source:
  type: regulation
  id: fnma-ll-2026-04
  authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of artificial intelligence and machine learning
  description: 'Fannie Mae Lender Letter LL-2026-04, published April 8, 2026, "Effective: 120 days from publication" (≈ August 6, 2026). Requires Fannie Mae seller/servicers using AI/ML in origination or servicing to maintain policies and procedures (transparent, trustworthy/ethical, legally informed, risk-based, owner-reviewed at least annually), comply with the Information Security and Business Resiliency Supplement, govern subcontractor/vendor AI/ML no-less-protectively, and disclose AI/ML use to Fannie Mae on request. The 2-page letter does NOT enumerate "four pillars" or a named "AI inventory with fields" — those are operationalizations.'
obligations:
- id: fnma-ll-2026-04-policies-and-procedures
  canonical_id: fnma-ll-2026-04-policies-and-procedures
  section: FNMA LL-2026-04 — policies & procedures for AI/ML (transparent, trustworthy, legal-aware, risk-managed)
  description: A seller/servicer using AI/ML must have policies and procedures for its development, implementation, use and maintenance, and for measuring and managing AI/ML risks — transparent, trustworthy/ethical, legally informed, and risk-tolerance-based.
  type: do
  audit_question: Does [LENDER] maintain AI/ML policies and procedures covering development, use, maintenance, and risk — transparent, trustworthy/ethical, legally informed, and tied to its risk tolerance?
  workflow_phase: ai_governance
  owner_role: cco
  secondary_owner_role: chief_risk_officer
  cadence: ongoing-program
  consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
  tags:
  - fnma
  - ll-2026-04
  - ai-governance
  - ai-ml
  - model-risk
  - vendor
  - effective-2026-08-06
  - promoted
  primary_source:
    tier: 1
    authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
    source_class: gse-lender-letter
    source_url: https://singlefamily.fanniemae.com/media/45196/display
    snapshot_id: 57b9721f3620063b
    fetched_at: '2026-06-08T00:00:00Z'
    content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
    paragraph_quote: Have policies and procedures regarding the development, implementation, use and maintenance of any AI/ML system it utilizes, and the measuring and managing of AI/ML risks.
    drafter_attestation: Verbatim from LL-2026-04 snapshot. Core policies-and-procedures requirement.
  program_review: Does the AI governance program establish policies & procedures for AI/ML use that are transparent, trustworthy/ethical, legally informed, and risk-based?
  file_review: N/A (program-level requirement) — confirm the policy document exists and meets the four characteristics.
  judgment: false
- id: fnma-ll-2026-04-owner-annual-review
  canonical_id: fnma-ll-2026-04-owner-annual-review
  section: FNMA LL-2026-04 — named owner reviews the AI/ML policies at least annually
  description: The AI/ML policies and procedures must have an owner who implements, maintains, and reviews them at least annually to ensure compliance with applicable law and consistency with industry best practices.
  type: do
  audit_question: Has [LENDER] named an owner for its AI/ML policies who reviews them at least annually for legal compliance and best-practice alignment?
  workflow_phase: ai_governance
  owner_role: cco
  secondary_owner_role: chief_risk_officer
  cadence: ongoing-program
  consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
  tags:
  - fnma
  - ll-2026-04
  - ai-governance
  - ai-ml
  - model-risk
  - vendor
  - effective-2026-08-06
  - promoted
  primary_source:
    tier: 1
    authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
    source_class: gse-lender-letter
    source_url: https://singlefamily.fanniemae.com/media/45196/display
    snapshot_id: 57b9721f3620063b
    fetched_at: '2026-06-08T00:00:00Z'
    content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
    paragraph_quote: have an owner(s) that implements, maintains and reviews the policies and procedures at least annually to ensure they comply with applicable law and consistently reflects industry best practices.
    drafter_attestation: Verbatim from LL-2026-04 snapshot. Owner + annual-review requirement.
  program_review: Does the program assign an owner who reviews the AI/ML policies at least annually?
  file_review: Confirm the named owner and evidence of the most recent annual review.
  judgment: false
- id: fnma-ll-2026-04-info-security-supplement
  canonical_id: fnma-ll-2026-04-info-security-supplement
  section: FNMA LL-2026-04 — comply with the Information Security and Business Resiliency Supplement
  description: The seller/servicer must comply with the requirements in the Fannie Mae Information Security and Business Resiliency Supplement.
  type: do
  audit_question: Does [LENDER] comply with the Fannie Mae Information Security and Business Resiliency Supplement for its AI/ML use?
  workflow_phase: ai_governance
  owner_role: cco
  secondary_owner_role: chief_risk_officer
  cadence: ongoing-program
  consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
  tags:
  - fnma
  - ll-2026-04
  - ai-governance
  - ai-ml
  - model-risk
  - vendor
  - effective-2026-08-06
  - promoted
  primary_source:
    tier: 1
    authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
    source_class: gse-lender-letter
    source_url: https://singlefamily.fanniemae.com/media/45196/display
    snapshot_id: 57b9721f3620063b
    fetched_at: '2026-06-08T00:00:00Z'
    content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
    paragraph_quote: Comply with the requirements in the Fannie Mae Information Security and Business Resiliency Supplement
    drafter_attestation: Verbatim from LL-2026-04 snapshot. Info Security Supplement cross-requirement.
