What changed

Fannie Mae published Lender Letter LL-2026-04, setting a governance framework for Seller/Servicers’ use of artificial intelligence and machine learning in origination and servicing.

The useful read is not that AI is prohibited. The signal is that AI/ML in mortgage workflows should be managed as an operational control environment, not as informal experimentation once it touches live lending work.

For compliance, operations, underwriting, servicing, and technology leaders, the practical question becomes: can the organization show what AI/ML is being used, who owns it, what use is approved, how it is reviewed, how vendors are controlled, where humans remain in the process, and what evidence exists for monitoring and audit?

The operational hinge

AI often enters mortgage operations through specific workflow improvements: income review, document classification, borrower communication, lead prioritization, or servicing workflows. Those uses may look narrow at launch, but they can become embedded in decision paths, queue management, communications, or review processes.

That is the governance hinge. A tool that supports origination or servicing should not sit outside the inventory merely because it is vendor-provided, workflow-specific, or described as automation rather than a “model.” The desk view is to treat AI/ML use as a controlled operating asset when it influences work performed in the lending or servicing process.

Teams should be ready to evidence model or tool inventory, approved use, owner assignment, risk review, human oversight, vendor documentation, change-management records, testing or validation evidence, complaint and fair-lending monitoring, exception paths, and audit support.

A practical control checklist

1. Build the AI/ML inventory

Start with a single inventory of AI/ML tools used in origination and servicing. Include internally built tools and vendor-provided capabilities. The inventory should be specific enough to identify the workflow, the business owner, the technology owner, and whether the use is approved for live operations.

The control question is simple: if compliance or audit asks where AI/ML is being used, can the team answer without relying on informal knowledge?

2. Maintain an approved-use register

For each tool, document the approved use. A tool used for document classification should not quietly expand into income review or borrower communication without a change record and review path.

The approved-use register should help business teams distinguish between tested use, pilot use, and unsupported use. It also gives managers a practical way to spot drift between the original purpose and actual operating behavior.

3. Assign clear ownership

Each tool needs accountable ownership. At minimum, teams should know who owns the business process, who owns the technology implementation, and who is responsible for compliance coordination.

Ownership matters because AI controls are not self-executing. Someone must be responsible for review, escalation, monitoring, vendor follow-up, and evidence retention.

4. Require risk review before live embedding

Before an AI/ML tool becomes part of live origination or servicing work, require a documented risk review. That review should address how the tool will be used, where it affects workflow outcomes, what human review is required, what exceptions look like, and what monitoring will occur after deployment.

This is especially important for tools used around income review, document handling, borrower communication, lead prioritization, or servicing workflows, because those processes can affect operational consistency and customer-facing activity.

5. Keep human-review checkpoints visible

Human oversight should not be implied. It should be mapped.

For each AI-supported workflow, identify where a person reviews the output, when a person may override it, and how exceptions are handled. If the tool is used to classify, prioritize, summarize, or route work, the checkpoint should be visible to the people operating the process.

6. Control vendor-provided AI

Vendor involvement does not remove the need for internal governance. If a vendor product uses AI/ML in an origination or servicing workflow, the Seller/Servicer still needs documentation sufficient to understand the use, the control expectations, and the change-management path.

Contract and vendor-management reviews should ask whether the vendor documentation supports the institution’s inventory, approved-use register, testing or validation evidence, monitoring, and audit needs.

7. Preserve testing, validation, and change records

A governance framework is only as useful as the evidence behind it. Keep records of testing, validation, approvals, and changes. If the tool changes, or if its use changes, the record should show what changed and who reviewed it.

This is the difference between saying a tool is controlled and being able to demonstrate that it is controlled.

8. Monitor complaints, fair-lending signals, and exceptions

Post-deployment monitoring should include operational exceptions, borrower complaints, and fair-lending-related signals where relevant to the use case. The point is not to assume every AI tool creates the same risk. The point is to connect monitoring to the workflow the tool actually supports.

If monitoring identifies a concern, the team should know the escalation path and how the issue will be documented.

Review questions for current AI use

For teams already using AI/ML in mortgage workflows, the immediate review can be framed around these questions:

  • Which origination or servicing workflows currently use AI/ML?
  • Is each tool in the model or tool inventory?
  • Is the approved use documented?
  • Who owns the business process and the control evidence?
  • What vendor documentation supports the use?
  • What testing or validation evidence exists?
  • Where are human-review checkpoints built into the workflow?
  • How are changes reviewed and recorded?
  • How are complaints, fair-lending signals, and exceptions monitored?
  • Can audit or compliance reconstruct the decision to approve and continue using the tool?

Caveat

This note is based on a Fannie Mae Single-Family lender letter and related source description. It is an agency-specific governance signal for Seller/Servicers, not a prediction about enforcement outcomes and not a complete implementation manual for every AI use case.