Fannie Mae updates its AI and cybersecurity requirements for sellers
For the chief risk officer at a mortgage-selling bank
Supplemental Bulletin 26-01, effective Jan 18, resets Fannie Mae's AI and cybersecurity rules. Every AI reference now reads SI, "super intelligence," and the bulletin says the meaning does not change. The real changes sit underneath. A cyber incident starts a 36-hour clock to tell Fannie Mae the event date, the actions taken and whether operations stopped. Any SI use needs risk assessments, data governance, model training and testing controls, and security monitoring. Vendor compliance becomes your job, without the indemnification Freddie Mac requires. Some paperwork disappears: the annual threat risk assessment, fourth-party contingencies, and formal socializing with leadership. Is the bulletin lighter or heavier, then? Lighter on binders, heavier on proof. A 36-hour clock asks whether your vendor answers the phone on a Saturday.
Our take. Fannie Mae renamed AI "super intelligence" and says nothing changes. The real changes are a 36-hour incident clock and vendor compliance landing on your bank by Jan 18. The gap check should start now.
Action. Cyber incident response: Add a 36-hour Fannie Mae notice with event date, actions taken and operations status to playbooks and vendor contracts.