Across the mortgage industry, August 6, 2026, has been treated as the artificial-intelligence governance deadline. Now that the date has arrived, the harder question is what an institution must be prepared to prove on August 7 and every day thereafter.
Fannie Mae’s governance framework for seller/servicers using artificial intelligence or machine learning in origination or servicing is significant. It requires written policies and procedures, a designated owner, at least annual review, legal compliance, vendor and subcontractor controls, adherence to Fannie Mae’s incorporated information-security requirements, and prompt disclosure of AI/ML use upon request. Mortgage companies should take these obligations seriously. However, treating August 6 as the central AI-governance deadline risks creating the mistaken impression that compliance is a short-term counterparty exercise, rather than a durable enterprise system for managing legal exposure.
A lender may satisfy Fannie Mae’s framework and still face liability under federal lending laws, privacy and information-security requirements, consumer-reporting statutes, telemarketing restrictions, state consumer-protection laws, employment laws, Freddie Mac’s separate contractual requirements, and ordinary litigation doctrines.
The First Mistake: Treating A Contractual Requirement As The Entire Legal Standard
Fannie Mae’s Lender Letter LL-2026-04 applies to approved seller/servicers that use AI or machine learning for loans sold to or guaranteed by Fannie Mae, or serviced on its behalf. The letter covers both internally developed systems and third-party technologies, including tools provided by vendors and subcontractors.
These duties arise from the seller/servicer relationship and are contractual in nature. Noncompliance may result in counterparty remedies, repurchase or indemnification exposure, servicing consequences, heightened oversight, or other action under the governing agreements. Conversely, compliance does not provide any type of safe harbor from the vast majority of statutes and regulations that govern how mortgage companies market to consumers, communicate with them, evaluate applications, approve or deny credit, service loans, and/ or collect consumer information.
The GSE framework asks whether the institution has built a credible governance structure. The law asks more: Did the system discriminate? Did the adverse-action reasons match the factors that actually drove the decision? Was consumer information obtained, used, disclosed, and retained lawfully? Did an AI voice contact a consumer with legally sufficient consent? Did a chatbot make a deceptive statement? Did a servicing model treat similarly situated borrowers differently? Did the company identify a material risk and fail to correct it? Quite simply, an AI policy or inventory spreadsheet alone cannot answer those questions.
The Operative Deadline Is the Day the GSE Asks
Fannie Mae’s letter requires a seller/servicer, upon request, to promptly disclose the AI/ML it uses, how and why it uses it, the safeguards in place to mitigate risk, and any other information Fannie Mae requires. Freddie Mac imposes a materially similar disclosure-on-request obligation.
That changes the executive calculus since the institution does not control when the request arrives, which business unit receives it first, or how quickly its records must be assembled. The real deadline is not a date on the calendar; it is the moment the institution must turn governance claims into evidence.
In light of the foregoing, any company that has adopted a policy but cannot tie each covered use case to approvals, testing, legal analysis, vendor diligence, monitoring, exceptions, and remediation may very well find that its “AI governance program” cannot be reproduced under scrutiny.
Freddie Mac Was Already There And Went Further
Freddie Mac Guide Section 1302.8 has been effective since March 3, 2026. It requires compliance with applicable law and purchase documents; senior-management approval of AI/ML policies; assigned ownership and annual review; risk assessments; testing; monitoring; auditing; documentation; vendor controls; and prompt disclosure upon request.
Freddie Mac’s framework is not simply earlier; in several respects, it is more prescriptive. It expressly requires regular monitoring for performance, security breaches, and bias; internal and external audits; assessment of threats such as data poisoning and adversarial inputs; segregation of duties; and audits addressing standards such as NIST 800-53 and ISO 27001. Most importantly, Section 1302.8(b) includes a broad AI/ML indemnification in favor of Freddie Mac for liabilities, losses, claims, damages, judgments, costs, expenses, and attorneys’ fees arising directly or indirectly from, or relating to, the seller/servicer’s use of AI/ML.
The enterprise therefore should not maintain separate “Fannie” and “Freddie” policies in parallel. It needs one defensible architecture that satisfies the more demanding applicable requirement and maps the resulting controls and evidence to each counterparty. This is especially true with there being a very high likelihood that both Freddie and Fannie have every intention of requiring much more from their approved sellers/servicers in the coming months, if not weeks.
FRAME Should Be The Common Architecture And Not The Legal Ceiling
The strongest mortgage-specific model has three layers: operational governance, contractual governance, and legal governance.
MISMO’s Framework for Responsible AI in the Mortgage Ecosystem — FRAME — can supply the operational architecture. Fannie Mae’s and Freddie Mac’s requirements impose the contractual obligations. Applicable statutes, regulations, case law, and institution-specific duties form the legal layer.
