Mortgage servicers may be seeing less visible enforcement pressure this year, but that does not mean their compliance exposure is easing. According to the report, federal oversight actions have slowed, with no CFPB consent orders against servicers in 2026 and a reduced enforcement staff, yet the accountability standard continues to widen. The central issue is straightforward: when an AI model makes a poor account-level decision, regulators and counterparties are still likely to hold the servicer responsible, not the vendor that built the tool.
The article points to three separate AI governance regimes now shaping the market. Under OCC Bulletin 2026-13 and SR 26-2, third-party models are treated much like internal ones for validation, monitoring and outcomes analysis. That means a vendor’s scoring system cannot simply be accepted on trust; it has to be managed within the servicer’s model risk framework. The guidance also excludes generative and agentic AI, even though those are among the tools currently being deployed, leaving a gap between what servicers are using and what the bulletin directly addresses.
Contracts, audits and inventory demands are becoming stricter
Freddie Mac Bulletin 2025-16 is even more specific. In force since March 3, 2026, it requires documented AI governance, executive sign-off from senior risk or technology leaders, audits tied to recognized security frameworks, continuous bias monitoring and safeguards against threats such as prompt injection, data poisoning and model inversion. It also includes broad indemnification language, which can turn non-compliance into a direct contractual liability inside seller/servicer agreements. Fannie Mae’s later lender letter, effective August 6, 2026, is less prescriptive but still requires vendor AI governance to be at least as protective as the servicer’s own, while giving Fannie the right to request a full inventory of every AI system, including its purpose, data types and safeguards.
The report also highlights the Treasury Financial Services AI Risk Management Framework, released in February 2026. Although voluntary, it is becoming the practical reference point for examiners and internal audit because no binding federal standard yet governs generative tools. Its control objectives cover governance, data integrity, bias monitoring, lifecycle management, third-party risk and operational resilience. The biggest weakness for many servicers, according to the report, lies in third-party AI risk and in the contract terms that support it. Common gaps include restrictions on using borrower data for training, advance notice of model changes, audit rights, and provisions that preserve logs and override records if the relationship ends. The message for the industry is clear: vendor promises may be attractive, but the operational and regulatory burden still sits with the servicer.
Source: housingwire.com
