Fannie Mae AI governance is now a written eligibility requirement. Under Lender Letter LL-2026-04, effective August 6, 2026, any Fannie Mae seller or servicer that uses artificial intelligence or machine learning (AI/ML) in origination or servicing must operate under a documented governance program, review its AI/ML policies at least annually, extend those standards to vendors and subcontractors, and disclose its AI use to Fannie Mae on request. Freddie Mac imposes a parallel framework through Guide Bulletin 2025-16, codified in Single-Family Seller/Servicer Guide Section 1302.8 and effective March 3, 2026, with more prescriptive audit and indemnification language. If your firm touches AI anywhere in the loan lifecycle, you need an auditable program in place, and the practical way to build one is documented policies, a complete model inventory, vendor oversight, and independent testing.
This article breaks down what each government-sponsored enterprise (GSE) now requires, where the two frameworks differ, and how a lender can stand up a program that survives a Fannie Mae or Freddie Mac request. For firms that already manage agency eligibility, this is an extension of familiar seller/servicer discipline into a new risk domain.
What Fannie Mae Requires Under LL-2026-04
Lender Letter LL-2026-04 establishes a governance framework for sellers and servicers that use AI/ML in their origination or servicing practices. Fannie Mae issued the letter on April 8, 2026, and its requirements take effect August 6, 2026, roughly 120 days after publication. It applies broadly and does not carve out a distinction between internally built tools and vendor-provided systems.
The core obligation is a documented, actively maintained governance program. A seller or servicer must maintain policies and procedures covering the development, implementation, use, and maintenance of any AI/ML system it relies on, along with a method for measuring and managing the associated risks.
Fannie Mae expects those policies to meet several tests. They must be transparent and communicated to the appropriate personnel, incorporate the characteristics of trustworthy and ethical AI/ML, reflect an understanding of applicable legal and regulatory requirements, align with the firm’s stated risk tolerance, and be reviewed at least annually for compliance with law and consistency with industry practice.
The framework also reaches outside the four walls of the lender. A seller or servicer must manage the risks arising from vendor and subcontractor use of AI/ML tools and apply the same governance standards it holds itself to. In practice, that means the third party running your fraud screen, your document classifier, or your borrower chatbot has to meet your controls, not just its own.
Finally, disclosure is on demand. Upon request, a seller or servicer must promptly tell Fannie Mae the types of AI/ML in use, the purpose and manner of that use, the safeguards in place to mitigate AI/ML risk, and any other information Fannie Mae requires. There is no annual filing, but there is a standing obligation to be ready to answer.
What Freddie Mac Requires and How the Two GSEs Compare
Freddie Mac moved first. Guide Bulletin 2025-16, issued December 3, 2025, amended the Single-Family Seller/Servicer Guide with governance, audit, and security requirements for AI and ML, effective March 3, 2026. The requirements sit principally in Section 1302.8 of the Guide and, like Fannie Mae’s, apply to any AI or ML used in connection with origination or servicing, including vendor tools embedded in document processing, fraud detection, quality control, and customer communications.
The two frameworks rhyme, but Freddie Mac’s is more operationally prescriptive. Both GSEs require written policies across the full system lifecycle, an inventory of AI/ML use, ongoing monitoring for bias and performance degradation, staff training, and disclosure on request. Where Fannie Mae sets a principles-based structure, Freddie Mac spells out more of the mechanics.
Several Freddie Mac elements go further than the Fannie Mae letter. Freddie Mac’s guidance contemplates regular internal and external audits measured against recognized frameworks such as NIST 800-53 and ISO 27001. It also emphasizes documented accountability, including approval of AI/ML policies at a senior executive level, and it carries an express indemnification obligation tied to AI use that the Fannie Mae letter does not explicitly impose.
For a firm that sells to or services for both enterprises, the practical takeaway is to build to the stricter standard. A program engineered to satisfy Freddie Mac’s audit and accountability requirements will generally clear the Fannie Mae bar as well, and it consolidates two overlapping obligations into one control set rather than two.
The dates matter for sequencing. Freddie Mac’s requirements have been live since March 3, 2026, so seller/servicers should already be operating under Section 1302.8. Fannie Mae’s August 6, 2026 effective date is the second deadline, not a fresh start. A single, well-documented AI governance program addresses both.