That sequence matters because mortgage banking is too interconnected for lenders, servicers, vendors, investors, and advisors to operate under different vocabularies, risk taxonomies, and control structures. As such, FRAME gives the industry a shared structure for policies, inventories, risk assessments, implementation guidance, and oversight, which MISMO currently makes available to member companies through MISMO Connect.
With the foregoing in mind, while FRAME should be supported as the industry’s common foundation and is one that our firm supports, a shared framework does not amount to a legal conclusion whether a particular use complies with ECOA, FCRA, the Fair Housing Act, GLBA, TCPA, state privacy and consumer-protection laws, employment requirements, and/or contractual obligations.
Our opinion is that the better approach is integration: use FRAME as the mortgage-specific architecture, map both GSEs to it, and then layer in the applicable legal duties, testing requirements, vendor rights, escalation rules, and institution-specific controls. Standardization reduces fragmentation. Legal analysis determines what the standardized process must accomplish for each use case.
An AI Inventory Is Necessary But Radically Insufficient
Although an institution cannot govern tools it does not know it is using, an inventory is not governance. In other words, where an inventory identifies systems, governance determines what those systems may do, which laws and contracts apply, what testing is required, who may approve use, what evidence must be retained, what happens when a system changes, and who has authority to suspend it.
A legally useful use-case register should identify the affected population, decision or recommendation produced, data inputs, downstream systems, applicable authorities, validation methodology, performance thresholds, protected-class testing, adverse-action implications, consent requirements, data-retention rules, human-review mechanics, override authority, vendor dependencies, incident triggers, and remediation history. Without that information, the inventory is not a control mechanism. It is a list of potential exhibits.
In litigation or an enforcement investigation, an inventory may show that the institution knew a system existed. If the same records show the tool was classified as high risk, but the company cannot demonstrate testing, escalation, remediation, or monitoring, the inventory may help prove notice of the risk. At the end of the day, where a policy states what the organization says it does, evidence shows whether it actually did it.
One Mortgage Workflow Can Trigger Multiple Legal Regimes
Consider one borrower journey. An AI-assisted marketing platform determines who receives an advertisement. A lead-scoring model prioritizes prospects. An artificial-voice system calls them. A chatbot answers questions. Automated tools extract application data. An underwriting model generates recommendations. A separate system helps produce adverse-action reasons. After closing, servicing analytics determine who receives outreach, loss-mitigation messaging, or escalation.
Operationally, those tools may look like separate technologies owned by separate departments. Legally, they operate as one connected chain of conduct.
Fair Lending And Adverse Action
Under ECOA and Regulation B, a creditor remains responsible for providing the specific principal reasons for adverse action. The technical issue is not merely explainability; it is explanation fidelity—whether the reasons given to the applicant match the factors that actually drove the decision, rather than a plausible narrative generated after the fact.
That task becomes more difficult with complex models, particularly when vendor-generated reason codes, feature transformations, interaction effects, or downstream overlays separate the model’s internal mechanics from the notice delivered to the consumer. The institution must test that chain; a vendor’s assurance that the product is “explainable” is not enough.
Fair-lending exposure also begins upstream. AI may influence who sees an advertisement, which leads receive attention, how quickly consumers are contacted, which products are presented, and whether borrowers remain in the pipeline. Even after the 2026 Regulation B amendment, disparate-treatment and proxy concerns, the Fair Housing Act, state law, and UDAAP-related theories continue to make those upstream decisions legally consequential.
FCRA, GLBA, And Data Governance
AI tools that use consumer-report information, generate eligibility recommendations, verify identity, detect fraud, or affect adverse decisions may implicate the Fair Credit Reporting Act. Relevant issues may include permissible purpose, accuracy, dispute handling, adverse-action procedures, third-party data, and whether a vendor has become part of a consumer-reporting workflow without the institution recognizing it.
Mortgage companies subject to the Gramm-Leach-Bliley Act must safeguard customer information and oversee the service providers that handle it. AI creates additional risks: customer data may be retained or reused unexpectedly; employees may enter confidential information into unapproved tools; retrieval systems may expose information across files; vendors may add subprocessors; and traditional controls may not address prompt injection, data poisoning, or model extraction.
An AI-specific legal and technical assessment should therefore be part of the institution’s risk-based program when the use case, governing instrument, or data exposure warrants it. The need should be tied to the actual system and obligation, not asserted as a stand-alone universal mandate.
Robocalling And Consent
The Federal Communications Commission has confirmed that AI-generated voices qualify as “artificial” voices under the Telephone Consumer Protection Act. Calls using those technologies generally require prior express consent, and telemarketing calls may require prior express written consent.
For AI voice agents used in lead conversion, application follow-up, servicing, collections, or retention, the lender must know how consent was obtained, what it covers, which entity received it, whether it extends to the caller and purpose, whether it has been revoked, whether suppression systems operate in real time, and whether the records can prove compliance for each call.
