vendors Deploy

Fannie Mae requires lenders to govern vendor AI in a way that is “no less protective” than their own. That matters because vendors are adding AI mid-contract. One lender’s QC vendor quietly switched to AI-based review, and monthly findings jumped from 3–5 to more than 30, with inconsistent severity ratings on identical issues.

Ask every vendor three questions: What is the tool used for? Does it touch consumer data? Does it render financial decisions? Then add a contract clause requiring notice before a vendor adds AI.

AI Governance is What Makes Adoption Possible

One lender is running an AI overlay in shadow mode beside live underwriting, with a 2% error threshold before it makes any decision on its own. In testing, it is making fewer mistakes than human processors. That lender could run the test because it had the controls to measure it.

Ownership matters too. AI governance works best as a partnership between compliance and IT, and the GSE rules reinforce that: Fannie Mae requires designated owners with annual policy review, and Freddie Mac requires segregation of duties. At ActiveComply, we hold our own AI to the same standard: know where it is used, who owns it, and how to explain it to an examiner.

Your AI Governance Checklist

For more of what compliance leaders shared, read our Uniquely TMC 2026 recap.

Start with What Your Loan Officers Publish

Every AI-assisted post, email, or flyer is an advertisement, and examiners can see it. ActiveComply^® Pre-Review gives each one a documented review and approval trail. See how Pre-Review works.

Sources

• Fannie Mae Lender Letter LL-2026-04
• Freddie Mac Bulletin 2025-16 summary, Weiner Brodsky Kider
• CSBS announces AI Supervisory Framework
• CSBS framework overview, National Law Review
• MISMO releases FRAME, MBA