FNMA Lender Letter LL-2026-04 — Governance framework on use of artificial intelligence and machine learning

fnma-ll-2026-04

Fannie Mae Lender Letter LL-2026-04, published April 8, 2026, "Effective: 120 days from publication" (≈ August 6, 2026). Requires Fannie Mae seller/servicers using AI/ML in origination or servicing to maintain policies and procedures (transparent, trustworthy/ethical, legally informed, risk-based, owner-reviewed at least annually), comply with the Information Security and Business Resiliency Supplement, govern subcontractor/vendor AI/ML no-less-protectively, and disclose AI/ML use to Fannie Mae on request. The 2-page letter does NOT enumerate "four pillars" or a named "AI inventory with fields" — those are operationalizations.

Update kit for this regulation → Get this register: .xlsx .csv More bundles →

source:
  type: regulation
  id: fnma-ll-2026-04
  authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of artificial intelligence and machine learning
  description: 'Fannie Mae Lender Letter LL-2026-04, published April 8, 2026, "Effective: 120 days from publication" (≈ August 6, 2026). Requires Fannie Mae seller/servicers using AI/ML in origination or servicing to maintain policies and procedures (transparent, trustworthy/ethical, legally informed, risk-based, owner-reviewed at least annually), comply with the Information Security and Business Resiliency Supplement, govern subcontractor/vendor AI/ML no-less-protectively, and disclose AI/ML use to Fannie Mae on request. The 2-page letter does NOT enumerate "four pillars" or a named "AI inventory with fields" — those are operationalizations.'
obligations:
  - id: fnma-ll-2026-04-policies-and-procedures
    canonical_id: fnma-ll-2026-04-policies-and-procedures
    section: FNMA LL-2026-04 — policies & procedures for AI/ML (transparent, trustworthy, legal-aware, risk-managed)
    description: A seller/servicer using AI/ML must have policies and procedures for its development, implementation, use and maintenance, and for measuring and managing AI/ML risks — transparent, trustworthy/ethical, legally informed, and risk-tolerance-based.
    type: do
    audit_question: Does [LENDER] maintain AI/ML policies and procedures covering development, use, maintenance, and risk — transparent, trustworthy/ethical, legally informed, and tied to its risk tolerance?
    program_review: Does the AI governance program establish policies & procedures for AI/ML use that are transparent, trustworthy/ethical, legally informed, and risk-based?
    file_review: N/A (program-level requirement) — confirm the policy document exists and meets the four characteristics.
    judgment: false
    feeds: []
    workflow_phase: ai_governance
    owner_role: cco
    secondary_owner_role: chief_risk_officer
    cadence: ongoing-program
    consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
    tags:
      - fnma
      - ll-2026-04
      - ai-governance
      - ai-ml
      - model-risk
      - vendor
      - effective-2026-08-06
      - promoted
    primary_source:
      tier: 1
      authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
      source_class: gse-lender-letter
      source_url: https://singlefamily.fanniemae.com/media/45196/display
      snapshot_id: 57b9721f3620063b
      fetched_at: '2026-06-08T00:00:00Z'
      content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
      paragraph_quote: Have policies and procedures regarding the development, implementation, use and maintenance of any AI/ML system it utilizes, and the measuring and managing of AI/ML risks.
      drafter_attestation: Verbatim from LL-2026-04 snapshot. Core policies-and-procedures requirement.
  - id: fnma-ll-2026-04-owner-annual-review
    canonical_id: fnma-ll-2026-04-owner-annual-review
    section: FNMA LL-2026-04 — named owner reviews the AI/ML policies at least annually
    description: The AI/ML policies and procedures must have an owner who implements, maintains, and reviews them at least annually to ensure compliance with applicable law and consistency with industry best practices.
    type: do
    audit_question: Has [LENDER] named an owner for its AI/ML policies who reviews them at least annually for legal compliance and best-practice alignment?
    program_review: Does the program assign an owner who reviews the AI/ML policies at least annually?
