AI Is Already Inside Your Mortgage Company. The Question Is Whether You Can Govern It.

AI Is Already Inside Your Mortgage Company. The Question Is Whether You Can Govern It.

Artificial intelligence is no longer a future consideration for mortgage lenders. It is already operating throughout the mortgage ecosystem.

AI can be found in loan origination systems, point-of-sale platforms, pricing engines, fraud tools, income and asset verification, automated valuation models, document extraction, marketing, lead generation, chat and voice systems, servicing workflows, recruiting platforms, employee copilots and cloud services. Some of these capabilities were deliberately selected and approved. Others were quietly added through a software update, embedded inside a familiar platform or introduced through a vendor’s platform.

Then there is shadow AI: tools employees are using without the company’s knowledge or approval.

That reality changes the first question every mortgage company should be asking. It is no longer, “Do we plan to use AI?” It is, “Where is AI already operating, what does it touch and how are we governing it?”

I discussed these issues on a recent episode of MISMO MIC’D UP  with James Brody and Ron Gapp, partners at Brody Gapp LLP. Their message to lenders was direct: there is no practical way to pause AI adoption. Loan officers, employees, vendors and technology platforms are already using it. The responsible response is not to avoid AI. It is to identify it, understand it and build the governance structure necessary to use it safely.

AI Governance Is Now a Lender Responsibility

AI governance can sound like a technology issue. It is actually an enterprise risk issue.

Existing mortgage and consumer protection laws do not disappear when a process is supported by AI. Fair lending requirements, adverse action obligations, privacy rules, servicing standards, information security expectations and prohibitions against unfair or deceptive practices still apply.

The Mortgage Bankers Association’s recent white paper, Examining AI-Powered Mortgage Through the Lens of Federal Law, identifies fair lending and bias, explainability, steering, data privacy and security, and third-party vendor management as central areas of AI risk. It recommends that lenders maintain human accountability, assess individual AI models and use cases, implement appropriate testing and prepare for evolving regulatory expectations.

The GSEs have also changed the conversation.

Freddie Mac’s AI and machine learning requirements became effective March 3, 2026. They require seller-servicers using AI or machine learning in connection with Freddie Mac origination or servicing to maintain governance policies approved by senior management, assign ownership, communicate responsibilities to appropriate personnel and promptly disclose relevant AI uses and safeguards upon request. (Freddie Mac Guide)

Fannie Mae’s Lender Letter LL-2026-04 establishes a governance framework for seller-servicers using AI or machine learning in origination or servicing, with an effective date 120 days after its April 8 publication. (Fannie Mae Single-Family)

The essential point is simple: even when a lender does not own the model, the lender still owns the outcome.

A lender cannot outsource accountability by purchasing technology from a vendor. If an AI-enabled system influences credit, pricing, valuation, adverse action, servicing, borrower communications or the handling of consumer data, the lender must understand how that system operates and how the associated risks are controlled.

You Cannot Govern What You Cannot See

The first step in AI governance is not writing a 100-page policy. It is building an inventory.

Brody Gapp’s recently released AI Vendor Due Diligence – Phase One Letter gives lenders a practical method for beginning that process. The letter asks vendors to disclose active, optional, disabled, beta, planned, embedded and subprocessor-provided AI capabilities. It also asks what those capabilities do, what data they touch, whether they influence consumer or lending decisions and what evidence exists regarding testing, security, human oversight and change management.

That level of inquiry matters because a familiar product can change its risk profile without a lender entering into a new contract. A vendor may change models, activate a new feature or replace a subprocessor through a routine software release.

Brody Gapp’s operating principle is a good one: a vendor’s response is not the end of diligence. It is the first controlled record in the lender’s AI governance file.

That file should eventually document the vendor and product, the internal business owner, the actual use case, the data involved, the system’s role in decisions, the risk tier, the supporting evidence and the next review date. Higher-risk systems require deeper diligence, testing, contractual protections and ongoing monitoring.

