Build your AI vendor file.
Fannie Mae and Freddie Mac set AI governance requirements for their lenders, including oversight of vendors. Use the source links and Cal's documented safeguards to support your review. Your team owns the governance program and every lending decision.
Three steps for your file
- Record how your team uses Cal. Include the research, pricing, workflow and communication features you enable, the data they receive and the people responsible for review.
- Keep a person on every lending decision. Cal's research and calculations are not an approval, denial, rate commitment or AUS finding. Check the cited source and review any workflow or communication you authorize.
- Request the current vendor evidence. Review its scope, open items and approval status with your compliance team before relying on it. Ask for the packet.
What the agencies require
- Freddie Mac, in force since March 3, 2026. Guide Section 1302.8, from Bulletin 2025-16, sets an AI and machine learning governance framework: approved policies with an owner and annual review, threat assessment, monitoring for performance, security and bias, audits, and segregation of duties. Section 1302.2 adds AI threat training, AI incident playbooks and written agreements with vendors that touch Freddie Mac data.
- Fannie Mae, in force January 18, 2027. Section 4 of the Information Security and Business Resiliency Supplement, from Supplement Bulletin 26-01, calls for a formal governance program with a use-case inventory, testing and validation, continual monitoring and retirement, change controls, data protection, third-party oversight, and safeguards against prompt injection and data leakage. Fannie calls the technology "Super Intelligence" and says the new term does not change the scope. It replaces Lender Letter LL-2026-04.
- Vendors count. Include third-party tools in your review. Ask which controls are operating, which are still being prepared and what evidence supports each claim.
What to review with Cal
AI use and providers
Review the features your team enables, their model providers and the data each processes. Provider disclosures are on the privacy page.
Testing and monitoring
Cal runs guideline evaluations and service health checks. See the dated results on the scoreboard; a test score does not guarantee a correct answer on your file.
Change control
Code changes use pull requests and automated checks. The API deployment process retains a rollback image. Ask for the test and release evidence relevant to your use case.
Sources and revisions
Check the cited section, document date and lender overlay before relying on a research answer. Library review and edition-retirement tools support that process; the source remains the authority.
Transparency
Our product limits are on what Cal will not do, and recorded corrections are on what Cal got wrong.
Data protection
Review access controls, the data you submit, provider terms and retention requirements for each workflow. Do not treat a safeguard in one feature as a guarantee for every data path.
Still in progress
Request current evidence for these items before completing your vendor review.
- A signed AI and security addendum for lenders.
- An independent penetration test and a SOC 2 or ISO 27001 report.
- Recorded data-use and retention terms with each AI provider.
- Operational verification of encrypted document storage, restore procedures and the approved retention schedule before document workflows are activated.
Questions from an examiner or investor
If Fannie Mae, Freddie Mac or an investor asks about your use of Cal, send the request to chris@askcal.io and we will help you answer it.
This page explains how Cal fits the agency requirements. It is not legal advice, and your company's own governance program remains yours. Ask Cal about any guideline and check the citation it gives you.