    file_review: Confirm the named owner and evidence of the most recent annual review.
    judgment: false
    feeds: []
    workflow_phase: ai_governance
    owner_role: cco
    secondary_owner_role: chief_risk_officer
    cadence: ongoing-program
    consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
    tags:
      - fnma
      - ll-2026-04
      - ai-governance
      - ai-ml
      - model-risk
      - vendor
      - effective-2026-08-06
      - promoted
    primary_source:
      tier: 1
      authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
      source_class: gse-lender-letter
      source_url: https://singlefamily.fanniemae.com/media/45196/display
      snapshot_id: 57b9721f3620063b
      fetched_at: '2026-06-08T00:00:00Z'
      content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
      paragraph_quote: have an owner(s) that implements, maintains and reviews the policies and procedures at least annually to ensure they comply with applicable law and consistently reflects industry best practices.
      drafter_attestation: Verbatim from LL-2026-04 snapshot. Owner + annual-review requirement.
  - id: fnma-ll-2026-04-info-security-supplement
    canonical_id: fnma-ll-2026-04-info-security-supplement
    section: FNMA LL-2026-04 — comply with the Information Security and Business Resiliency Supplement
    description: The seller/servicer must comply with the requirements in the Fannie Mae Information Security and Business Resiliency Supplement.
    type: do
    audit_question: Does [LENDER] comply with the Fannie Mae Information Security and Business Resiliency Supplement for its AI/ML use?
    program_review: Does the program incorporate the Information Security and Business Resiliency Supplement requirements?
    file_review: Confirm Info Security & Business Resiliency Supplement compliance is mapped into the AI program.
    judgment: false
    feeds: []
    workflow_phase: ai_governance
    owner_role: cco
    secondary_owner_role: chief_risk_officer
    cadence: ongoing-program
    consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
    tags:
      - fnma
      - ll-2026-04
      - ai-governance
      - ai-ml
      - model-risk
      - vendor
      - effective-2026-08-06
      - promoted
    primary_source:
      tier: 1
      authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
      source_class: gse-lender-letter
      source_url: https://singlefamily.fanniemae.com/media/45196/display
      snapshot_id: 57b9721f3620063b
      fetched_at: '2026-06-08T00:00:00Z'
      content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
      paragraph_quote: Comply with the requirements in the Fannie Mae Information Security and Business Resiliency Supplement
      drafter_attestation: Verbatim from LL-2026-04 snapshot. Info Security Supplement cross-requirement.
  - id: fnma-ll-2026-04-vendor-ai-governance
    canonical_id: fnma-ll-2026-04-vendor-ai-governance
    section: FNMA LL-2026-04 — govern subcontractor and vendor AI/ML, no less protectively
    description: The seller/servicer must manage risks and apply appropriate governance to subcontractor and vendor use of AI/ML that is no less protective than its own requirements.
    type: do
    audit_question: Does [LENDER] govern its subcontractors and vendors that use AI/ML to a standard no less protective than its own AI/ML requirements?
    program_review: Does the program extend AI/ML governance to subcontractors and vendors at a no-less-protective standard?
    file_review: On vendor files, confirm AI/ML governance terms meet the no-less-protective bar.
    judgment: false
    feeds: []
    workflow_phase: ai_governance
    owner_role: cco
    secondary_owner_role: chief_risk_officer
    cadence: ongoing-program
    consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
    tags:
      - fnma
      - ll-2026-04
      - ai-governance
      - ai-ml
      - model-risk
      - vendor
      - effective-2026-08-06
      - promoted
    primary_source:
      tier: 1
      authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
      source_class: gse-lender-letter
      source_url: https://singlefamily.fanniemae.com/media/45196/display
      snapshot_id: 57b9721f3620063b
      fetched_at: '2026-06-08T00:00:00Z'
      content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
