What the Fannie Mae and Freddie Mac AI mandates mean for lenders

In 2025 and 2026, both government-sponsored enterprises moved AI oversight from guidance to obligation. Freddie Mac's Bulletin 2025-16 took effect on March 3, 2026. Fannie Mae's Lender Letter LL-2026-04 took effect on August 6, 2026. Together they mean that any lender selling loans to the GSEs must now be able to demonstrate governance over the AI it uses in its origination and servicing operations.

The requirements are broader than many lenders expect. They cover governance frameworks and written policies, monitoring — including for bias — audit capability, and named senior-officer accountability for AI use. And critically, the obligations extend to vendor-provided AI systems, not just models a lender built in-house.

Most lenders do not build AI. They buy it — inside their point-of-sale system, their document processing tools, their servicing platform. Under the new requirements, using a vendor's AI does not transfer the obligation to the vendor. The lender must still be able to document what the AI does, what data it touches, how it is monitored, and how its decisions can be audited.

That creates an uncomfortable question to put to every AI vendor in your stack: can you give me an audit-ready record of what your system did on my loans? A security certification does not answer it. A marketing page does not answer it. What answers it is a per-loan record of every AI action — what ran, what data it used, what it produced, and whether a human reviewed it.

A defensible posture has a few recognizable properties. First, an inventory: you know exactly where AI acts in your process, at what level of autonomy, and where humans review. Second, decision records: every AI-involved decision is captured with its inputs, the policy applied, the reasons that fired, and any human approval — at decision time, not reconstructed later. Third, integrity: the record itself is trustworthy. An ordinary application log can be edited; a tamper-evident record — where each entry is cryptographically chained to the one before it — cannot be altered without the alteration being visible.

Fourth, and least discussed: reproducibility. When a decision from months ago is questioned, the strongest answer is not a log excerpt — it is re-running the decision with its original inputs and showing that the same policy produces the same result. That is only possible when the decision logic is deterministic rather than buried in a model's reasoning.

Both dates have now passed, but neither was a cliff — examiners are looking for credible programs, not perfection. But 'we are evaluating our AI governance posture' is a much weaker answer than 'here is the register of every AI action on this loan, here is the approval record, and here is the integrity proof.' Lenders that treat the mandates as an architecture requirement rather than a paperwork exercise will spend less time on every exam, every investor review, and every repurchase dispute that touches AI.

This is the standard Miji is built to — governed AI operations with approval gates, decision records, and a hash-chained, tamper-evident audit trail, designed so the compliance record is a by-product of running the work rather than a project after it. If you are working through what the mandates mean for your operation, we are onboarding design partners in lending: hello@mijios.ai.

Note: this article is general information, not legal or compliance advice. Consult your counsel and the source documents — Freddie Mac Bulletin 2025-16 and Fannie Mae Lender Letter LL-2026-04 — for the authoritative requirements.