BrokerVA
BrokerVA Team · October 26, 2026

Who Is Accountable When AI Touches a Mortgage File? What the GSE Rules Say

Who Is Accountable When AI Touches a Mortgage File? What the GSE Rules Say

When AI touches a mortgage file, the lender stays accountable. Freddie Mac has required AI governance since March 3, 2026, Fannie Mae since August 6, and both reach AI inside vendors' platforms. Here is what the rules say, what they leave open, and what to ask your providers. It's part of our series on the human element in mortgage.

What Did Freddie Mac Require?

Freddie Mac's Guide Bulletin 2025-16, issued December 3, 2025, amended Sections 1302.2 and 1302.8 of its Single-Family Seller/Servicer Guide to require a governance framework for AI and machine learning, effective March 3, 2026. You can read the bulletin text as hosted by Orrick.

According to National Mortgage Professional's summary, the requirements apply to AI and machine learning used in origination and servicing, including AI embedded in third-party vendor platforms that the seller/servicer didn't develop or fully control. NMP also reports that Section 1302.8 includes indemnification obligations tied to a seller/servicer's use of AI, that the framework must be reviewed at least annually, and that vendor and subcontractor AI must be governed to standards no less protective than the seller/servicer's own.

What Did Fannie Mae Require?

Fannie Mae's Lender Letter LL-2026-04, issued April 8, 2026, took effect August 6. It applies to approved seller/servicers that use AI or machine learning in connection with loans sold to or guaranteed by Fannie Mae, or serviced on its behalf. National Mortgage Professional reports that it requires policies and procedures covering the development, implementation, use, and maintenance of AI and machine learning systems, and that Fannie Mae may request prompt disclosure of the types of AI used, how, for what purpose, and with what safeguards.

NMP also reports that both frameworks build on FHFA Advisory Bulletin AB 2022-02, which set AI risk management expectations for the enterprises themselves.

Do These Rules Reach Vendors?

According to the summaries above, yes. If a vendor's platform uses AI in work on your loans, the reporting says your governance has to account for it. That is why it's worth asking vendors directly. These are the GSEs' requirements for their approved sellers and servicers, and your obligations depend on who you sell to or service for. Confirm how they apply to you with your counsel.

What About Adverse Action Reasons?

A separate rule applies whatever technology produces a decision. ECOA and Regulation B require lenders to give applicants specific, accurate reasons for adverse action. The CFPB's Circular 2022-03 explained that this applies to complex algorithms, and that not understanding your own model isn't a defense. That circular, and Circular 2023-03 on the same subject, were withdrawn on May 12, 2025. The requirement itself sits in the regulation and was not withdrawn.

The practical takeaway: if a person can't explain a decision, the lender can't give accurate reasons for it.

Who Is Accountable for a Vendor's Work in General?

The institution, under longstanding vendor oversight principles. The FTC's Safeguards Rule requires financial institutions to oversee service providers, including selecting capable providers, requiring safeguards by contract, and assessing them periodically. The CFPB's Compliance Bulletin 2016-02 says a vendor relationship doesn't absolve a supervised entity of responsibility. That bulletin is non-binding, and it does not appear on the CFPB's list of withdrawn guidance, which was last updated July 22, 2026. See Who Is Liable for Outsourced File Errors?.

How Visible Is Vendor AI Today?

Not very. In Ncontracts' 2026 survey, reported in MBA Newslink, 72% of organizations were only partially aware of which vendors use AI, 16% hadn't assessed vendor AI use, and none felt extremely confident managing AI-related vendor risk. Ncontracts sells vendor-risk software, and the survey covers financial services broadly, so treat it as an indicator.

What Should You Ask Your Providers?

Put these in writing:

  1. Do you use AI or machine learning in work on my loans? Where, and for what tasks?
  2. Is any borrower or loan data sent to an AI tool or vendor, and under what controls?
  3. Which third parties or subcontractors use AI on my files?
  4. Who reviews AI-assisted output before it affects a file, and how is that recorded?
  5. Can you disclose your AI use to me on request, in a form I could pass to a GSE?
  6. How do your contract terms handle errors, indemnification, and incidents?
  7. Where does a person make the final call?

These build on questions 27 and 28 of our security due diligence checklist. For the vendor-risk context, see What the 2026 Vendor-Risk Survey Means for Outsourced Operations.

Where Do People Sit in All of This?

At the decision points. Governance frameworks name accountable people, executive sign-off, and documented oversight because a policy can't answer for a result. That is why we map where human judgment shows up in each stage of the loan, and why buyers say they want safeguards, as in Cotality's 2026 survey.

How Does BrokerVA Fit?

BrokerVA provides mortgage operations support through 150+ specialists in five stage-based roles, Setup, Disclosure, Closing, Funding, and Post-Closing. Accountability for the loan stays with you and your licensed people, and we don't claim to make anyone compliant. We have partnered with Addy AI for LOA services. For any other question about AI in our services, ask us directly, and put the seven questions above to us as you would to any provider. Our security page explains what we can document.

Our goal is to lower your cost to originate. Every client gets a dedicated Coach for a 6-week implementation, then ongoing coaching and regular check-ins, which keeps your checkpoints and your processes part of how the work is done. We can't promise a specific saving, since it depends on your operation. On a call, we'll walk through your numbers and show you our cost calculator live. Pricing is customized to your volume and the roles you need. See how BrokerVA works.

Frequently Asked Questions

Who is accountable when AI makes a mortgage decision? The lender or seller/servicer. Freddie Mac and Fannie Mae require approved sellers and servicers to maintain AI governance, and adverse action reasons under ECOA and Regulation B must still be specific and accurate.

When did the GSE AI requirements take effect? Freddie Mac's on March 3, 2026, and Fannie Mae's on August 6, 2026.

Do the rules apply to vendors' AI? According to National Mortgage Professional's summaries, they reach AI embedded in third-party platforms and require vendor and subcontractor AI to be governed to a standard no less protective than your own. Confirm how this applies to you with counsel.

What should I ask a provider about AI? Where it's used, what data it touches, who reviews its output, whether it can be disclosed on request, and how errors and indemnification are handled.

Sources

Doing a vendor review that includes AI? Book a call with BrokerVA and bring your questions. We'll walk through your numbers and show you our cost calculator.

BrokerVA | NMLS #1977844