      paragraph_quote: Manage risks and appropriate governance of subcontractor and vendor use of AI/ML that is no less protective of these requirements.
      drafter_attestation: Verbatim from LL-2026-04 snapshot. Vendor/subcontractor AI/ML governance.
  - id: fnma-ll-2026-04-disclosure-on-request
    canonical_id: fnma-ll-2026-04-disclosure-on-request
    section: FNMA LL-2026-04 — disclose AI/ML use to Fannie Mae upon request
    description: Upon request by Fannie Mae, the seller/servicer must promptly disclose the types of AI/ML used, the purpose and manner of use, the safeguards implemented to mitigate risk, and such other information as Fannie Mae may require.
    type: do
    audit_question: Could [LENDER] promptly disclose to Fannie Mae, on request, the types/purpose/manner of its AI/ML use and the safeguards in place?
    program_review: Does the program keep AI/ML use, purpose, and safeguards documented well enough to disclose to Fannie Mae promptly on request?
    file_review: Confirm the program could produce the disclosure (types, purpose, safeguards) on demand.
    judgment: false
    feeds: []
    workflow_phase: ai_governance
    owner_role: cco
    secondary_owner_role: chief_risk_officer
    cadence: ongoing-program
    consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
    tags:
      - fnma
      - ll-2026-04
      - ai-governance
      - ai-ml
      - model-risk
      - vendor
      - effective-2026-08-06
      - promoted
    primary_source:
      tier: 1
      authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
      source_class: gse-lender-letter
      source_url: https://singlefamily.fanniemae.com/media/45196/display
      snapshot_id: 57b9721f3620063b
      fetched_at: '2026-06-08T00:00:00Z'
      content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
      paragraph_quote: Upon request by Fannie Mae, the seller/servicer must promptly disclose the types of AI/ML used, the purpose and manner for such use, the safeguards the seller/servicer has implemented to mitigate risks related to the use of AI/ML, and such other information as Fannie Mae may require.
      drafter_attestation: Verbatim from LL-2026-04 snapshot. Disclosure-on-request obligation.
  - id: fnma-ll-2026-04-compliance-with-law-and-contract
    canonical_id: fnma-ll-2026-04-compliance-with-law-and-contract
    section: FNMA LL-2026-04 — AI/ML use must comply with applicable law and the Lender Contract
    description: To the extent it uses AI/ML in origination or servicing of Fannie Mae loans, the seller/servicer must ensure compliance with applicable laws and the Lender Contract.
    type: do
    audit_question: Does [LENDER] ensure its AI/ML use in Fannie Mae origination/servicing complies with applicable law and the Lender Contract?
    program_review: Does the program ensure AI/ML use complies with applicable law and the Lender Contract?
    file_review: Confirm AI/ML use is assessed against applicable law and the Lender Contract.
    judgment: false
    feeds: []
    workflow_phase: ai_governance
    owner_role: cco
    secondary_owner_role: chief_risk_officer
    cadence: ongoing-program
    consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
    tags:
      - fnma
      - ll-2026-04
      - ai-governance
      - ai-ml
      - model-risk
      - vendor
      - effective-2026-08-06
      - promoted
    primary_source:
      tier: 1
      authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
      source_class: gse-lender-letter
      source_url: https://singlefamily.fanniemae.com/media/45196/display
      snapshot_id: 57b9721f3620063b
      fetched_at: '2026-06-08T00:00:00Z'
      content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
      paragraph_quote: the seller/servicer must ensure compliance with applicable laws and the Lender Contract.
      drafter_attestation: Verbatim from LL-2026-04 snapshot. Baseline law + Lender Contract compliance.

Update kit

Need to act on this regulation? FNMA AI Lender Letter (LL-2026-04) — Survivors Compliance Guide →

Verbatim regulatory text (6)

Verbatim provisions from FNMA Lender Letter LL-2026-04 — Governance framework on use of artificial intelligence and machine learning — each quote is a verified substring of the regulator-published source snapshot, not retyped. Quoted for reference; this is not legal advice. The operational layer (P&P updates, prompts) lives in the regulation update kits.