The TCPA authorizes statutory damages of $500 per violation and allows courts to award up to three times that amount for willful or knowing violations. At scale, a flawed configuration or deficient consent record can become material class-action exposure.
Banking Guidance Does Not Fill The Gap
On April 17, 2026, the Federal Reserve, OCC, and FDIC issued revised interagency model-risk guidance, identified as SR 26-2, OCC Bulletin 2026-13, and FDIC FIL-15-2026. The guidance is supervisory rather than an enforceable standard, is expected to be most relevant to banking organizations with more than $30 billion in assets, and expressly excludes generative and agentic AI from its scope.
That exclusion underscores the central point: no single banking, GSE, or industry instrument covers the full AI risk surface. Depositories must place the guidance within a broader governance system. Independent mortgage banks should also expect bank-regulated warehouse lenders to incorporate comparable AI-governance questions into diligence and covenant reviews, even though no uniform warehouse mandate has been established.
Vendor Governance Is Not Vendor Reliance
Much of the industry’s AI is embedded in loan-origination systems, customer-relationship platforms, document tools, call-center systems, fraud products, marketing platforms, underwriting utilities, quality-control tools, and servicing applications.
A model card, SOC report, security questionnaire, fairness statement, or contractual warranty may be relevant. None proves that the system operates lawfully in the lender’s actual environment. Performance can vary with the lender’s data, population, product mix, geography, configuration, thresholds, integrations, model updates, user behavior, and downstream human decisions.
The institution must evaluate the use case, not simply the product. Contracts may need audit rights, testing cooperation, data-use limitations, model-change notice, subprocessor controls, record-retention requirements, incident reporting, regulatory cooperation, explanation rights, remediation obligations, insurance, indemnification, and termination assistance.
A vendor’s refusal to provide meaningful information is risk information.
Why Counsel Must Be Structurally Involved
Information technology, information security, data science, compliance, procurement, and enterprise risk all play essential roles in AI governance. None, however, can independently assess the institution’s full legal exposure.
AI governance requires decisions involving statutory interpretation, regulatory scope, contracts, consumer disclosures, discrimination analysis, employment law, incident reporting, evidence preservation, litigation risk, and communications with counterparties and regulators. Legal analysis must therefore shape the governance architecture itself, including classification, testing, escalation, remediation, suspension authority, retention, disclosure, investigation, and response when the evidence is unfavorable.
That does not make every governance record privileged. Pre-existing inventories, test results, monitoring logs, and vendor reports do not become privileged simply because they are later sent to counsel. A properly structured, counsel-directed investigation may separately generate privileged communications or work product, but the institution must distinguish ordinary governance records from legal advice and investigative materials.
What Executives Should Require Now
1. Convert the inventory into a legally mapped use-case register. Map each use to the affected laws, contracts, consumers, employees, data categories, decisions, communications, testing requirements, and potential remedies.
2. Use FRAME as the architecture, then layer obligations onto it. Map Fannie Mae, Freddie Mac, applicable law, and institution-specific controls into one mortgage-specific operating structure.
3. Test outcomes and explanation fidelity. Evaluate accuracy, fairness, security, consent, overrides, exceptions, downstream effects, and whether explanations align with the factors that actually drove the decision.
4. Strengthen vendor contracts and evidence rights. Ensure the institution can obtain the information, cooperation, records, testing support, change notices, and remediation needed to satisfy its own obligations.
5. Establish counsel-led escalation and incident protocols. Decide in advance who may suspend a system, when legal review is required, what must be preserved, and what must be disclosed to a GSE, regulator, consumer, investor, or other counterparty.
The Real Deadline
FRAME supplies the common operating structure. The GSEs add contractual requirements. Federal and state law govern the institution’s conduct and remedies. None of these relieves a mortgage company of the duty to identify which obligations apply to its operations and prove that its controls worked in practice.
August 6 was not the end of implementation; it was the beginning of an evidence obligation. The board-level question is now simple: if Fannie Mae, Freddie Mac, a regulator, an investor, a warehouse lender, or a plaintiff asked tomorrow, could the company produce a coherent record showing what AI it uses, why it uses it, which legal and contractual duties apply, how each system was tested, what the vendor had to provide, what exceptions occurred, and how the institution responded?
Companies that treat AI governance as a policy exercise will remain exposed. Companies that treat it as an enterprise legal-control and evidence system will be ready for what comes next. That is the deadline that matters.
Legal Disclaimer: This article is for general informational purposes only, reflects developments as of Aug. 6, 2026, and does not constitute legal advice or create an attorney-client relationship. Readers should verify current law and consult counsel licensed in the appropriate jurisdiction. The authors’ firm includes attorneys licensed in California, Arizona, Texas, Minnesota, and New York, and works with local counsel where necessary. This material may constitute attorney advertising in some jurisdictions.