  program_review: Does the program incorporate the Information Security and Business Resiliency Supplement requirements?
  file_review: Confirm Info Security & Business Resiliency Supplement compliance is mapped into the AI program.
  judgment: false
- id: fnma-ll-2026-04-vendor-ai-governance
  canonical_id: fnma-ll-2026-04-vendor-ai-governance
  section: FNMA LL-2026-04 — govern subcontractor and vendor AI/ML, no less protectively
  description: The seller/servicer must manage risks and apply appropriate governance to subcontractor and vendor use of AI/ML that is no less protective than its own requirements.
  type: do
  audit_question: Does [LENDER] govern its subcontractors and vendors that use AI/ML to a standard no less protective than its own AI/ML requirements?
  workflow_phase: ai_governance
  owner_role: cco
  secondary_owner_role: chief_risk_officer
  cadence: ongoing-program
  consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
  tags:
  - fnma
  - ll-2026-04
  - ai-governance
  - ai-ml
  - model-risk
  - vendor
  - effective-2026-08-06
  - promoted
  primary_source:
    tier: 1
    authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
    source_class: gse-lender-letter
    source_url: https://singlefamily.fanniemae.com/media/45196/display
    snapshot_id: 57b9721f3620063b
    fetched_at: '2026-06-08T00:00:00Z'
    content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
    paragraph_quote: Manage risks and appropriate governance of subcontractor and vendor use of AI/ML that is no less protective of these requirements.
    drafter_attestation: Verbatim from LL-2026-04 snapshot. Vendor/subcontractor AI/ML governance.
  program_review: Does the program extend AI/ML governance to subcontractors and vendors at a no-less-protective standard?
  file_review: On vendor files, confirm AI/ML governance terms meet the no-less-protective bar.
  judgment: false
- id: fnma-ll-2026-04-disclosure-on-request
  canonical_id: fnma-ll-2026-04-disclosure-on-request
  section: FNMA LL-2026-04 — disclose AI/ML use to Fannie Mae upon request
  description: Upon request by Fannie Mae, the seller/servicer must promptly disclose the types of AI/ML used, the purpose and manner of use, the safeguards implemented to mitigate risk, and such other information as Fannie Mae may require.
  type: do
  audit_question: Could [LENDER] promptly disclose to Fannie Mae, on request, the types/purpose/manner of its AI/ML use and the safeguards in place?
  workflow_phase: ai_governance
  owner_role: cco
  secondary_owner_role: chief_risk_officer
  cadence: ongoing-program
  consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
  tags:
  - fnma
  - ll-2026-04
  - ai-governance
  - ai-ml
  - model-risk
  - vendor
  - effective-2026-08-06
  - promoted
  primary_source:
    tier: 1
    authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
    source_class: gse-lender-letter
    source_url: https://singlefamily.fanniemae.com/media/45196/display
    snapshot_id: 57b9721f3620063b
    fetched_at: '2026-06-08T00:00:00Z'
    content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
    paragraph_quote: Upon request by Fannie Mae, the seller/servicer must promptly disclose the types of AI/ML used, the purpose and manner for such use, the safeguards the seller/servicer has implemented to mitigate risks related to the use of AI/ML, and such other information as Fannie Mae may require.
    drafter_attestation: Verbatim from LL-2026-04 snapshot. Disclosure-on-request obligation.
  program_review: Does the program keep AI/ML use, purpose, and safeguards documented well enough to disclose to Fannie Mae promptly on request?
  file_review: Confirm the program could produce the disclosure (types, purpose, safeguards) on demand.
  judgment: false
- id: fnma-ll-2026-04-compliance-with-law-and-contract
  canonical_id: fnma-ll-2026-04-compliance-with-law-and-contract
  section: FNMA LL-2026-04 — AI/ML use must comply with applicable law and the Lender Contract
  description: To the extent it uses AI/ML in origination or servicing of Fannie Mae loans, the seller/servicer must ensure compliance with applicable laws and the Lender Contract.
  type: do
  audit_question: Does [LENDER] ensure its AI/ML use in Fannie Mae origination/servicing complies with applicable law and the Lender Contract?
  workflow_phase: ai_governance
  owner_role: cco
  secondary_owner_role: chief_risk_officer
  cadence: ongoing-program
  consequence: Non-compliant AI/ML governance breaches the Lender Contract; Fannie Mae may require disclosure and take action against the seller/servicer.
  tags:
  - fnma
  - ll-2026-04
  - ai-governance
  - ai-ml
  - model-risk
  - vendor
  - effective-2026-08-06
  - promoted
  primary_source:
    tier: 1
    authority: FNMA Lender Letter LL-2026-04 — Governance framework on use of AI/ML (April 8, 2026)
    source_class: gse-lender-letter
    source_url: https://singlefamily.fanniemae.com/media/45196/display
    snapshot_id: 57b9721f3620063b
    fetched_at: '2026-06-08T00:00:00Z'
    content_hash: sha256:placeholder-snapshot-content-hash-from-source-json
    paragraph_quote: the seller/servicer must ensure compliance with applicable laws and the Lender Contract.
    drafter_attestation: Verbatim from LL-2026-04 snapshot. Baseline law + Lender Contract compliance.
  program_review: Does the program ensure AI/ML use complies with applicable law and the Lender Contract?
  file_review: Confirm AI/ML use is assessed against applicable law and the Lender Contract.
  judgment: false
