Fannie Mae Information Security Supplement
Understand the New Security Supplement. Prove How Your AI Is Safeguarded.
Fannie Mae's updated Information Security and Business Resiliency Supplement requires every covered Company that uses Super Intelligence - Fannie Mae's updated term for AI - in Fannie Mae work to run a formal SI governance program. It covers Single-Family lenders, Multifamily lenders, document custodians, and integrators, holds Companies responsible for their third parties' AI, and sets a 36-hour incident-notice standard. Fannie Mae encourages adoption now, with full implementation expected by January 18, 2027.
If Fannie Mae asked what AI you use and how it is safeguarded, could you answer from evidence?
The Supplement's disclosure, audit, and incident requirements assume a Company can show what its AI was authorized to do and what it actually did - at the level of specific identities, systems, records, and data attributes.
Direct Answer
What does the Fannie Mae Information Security and Business Resiliency Supplement require for AI?
Effective January 18, 2027, the Supplement requires each Company - Single-Family lenders, Multifamily lenders, document custodians, and integrators (third-party solution providers) - that uses Super Intelligence (SI), Fannie Mae's updated term for artificial intelligence, in Fannie Mae work to implement a formal SI governance program. The program must maintain an inventory of SI use cases, identify and assess risks against the Company's risk tolerance, address data governance and change management, monitor and audit SI use, assess security risks including prompt injection and data leakage, document safeguards, enforce segregation of duties, govern third-party SI use no less protectively than its own, and promptly disclose SI types, purpose, manner of use, and safeguards when Fannie Mae requests them.
Section 4: Super Intelligence
What the SI governance program must cover
Inventory of SI use cases
Maintain an inventory of SI use cases, with processes to detect, track, and measure their purpose and scope.
Risk identification and tolerance
Establish governance and risk processes to identify risks, errors, or negative impacts requiring remediation, aligned with the Company's risk tolerance.
Data governance
Address data governance, retention, classification, and quality. SI outputs derived from Confidential Information should be treated as Confidential Information.
Model governance
Govern model design, training, testing, and validation as part of the program.
Monitoring and oversight
Provide for monitoring, auditing, ongoing oversight, and performance assessment, including post-deployment monitoring and retirement of SI systems.
Change management
Include change management controls for SI models, systems, and use cases.
Security-risk assessment
Assess SI for adversarial manipulation, model inversion, data leakage, prompt injection, and training-data integrity issues.
Documented safeguards
Implement and document safeguards designed to mitigate SI risks, including controls for data protection, model integrity, and misuse.
Segregation of duties
Prevent conflicts of interest with the teams and individuals empowered, responsible, and trained for mapping, measuring, and managing SI risks.
Third-party SI governance and disclosure
Govern third-party use of SI no less protectively than the Company's own requirements, and promptly disclose SI types, purpose, manner of use, and safeguards on Fannie Mae's request.
Where execution-time control and evidence fit
Enforce the SI governance policy at the point where AI touches loan data, with signed, versioned policy changes and a documented rollback path.
Give every human and machine a unique identity, and scope least privilege down to specific operations, records, and values - not just systems.
Record intent before execution: audit evidence of allowed and denied actions, tied to policy versions, that does not depend on the model behaving as instructed.
Contain prompt injection: when permissions are enforced outside the model, an injected instruction cannot widen what an agent is allowed to do.
Route vendor AI agents through the Company's own identity and policy layer, so the Company decides what third-party AI can do and holds the evidence.
Scope incidents from data: which users and agents acted, which operations and records they touched, and what was returned to the model.
“Company is responsible for all failures by such a third party to comply with this Supplement to the same extent as if such failure were committed by the Company.”
— Fannie Mae Information Security and Business Resiliency Supplement, Section 3.14 (Supply Chain Risk Management)
AI Governance Questions
Questions About the Fannie Mae Security Supplement
These answers address the Fannie Mae Information Security and Business Resiliency Supplement effective January 18, 2027. Companies should confirm applicability with counsel and the current Fannie Mae publications.
Section 4 requires a documented and implemented SI governance program covering an inventory of SI use cases, risk identification and assessment aligned to risk tolerance, data governance, model design and testing, monitoring and auditing, change management, security-risk assessment including prompt injection and data leakage, documented safeguards, segregation of duties, third-party SI governance, and disclosure to Fannie Mae on request. A designated owner must implement, maintain, and review the program at least annually.
#fannie-mae-si-governance-programYes. Section 3.14 requires a Company to cause its third parties to comply with the Supplement, including information security, Super Intelligence, and resiliency controls that meet or exceed its requirements, and states that the Company is responsible for third-party failures to the same extent as if the failure were committed by the Company. Section 4 separately requires third-party SI governance that is no less protective than the Company's own.
#fannie-mae-supplement-vendor-aiWithout undue delay, and no later than 36 hours after identifying a Cybersecurity Incident or reasonably concluding one may have occurred, a Company must provide all known details: the identification date, mitigation and containment status, and any suspended business operations. When available, it must also provide whether, and to what extent, including the data attributes involved, Fannie Mae Confidential Information was accessed, taken, or exposed.
#fannie-mae-36-hour-noticeUpon request, Fannie Mae requires prompt disclosure of the types of Super Intelligence used, the purpose and manner of SI use, the safeguards implemented to mitigate SI risks, and other information Fannie Mae requires. Section 3 separately requires the information-security program and supporting documentation to be made available on request, along with an annual written attestation from an authorized corporate officer.
#fannie-mae-supplement-ai-disclosureNo. No technology product makes a Company compliant with the Supplement, and much of it - training, physical security, insurance, governance ownership, and the annual officer attestation - is organizational work. Crittora's products are designed to support specific execution controls: enforcing policy where AI agents call business systems, least-privilege access for people and machines, audit evidence of allowed and denied actions, and incident scoping for the 36-hour notice. Those controls operate inside a broader program the Company owns.
#crittora-and-fannie-mae-supplementPrimary sources
Use the current official documents when assessing applicability, contractual duties, and implementation decisions.
- Fannie Mae Information Security and Business Resiliency Supplement (effective January 18, 2027)
- Fannie Mae Supplement information page
- Fannie Mae Lender Letter LL-2026-04
- MISMO FRAME announcement
Crittora provides technology controls and operational information. It does not provide legal advice, certify compliance, or guarantee satisfaction of Fannie Mae, Freddie Mac, MISMO, or other requirements. No endorsement by Fannie Mae, Freddie Mac, or MISMO is implied.
Free Consultation
Schedule a Free AI Readiness Call
Talk with Crittora about your AI-governance priorities, the questions your team is facing, and a practical next step. No lengthy preparation is required.