Fannie Mae Adds AI Governance and 36-Hour Cyber Notice to Security Supplement
Lenders must now report cyber incidents within 36 hours and fold AI-risk oversight into their compliance regimes under Fannie Mae's updated supplement.
Fannie Mae's latest Information Security and Business Resiliency Supplement, effective January 18, 2027, expands the government-sponsored enterprise's cybersecurity framework to include a new "Super Intelligence" governance section, a term that in practice refers to emerging AI and advanced analytics technologies that can influence mortgage-service workflows. The update also introduces a 36-hour cyber-incident notice requirement, obliging mortgage originators, servicers, and related lenders to notify Fannie Mae of any incident that potentially compromises borrower data, system integrity, or the availability of pledged collateral. For firms advising banking and mortgage-servicing clients, the change means revisiting internal risk-management policies, tightening governance around AI tools, and ensuring incident-reporting procedures can meet the tightened disclosure threshold. The exact scope of "Super Intelligence" remains limited in available reporting, but the move signals a broader regulatory push toward embedding AI risk within core cybersecurity compliance. Clients should assess AI deployments, audit incident-tracking workflows, and map legal review steps ahead of the January 2027 effective date.