Freddie Mac Single-Family Seller/Servicer Guide 1302.8 — Use of artificial intelligence and machine learning

Freddie Mac Single-Family Seller/Servicer Guide 1302.8 — Use of artificial intelligence and machine learning

Effective 2026-03-03 · Freddie Mac's stamp for this section

This section contains requirements related to: ■ Compliance with applicable law ■ Indemnification ■ Governance framework (a) Compliance with applicable law Seller/Servicers that use artificial intelligence and/or machine learning (together, “AI/ML”) in connection with the origination of Mortgages sold to or guaranteed by Freddie Mac or Servicing Mortgages on behalf of Freddie Mac must ensure compliance with Applicable Law and their Purchase Documents. In addition, such use is conditioned upon: ■ Seller/Servicer’s development, implementation and maintenance of policies and procedures for the use of AI/ML, which must at a minimum: ❑ Be approved by Senior Management, including, at a minimum, the Chief Information Officer, Chief Technology Officer, Chief Information Security Office or Chief Risk Officer (or the equivalents thereof) ❑ Be communicated to appropriate personnel who have job responsibility in areas that use AI/ML; and ❑ Have an owner(s) that implements, maintains and reviews the policies and procedures at least annually to ensure they comply with Applicable Law and consistently reflect industry best practices ■ Upon request by Freddie Mac, Seller/Servicer’s prompt disclosure of the types of AI/ML used, the purpose and manner for such use, safeguards to mitigate risks related to the use of AI/ML, and such other information as Freddie Mac may require. (b) Indemnification Seller/Servicer agrees to indemnify Freddie Mac and its directors, officers, employees, agents, successors and assigns, and to hold each harmless from and against any and all liabilities, losses, claims, actions, damages, including, but not limited to, indirect, incidental, special or consequential damages, whether foreseeable or not, judgments, costs and expenses, including reasonable attorneys’ fees, arising directly or indirectly out of or relating to its use of AI/ML. Freddie Mac shall provide the Seller/Servicer with notice of any such claim after it comes to Freddie Mac’s attention. (c) Governance framework Seller/Servicer must establish clear governance frameworks for AI/ML adoption by ensuring the following: ■ Policies, processes, procedures and practices across the organization related to the mapping, measuring and managing of AI risks are in place, transparent and implemented effectively ■ Legal and regulatory requirements involving AI are understood, managed and documented ■ The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures and practices ■ Processes, procedures and practices are in place to determine the level needed of risk management activities based on the organization’s risk tolerance Seller/Servicer must do the following: ■ Assess AI/ML for specific threats such as data poisoning and adversarial inputs ■ Conduct regular internal and external audits to identify any potential vulnerabilities or deviations from established policies. Ongoing monitoring and periodic review of the risk management process and its outcomes must be planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review ■ Regularly monitor AI systems for performance, security breaches and biases ■ Conduct audits to ensure compliance with standards like National Institutes of Standards and Technology 800-53 and International Organization for Standardization 27001 ■ Establish clear policies and codes of conduct to ensure the following: ❑ The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures and practices ❑ Processes, procedures and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance ❑ The risk management process and its outcomes are established through transparent policies, procedures and other controls based on organizational risk priorities ■ Apply segregation of duties to prevent conflicts of interest and ensure the following: ❑ Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible and trained for mapping, measuring and managing AI risks ❑ Roles and responsibilities and lines of communication related to mapping, measuring and managing AI risks are documented and are clear to individuals and teams throughout the organization

Source: Freddie Mac Single-Family Seller/Servicer Guide 1302.8 — Use of artificial intelligence and machine learning · source URL · snapshot 4c94f67729042dd6