The 120-day deadline from Fannie Mae’s announcement in early April that approved seller-servicers must have artificial intelligence governance frameworks in place by Aug. 6 has arrived.

While many lenders may have policies on paper by Thursday’s deadline, far fewer will have governance programs in place on which they can effectively execute, experts tell Scotsman Guide.

Chris Williams leads the advisory team for cybersecurity services at Richey May, where he also serves as chief information security officer for a handful of mortgage companies in the firm’s portfolio, advising on best practices and building out programs.

“There’s that idea of eating an elephant where it’s just such a big task that a lot of companies are a little overwhelmed by the ask,” said Williams. “It’s time, it’s money and it’s having an understanding of how individual companies are going to do this.”

The size, complexion and market positioning of different mortgage companies largely determines the speed and sophistication at which artificial intelligence integration and proper internal controls are developing within individual organizations.

“There are a lot of companies that are going to have to start answering those questions of the AI decision tree that they’ve never had to answer before,” added Williams. “A lot of companies, as they’re being forced to ask these from third-party vendors, are going to actually have to start building those logs out or providing those logs to customers because I don’t think that’s been asked enough to this point.”

The role of vendors

For mortgage companies feeling around in the dark for the light switch of governance, the vendors who power their daily operations are often their first phone call.

“Once Freddie, and then Fannie, put out their directives on AI governance, customers immediately started asking us, ‘What does this mean? What do we do?’” recalled Theo Ellis, CEO and founder of Friday Harbor, an AI-native pre-underwriting company that partners with nonbank lenders, brokerages, credit unions and depositories.

“People were leaning on us for some direction or some thought leadership because we are in the AI space,” added Ellis, “so we’ve really run at it.”

Running at it included enlisting the expertise of mortgage compliance attorneys, but also vetting the AI vendors and frontier models that Friday Harbor deploys across its systems.

But lenders have their own work to do, and Fannie’s and Freddie’s AI governance guidelines do not absolve lenders of their vendors’ sins.

Rather, lenders need to inventory AI use cases to understand where machine learning is embedded in vendor products, as well within their own operations. The expertise required to do so is highly siloed and costly to recruit and retain, yielding another operational advantage to larger organizations during a prolonged and ongoing downturn in home sales.

“Even the smallest lenders and brokers are asking us the right questions to build a policy or about what needs to be in the framework outside of the policy, but in terms of the drop-dead date of Aug. 6, I think we’re going to need a little bit more time than that,” said Alex Temple, a partner in the mortgage regulatory compliance practice at law firm Mitchell Sandler.

Temple has been at the forefront of the AI governance development process over the past year, as state regulators and Fannie and Freddie have rolled out requirements for tracking AI usage. She says the technology is driving a sea change in compliance likely to require “either vendors to help you manage your vendors or a different level of know-how on staff.”

To that end, a gulf is widening, industry sources say, between firms that can afford the risks of robust adoption alongside robust governance, and those who have yet to fully understand AI technology — let alone the regulatory landscape evolving before their eyes.

“There is some really cool stuff coming down the pike, but my biggest concern is I don’t think everybody fully understands how smart these models are,” said Temple. “And unless we understand exactly who built them, what frameworks they’re operating on, and what decisions the models are able to make on their own, it’s a very dangerous space to get into when we talk about processing, underwriting, decisioning and those types of things.”

A point of departure

What Aug. 6 represents is less a finish line that a starting gun for what will be a multiyear process developing standardized industry practices for all manner of industry stakeholders.

In the meantime, the complexity of AI technology being injected into every artery of the mortgage lifecycle means many lenders don’t know where to start. AI use cases can run the gamut from borrower-facing chatbots and run-of-the-mill document review to lead generation, underwriting and secondary loan delivery.

Some in the industry are skeptical of the internal controls that AI-powered vendors say they’re adopting — which is most vendors, if not all, amid the current artificial intelligence craze. Yet some lenders are avoiding the AI-related risks vendors pose amid rapid tech rollouts.

“If we’re really being honest with ourselves as an industry, I believe that most people are just sending out the questionnaire to their vendors, and getting the answers that they want to hear and never asking any more questions,” said Jeff Reeves, CEO and co-founder of Canopy Mortgage, a Utah-based distributed retail lender.

Reeves built Canopy with an internally developed tech stack that combines the point of sale, loan origination system, document verification, pricing and closing functions within a single code base and data layer. As a result, Reeves and his team are building an AI-native framework that plays within companies’ own sandbox — harnessed internally, permissioned internally and audited internally.

“I don’t know how somebody who is fully relying on a third-party vendor for AI can truthfully or can comfortably say that they’re complying with Fannie Mae’s guidance,” said Reeves. “On paper they’ll be able to say, ‘Hey, I gave them the questionnaire. They answered the boilerplate questions.’ But then all you can do is hope that your vendor is doing it right.”

While a fragmented AI regulatory landscape makes governance a moving target, different lenders and vendors are incorporating a wide range of models and AI-powered capabilities at the same time that they are navigating a range of guidance from state regulators and industry counterparties like government-sponsored enterprises (GSEs) Fannie and Freddie.

Yet industry leaders say that the resources and expertise mortgage companies may require to comply with Fannie’s governance requirements are more readily accessible than may be widely appreciated.

“There’s really no excuse for any lender to not be prepared with a documented policy and procedure, and at a minimum a baseline inventory of its own AI use cases,” said Brian Vieaux, president of the Mortgage Industry Standards Maintenance Organization (MISMO). “That is very doable for a lender of any size today.”

MISMO, which is owned by the Mortgage Bankers Association, helps to establish common language and data practices across the residential and commercial mortgage industries. It launched its Framework for Responsible AI in the Mortgage Ecosystem (FRAME) in June as a member-only toolkit to aid in responsible artificial intelligence governance and adoption.

At the organization’s fall summit on Aug. 24, MISMO will be hosting a day of FRAME-specific workshops to walk invitees through its AI governance framework, which comprises a template for policies and procedures, as well as AI use case inventory and risk assessment tools, all of which incorporate Fannie’s and Freddie’s latest guidance.

“Whether it’s a regulator or the GSEs, if at a minimum you’ve demonstrated that at least you know where AI is being used within your organization, then the conversations that follow are probably going to be a lot different [than] if you were not able to produce any evidence of your use of AI,” added Vieaux.