The AI You Cannot See Is Still Your Problem

In 2019, the year before RE/MAX acquired us, a wholesale lender sent Wemlo a vendor questionnaire. I remember it because it was thorough. Information security, business continuity, data handling, breach notification, subcontractors, insurance. We were processing loans for hundreds of brokerages at that point, sitting directly inside other people’s workflows, and the diligence reflected that.

Not one question asked what our software was actually doing with the data. Nobody thought to ask, because the question did not exist yet.

Fannie Mae’s new lender letter is the moment that changes.

Most of the discussion of the letter so far has focused on internal obligations, such as policies governing AI and machine learning, assigned ownership, annual review of controls. That is the obvious reading, and plenty of shops are behind on it.

The harder requirement involves vendors. Fannie says lenders must govern third-party AI use to a standard no less protective than the one applied internally, and must promptly explain, on request, what AI is in use, how, and with what safeguards.

Anyone who has run mortgage operations should see the problem. A lender cannot answer that on its own.

What I learned sitting inside other people’s workflows

I have spent more than 25 years in this business, and one lesson has followed me the whole way: how a loan actually moves rarely matches the process drawn on a whiteboard.

At Wemlo, we worked inside the processing function across hundreds of brokerages, and the variation was remarkable. Two brokers could run the same LOS and submit to the same wholesale lender, and their real workflows would look nothing alike. One kept everything inside approved systems. Another ran on spreadsheets, email templates and small tools picked up over the years. No single choice looked significant. Together they determined how borrower information moved and who could reach it.

That was the visibility problem before AI, and AI makes it worse, because the technology no longer announces itself. A product bought for one purpose acquires AI through a routine update. The vendor calls it automation. The user sees a faster result and has no reason to ask what changed.

So a broker may not think of itself as an AI user at all. Its CRM scores leads with machine learning, but the broker sees a CRM feature. Its phone system summarizes calls, but that reads as transcription. What the broker believes about its own AI use is beside the point, because the obligation to govern and explain that activity may land on the wholesale lender either way.

A vendor list is not an answer

If Fannie asks a lender what AI is being used in its origination operation, a roster of approved vendors will not be enough. The lender has to know what those products are doing. Is a system moving information between fields, or interpreting it? Does borrower data stay inside the vendor’s environment, or reach an outside model?

Those differences matter. A tool that drafts meeting notes is not the same thing as one reviewing income documentation. Lenders are going to need some practical way to distinguish between them. Treating every feature with AI in it as the same risk is not going to work.

The old vendor review will not carry this. A vendor can have excellent cybersecurity and offer almost no transparency into its models. If part of the technology comes from a subcontractor, the vendor itself may have limited visibility. None of that eliminates the lender’s obligation to govern the risk.

I have been on the other side of serious diligence. When RE/MAX acquired Wemlo, a public company went through exactly how our technology touched borrower data, and the questions were harder than anything on a standard vendor form. Most lenders’ vendor reviews were not built for this, and until now there was no reason they should have been.

The wholesale channel is next

Brokers are not subject to the letter the way Fannie Mae seller/servicers are. Wholesale lenders are, and the mechanism available to them is the TPO agreement.

I expect AI provisions to start appearing there over the next few quarters. Disclose AI tools used in origination. Do not place borrower information into unapproved products. Potentially certify what technology is being used and where.

I’ve watched versions of this happen before with quality control. The lender owned the obligation, but it couldn’t satisfy that obligation without getting more visibility into what was happening upstream. Over time, that meant more requirements for brokers, more documentation, more oversight and more representations about how loans were being originated. AI governance is different technology, but I think the path will be familiar. If the lender has to answer for it, eventually the lender is going to ask the broker to answer for it too.

The first round of disclosures will show how hard this is. At Wemlo, I learned that brokers are exceptionally resourceful. When a process slowed a loan down, somebody found a way around it. That instinct is part of what makes good originators good. It also means technology enters a workflow without passing through review.

So, when the checkbox arrives, most brokers will check it honestly and still be wrong.

They will be thinking about ChatGPT. They will not be thinking about the CRM. Which is why wholesale lenders should resist solving this with a broad certification asking brokers to disclose all AI. It looks protective, but what comes back will be a set of answers that aren’t comparable to each other. Brokers need practical definitions: which tools require approval, which uses are prohibited, and language reflecting how loans actually get originated.

In the end, the question is pretty simple. Can a lender identify where AI is being used in the workflows it is responsible for, and explain what that technology is doing?

Right now, I suspect many of them cannot.

Fannie is not only asking lenders to govern the AI they can see. It is making them responsible for finding the AI they cannot.

David Rogove is founder and CEO of Maestro Tech Inc (https://maestrotech.ai). He previously founded Wemlo, acquired by RE/MAX Holdings in 2020.