How to Build an Auditable AI/ML Program
The GSEs are not asking for a slide deck. They are asking for a program that can be evidenced when someone requests it. The following components map directly to what both Fannie Mae and Freddie Mac describe and give a lender a defensible structure.
Start with a written AI/ML governance policy. It should define what counts as AI/ML at your firm, assign ownership, state your risk tolerance, and describe how you develop, deploy, monitor, and retire models. Build in the annual review Fannie Mae requires, and record the date and outcome of each review so the cadence is provable.
Maintain a complete AI/ML inventory. Catalog every use case, whether homegrown or vendor-supplied, with a documented business purpose, a named owner, and a clear link to origination or servicing activity. This inventory is the single most useful artifact when a GSE asks what you use and why, and it is usually the item lenders are missing.
Extend governance to vendors and subcontractors. Update contracts and due-diligence questionnaires so third parties running AI/ML on your behalf meet your standards. Confirm you can obtain from them the same disclosure information the GSEs may request from you, including purpose, manner of use, and safeguards.
Establish monitoring and testing. Track model performance over time, watch for bias and drift, and log the results. Freddie Mac’s audit orientation makes independent testing especially important. An internal audit function or an external reviewer that validates the controls, rather than the model author self-attesting, is what makes the program credible.
Prepare a disclosure package in advance. Because both GSEs can ask on request, assemble a standing response set: the AI/ML types in use, purposes, manner of use, safeguards, and governance documentation. Keeping this current turns a stressful request into a routine pull.
Assign senior accountability. Freddie Mac’s emphasis on executive ownership of AI risk means the program needs a clear line to leadership. Name who owns AI risk, define escalation paths, and document segregation of duties between model owners and independent reviewers.
Pease Bell’s mortgage banking practice and risk advisory services help lenders design and independently test these controls so the program holds up to GSE scrutiny. Because AI governance now sits alongside the financial eligibility rules covered in our overview of Fannie Mae and Freddie Mac net worth and liquidity requirements, and it overlaps operationally with the reporting discipline behind the Mortgage Call Report, it fits naturally into the compliance calendar seller/servicers already run.
Frequently Asked Questions
What is Fannie Mae Lender Letter LL-2026-04?
LL-2026-04 is a Fannie Mae Lender Letter that sets a governance framework for sellers and servicers that use AI or ML in origination or servicing. It requires documented policies, at least annual policy review, vendor and subcontractor oversight, and disclosure of AI use to Fannie Mae on request. It becomes effective August 6, 2026.
When do the Fannie Mae and Freddie Mac AI requirements take effect?
Freddie Mac’s requirements, from Guide Bulletin 2025-16 and codified in Section 1302.8, took effect March 3, 2026. Fannie Mae’s LL-2026-04 takes effect August 6, 2026. Seller/servicers who work with both should already be in compliance with Freddie Mac and should have a program ready for the Fannie Mae date.
Do these rules apply to vendor AI tools?
Yes. Both GSEs apply their requirements to any AI/ML used in origination or servicing, including third-party tools embedded in document processing, fraud detection, quality control, and customer communications. Lenders must extend their governance standards to vendors and subcontractors and be able to disclose how those tools are used.
How is Freddie Mac’s AI framework different from Fannie Mae’s?
Both require written policies, an AI/ML inventory, monitoring for bias and performance, training, and disclosure on request. Freddie Mac’s version is more prescriptive: it emphasizes regular internal and external audits against recognized standards, senior executive accountability for AI risk, and an express indemnification provision. Building to the Freddie Mac standard generally satisfies Fannie Mae as well.
What documentation should a lender keep to prove compliance?
Keep a written governance policy with dated annual reviews, a complete AI/ML use-case inventory with owners and business purposes, vendor oversight records, monitoring and testing logs, and a prepared disclosure package covering AI types, purposes, manner of use, and safeguards. Independent testing of the controls strengthens the record.
Does using AI put my agency approval at risk?
Using AI is permitted, but failing to govern it can create eligibility and repurchase exposure, particularly under Freddie Mac’s indemnification language. The requirement is not to avoid AI; it is to run it under a documented, auditable program that you can evidence on request.
