Freddie Mac Deadline: March 3, 2026 – AI Governance Framework

YOUR COMPLIANCE QUESTION 

We are using your AI Policy Program. Upon receipt, we had it reviewed by our AI committee to determine whether it complies with Freddie's requirements for establishing a comprehensive AI governance framework for AI and Machine Learning. 

I am pleased to report that your AI Policy Program received the committee's approval. It met our checklist based on Freddie's requirements. 

As a Freddie Mac Seller/Servicer, we want to know what the effect would be on us if we had relationship partners that are not in compliance with the AI governance framework.   

What restrictions will Freddie Mac impose on us if our relationship partners do not comply with their AI requirements as of March 3, 2026? 

Signed,

An Anxious Compliance Manager 

OUR COMPLIANCE SOLUTION 

AI POLICY PROGRAM FOR MORTGAGE BANKING™ 

Our AI Policy Program aligns with Freddie Mac's AI governance requirements for the Freddie Mac Seller/Servicer (or "Lender"). Our well-constructed AI Policy Program is a proactive means designed to avoid and mitigate risks associated with Artificial Intelligence and Machine Learning. Responsible AI practices can help align AI system design, development, and use with applicable legal and regulatory guidelines. 

Our AI Policy Program consists of the following policies: 

1.      Artificial Intelligence Governance Policy

2.      Artificial Intelligence Use Policy

3.      Artificial Intelligence Workplace Policy

4.      Artificial Intelligence Credit Underwriting Policy

5.      Artificial Intelligence Do & Do Not Policy

6.      Artificial Intelligence Ethics Policy

7.      Artificial Intelligence Vendor Management Policy 

Discount offer available until March 3, 2026! 

Contact us for the presentation and pricing. 

OUR RESPONSE TO YOUR QUESTION 

Thank you for using our AI Policy Program. Since its release on October 30, 2025, it has been in considerable demand. 

Our AI Policy Program for Mortgage Banking™, which meets Freddie Mac's AI Governance Framework ("AI Framework"), is the first to provide a set of AI policies dedicated to mortgage banking. 

We had been tracking the GSE formulation of AI requirements for several months. 

On March 11, 2025, Freddie released a formal AI/ML governance framework in its Seller/Servicer Guide ("Guide"), introducing a comprehensive AI Framework for Sellers and Servicers that requires formal policies for the use of artificial intelligence ("AI") and machine learning ("ML"). This update mandated that any AI/ML used in the origination or servicing of Freddie Mac-eligible loans be governed by strict policies. 

On December 3, 2025, Bulletin 2025-16 was issued, clarifying timelines and expectations and stating that AI is no longer optional. In effect, Freddie asserted that implementation is a mission-critical, governed enterprise function. 

The compliance effective date is March 3, 2026. 

After considerable review, research, and drafting, we issued our AI Policy Program on October 30, 2025, thirty-four days before Freddie issued Bulletin 2025-16 on December 3, 2025, and Bulletin 2025-17 issued on December 10, 2025. 

On December 10, 2025, Freddie issued Bulletin 2025-17, which introduced revisions to AI Tools relating to servicing, information security, and Seller/Servicer insurance, with most changes effective on March 3, 2026. 

In the context of the AI Framework, "AI Tools" are any artificial intelligence or machine learning tools used in the loan lifecycle. 

BULLETINS 

Bulletin 2025-16 solidifies the compliance effective date of March 3, 2026, requires Lenders to have a comprehensive governance framework for AI/ML Tools used in loan origination or servicing, and, effective January 1, 2026, Lenders must ensure executive oversight, document AI use cases, ensure fairness, mitigate bias, and manage vendor risk.

Quality Control Challenges – Defect Rates and Trendlines

QUESTION 

During a MORA review, Fannie determined that several areas were problematic. We thought we were mostly ready until we got the MORA results. Fannie required us to revise a list of issues. 

It was too late for us to use your Fannie Tune-up. So we mustered through as best as we could. One area that the MORA team criticized us for was that we did not establish a "methodology for identifying, categorizing, and measuring defects and trends against an established target defect rate." 

They found our Quality Control Plan was defective, and we could not show that we followed a methodology to uncover defects and trends. Our QC Manager discussed this with our QC auditor, but they became defensive. They did not want to update their Quality Control Plan or provide their procedures for Fannie to evaluate. So, on top of everything else, we need to get another QC auditor. 

We need your help in understanding some basics about defects and trendlines. 

What methodology is used for "identifying, categorizing, and measuring defects and trends against an established target defect rate?" 