A statement that a product is “compliant,” “widely used,” “SOC 2 certified” or “approved by the GSEs” is not a universal safe harbor. Each statement answers only a narrow question. A security audit, for example, does not establish that an AI system is free from bias, capable of producing accurate adverse action reasons or subject to effective model-change controls.

FRAME Gives Mortgage Companies a Practical Starting Point

MISMO created FRAME, the Framework for Responsible AI in Mortgage Ecosystems, to solve the question many lenders are now asking: Where do we start?

FRAME is a mortgage-specific toolkit designed to help organizations identify AI, assign accountability, assess risk and establish repeatable governance processes. It incorporates principles from broader frameworks such as the NIST AI Risk Management Framework, but translates them into practical mortgage use cases and workflows.

The core FRAME process is straightforward:

Find. Inventory. Tier. Assess. Monitor. Update.

First, identify where AI is being used. Next, document each system and use case in the inventory. Assign ownership and classify the risk based on factors such as consumer impact, regulatory exposure, data access and decision-making authority. Conduct deeper assessments for the most consequential use cases. Then monitor performance, changes and emerging risks over time.

This risk-based approach is important because not every AI system should be governed the same way. An internal drafting assistant that does not receive consumer information presents a different risk than an underwriting model, pricing engine, fraud tool, valuation system or borrower-facing voice agent.

FRAME is also intentionally scalable. A smaller independent mortgage banker should not need a massive risk department to begin governing AI. The goal is progress, visibility and defensibility, not instant perfection.

The MISMO AI Governance Workshop

On August 24, MISMO will host an intensive AI Governance Workshop during the MISMO Fall Summit in Reston, Virginia. The Summit runs August 24 through August 27 and includes workgroups, workshops and industry programming throughout the week. 

More than 100 mortgage professionals are already registered for the workshop, reflecting just how quickly AI governance has moved from a niche concern to an industry priority.

This will not be a four-hour lecture with attendees watching slides and nodding politely. PowerPoint alone has never governed anything.

Participants will receive hands-on training using FRAME and will work directly through the foundational activities required to begin an AI governance program.

Attendees will learn how to identify AI use cases across the mortgage lifecycle, including less obvious or shadow uses. They will begin constructing an AI inventory that documents where systems operate, who owns them, what data they use and whether they influence decisions or communications.

Participants will then complete risk assessments for selected use cases. That process will examine factors such as consumer impact, fair lending exposure, explainability, privacy, security, human oversight, vendor dependencies and the potential consequences of system failure.

The objective is for attendees to leave with more than awareness. They should leave with experience, practical tools and a clearer implementation path for their own organizations.

Because MISMO believes this training should be accessible to lenders of every size and business model, the workshop is available through a special one-day Summit registration price of $199. Use the code FRAME when registering.

Building the People and Vendor Ecosystem

FRAME is only one part of MISMO’s broader AI governance strategy.

MISMO will soon launch an AI Practitioner Certification for companies responsible for implementing AI governance inside mortgage organizations. The certification will help establish a common level of knowledge around use-case identification, inventory management, risk assessment, governance responsibilities and the application of FRAME.

MISMO is also preparing a Vendor AI Certification for mortgage technology providers and service partners. The certification is intended to give lenders greater confidence that a vendor has established appropriate AI governance practices, including controls around consumer data, oversight, documentation, monitoring and change management.

Neither certification will eliminate a lender’s responsibility to conduct its own diligence. That would be a bridge too far. The goal is to create stronger, more consistent evidence and a common industry baseline that makes vendor review more effective and less duplicative.

Both certifications will initially be available exclusively to MISMO members.

Start Before Someone Asks

The biggest mistake a lender can make today is assuming there is still plenty of time.

You do not need to become an AI expert overnight. You do need to know where AI exists inside your organization, who owns each use case, what risks are present and what evidence supports your oversight.

As James Brody and Ron Gapp emphasized during our conversation, regulators, investors and GSEs may recognize that the industry is still learning. They are far less likely to be sympathetic to an organization that has done nothing.

The best time to begin building the file was before AI entered your company.

The second-best time is now.

#VieauxPoint