The FNMA AI Lender Letter compliance kit, run as a Project + Skill

What the FNMA AI Lender Letter (LL-2026-04) requires

Fannie Mae Lender Letter LL-2026-04 requires every seller/servicer to put a governance framework around its use of artificial intelligence and machine learning. In plain terms, you have to document where AI is used, the risk in each use, and how that risk is managed — and be ready to show Fannie Mae your work. It takes effect August 6, 2026.

Specifically, a seller/servicer must:

• Maintain policies and procedures for the development, use, and maintenance of AI/ML, and for measuring and managing its risks.
• Name an owner accountable for the AI governance program, who reviews it at least annually.
• Govern vendor and subcontractor AI to a standard “no less protective” than its own.
• Be able to disclose the types, purpose, and safeguards of its AI to Fannie Mae on request.
• Comply with the Information Security and Business Resiliency Supplement.
• Meet existing law — AI-driven decisioning, pricing, and valuation still have to satisfy ECOA/Reg B, FCRA, and AVM (appraisal) rules.

Operationally, that comes down to three artifacts an examiner expects: an AI system inventory, an AI risk assessment, and an AI governance policy with a named owner — plus updates to every policy and procedure the AI touches. The kit below builds all three, grounded in the verbatim rule so nothing is invented.

Set it up (with the kit)

1. 1 Turn on Code execution & install the Skill

   Settings → Capabilities → turn on Code execution. Then Settings → Customize → Skills → + → Upload a skill → pick fnma-ai-lender-letter-skill.zip → toggle it ON.

   Need to see exactly where these buttons are? Follow the screenshot-by-screenshot guide to installing a Skill.

2. 2 Start a new Project

   Name it FNMA AI Lender Letter. Open a new chat window in the Project and upload roughly 75 pages of policies and procedures (100-page limit per chat). Repeat until all your policies and procedures are uploaded to chats in your FNMA AI Lender Letter Project.

3. 3 Create your AI System Inventory

   In your FNMA AI Lender Letter Project, paste the prompt below into every chat you uploaded your P&Ps into:

   Inventory this batch for the FNMA AI lender letter.

   Running the prompt invokes the Skill, which has the FNMA AI Lender Letter regulatory requirements hard-coded in it. Repeat in a fresh chat for every batch until all are done.

4. 4 Reconcile — fill the gaps

   Step 3 automagically extracts any AI-relevant software, processes, and workflow found in the P&Ps you inventoried — and the Skill can research specific systems and software to understand their AI capabilities. Open a new chat and upload any documents, contracts, or vendor lists you know are applicable to the FNMA AI Lender Letter. Then paste:

   Consolidate the findings from all my inventoried batches into one working list. Then show me the gaps — including the AI the P&Ps can't show (embedded vendor AI, shadow/employee AI, tools added since the P&Ps were written). I'm giving you our vendor inventory, contracts, and app list in the project — cross-reference them, surface any system no P&P showed, and validate the owners. Work through the high-risk gaps with me, then save a reconciled working-inventory.md to the project folder.

5. 5 Let AI help you make your AI Governance Policy

   Open a new chat in the FNMA AI Lender Letter Project, then copy and paste the below:

   Build the master AI System Inventory, Risk Assessment, and AI Governance Policy from working-inventory.md in the project folder. List every open CONFIRM grouped by who I need to ask and what to ask. Save the master policy as a file in the project folder.

6. 6 Push your AI Governance Policy to your P&Ps

   Back in each chat that contains P&Ps → paste:

   Update these P&Ps to match the master AI policy in the project folder.

7. 7 Change log (Appendix A)

   New chat → paste:

   Make the Appendix-A change log for the master AI policy and every P&P we changed.

That’s the whole run: inventory each batch → reconcile (where your vendor list, contracts, and app list go in, and the undocumented AI gets caught) → one synthesis chat → realign each batch → change log. Every output is a working draft for your review — not legal advice.

Setting up the Project: a few rules that make it work

This structure is good general practice for keeping P&Ps current, and it’s especially strong on a job as broad as the FNMA AI letter. A handful of habits keep it clean:

1. If you can, one P&P (or themed batch) per chat. Keep each chat focused so it does a thorough job and emits a clean FINDINGS block. If a single P&P runs over ~100 pages, split it across multiple chats rather than starving the context.
2. Inventory first, in its own chats. Then a separate gap-analysis chat. Finish scanning all batches before you reconcile — the gap analysis needs the whole picture to tell you which systems no policy documented.