ANSWER 

It's unfortunate that you did not contact us soon enough for the Fannie Tune-up. It takes 60 days to complete, and it is inexpensive. Most clients use the Fannie Tune-up to comply with Fannie guidelines and stay ready or get ready for a Mortgage Origination Risk Assessment (MORA) visit. 

_____________________________________________ 

Anyone interested in the Fannie Tune-up can request information here. 

_____________________________________________ 

I thought it would be a good idea for you to get some feedback from Brandy George, the Executive Director of LCG Quality Control. 

There are few professionals in mortgage banking with Brandy's credentials and depth of experience. Her group audits small and large loan production into the thousands of units. Importantly, Brandy works hands-on with clients to ensure their quality control meets Fannie's guidelines. So, I asked her to join me in answering your question. 

_____________________________________________

 Brandy also offers a free Quality Control Plan (terms apply)

that meets GSE and regulatory scrutiny. 

If anyone wants to talk to Brandy about their Quality Control needs,

you can contact her here. 

_____________________________________________ 

I asked Brandy to give a brief but useful answer to your question. The following outline is reflective of my notes from my conversation with her. 

Brandy confirmed that a financial institution must have a set of policies and procedures documented in its Quality Control Plan, establishing a target defect rate and the methodology for "identifying, categorizing, and measuring defects and trends" against that rate. 

According to Brandy, 

the target defect rate is the final net defect rate your firm has established as an acceptable percentage rate of open defects in any given audit period and the year-to-date percentage rate of open defects. 

That led to our discussion about calculating the defect rate. I like Brandy's response: 

Calculating and tracking the actual defect rate against your target defect rate is how you assess your credit and financial risk performance and measure progress in meeting your quality control goals. Managing gross and net defect rates is critical to understanding the financial exposure revealed during the QC process. 

The gross defect rate is calculated by dividing the number of all defects noted by the number of loans reviewed in the audit period, and the final net defect rate is calculated by dividing the number of open defects by the number of loans reviewed in the audit period. 

To provide a granular description that brings in threat levels, having a target defect rate is required for the top severity level – which, by the way, is ineligible for delivery to Fannie Mae – and enables the lender to regularly evaluate and measure progress in meeting its loan quality standards. 

The lender must define lower severity levels as appropriate for its organization, and different target defect rates may be established for different severity levels (if applicable). Note that the target defect rate is a Fannie Mae requirement!

With respect to calculating the target defect rate, I would like to add my observation to Brandy's guidance. Calculating a defect rate is how you measure against your target defect rate. Some lenders use only a gross or a net calculation when determining their monthly defect rate, while others use both. 

• The gross defect rate is the defect rate based on the initial findings prior to any rebuttal activity. 

• The net defect rate is the defect rate based on the final findings after the rebuttal activity. 

Understanding the root cause of the issues resolved during the rebuttal process may provide insight into how the defects can be prevented. 

Concerning the severity level, if a loan has both the highest-severity level defect and a lower-severity level defect, Fannie directs that the lender should only count the loan once – in the highest-severity category – in a defect rate calculation. Calculations should be done for your two most severe defect types (i.e., Significant and Moderate). 

My conversation with Brandy concluded with discussing the methodology for identifying defects and trendlines. Her insight here is helpful. She said: 

The methodology for identifying defects and trends lies within the audit process. How loan defects are identified and categorized leads to the final reporting results. Meaning, exceptions and defects need to be categorized in such a way that puts the defects in risk rating categories, such as Minor, Moderate, and Significant, compliance and regulatory, or by area of responsibility, such as Loan Officer, Processor, Underwriter, or Closer.  

Categorizing into risk rating categories is essential to the mission of the quality control project. Once initial (gross) defects are cured, it is important to determine root causes, analyze issues, and reconcile the difference between your gross and net defects and action plan accordingly. Be sure to analyze the cause between the gross and net defect rates! The goal is to identify and remediate the issues to narrow the gap between gross and net defect rates. 

A final word about targets and defect rates. An effective way to establish loan quality targets is to model the financial exposure created at a certain defect level. The concept of "zero defects" generally will be considered challenging to achieve. And, in any event, Fannie Mae does not evaluate lenders by a zero-defect-rate standard. 

Fannie Mae expects lenders to set defect rate targets as reasonably low as possible based on a formal cost-benefit analysis of meeting that target. The MORA team expects lenders to demonstrate to Fannie how they manage loan quality to meet their established target. 

_____________________________________________ 

Brandy also offers a free Quality Control Plan (terms apply)

that meets GSE and regulatory scrutiny. 

If anyone wants to talk to Brandy about their Quality Control needs,

you can contact her here. 

_____________________________________________ 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group