AI Underwriting Without Counsel Creates Risk

How do un-auditable AI underwriting decisions lead to loan indemnification demands, and how do Fannie Mae and Freddie Mac regulations impact this? Under internal agency frameworks like Fannie Mae’s Lender Letter LL-2026-04, mortgage lenders are strictly required to operate auditable AI governance programs that track vendor usage, annual compliance audits, and individual loan-level data tracking. When an institution cannot produce a definitive audit trail linking a machine-learning decision to a human review or a specific policy version, buyers and agency regulators can classify the loan as defective and demand immediate indemnification or repurchase. To avoid costly secondary-market penalties, lenders must proactively integrate legal counsel to construct defensible governance frameworks, particularly since the MLPA compliance rep is where those demands land when errors occur.

Why this matters for the secondary market

The MLPA compliance rep promises that the loan was originated in accordance with applicable law and agency requirements. After August 6, 2026, agency requirements expressly include AI governance obligations. A loan underwritten using an AI tool that was not subject to a documented governance program is, on its face, a candidate for a defect classification.

That classification does not require a borrower harm. It does not require a fair-lending violation. It only requires that the agency conclude the lender was not following the governance framework when the AI was used. From there, the agency can demand indemnification, demand repurchase, or refer the matter for further review.

Where AI without counsel falls short

Lenders that build AI governance programs in-house, without legal review, frequently miss four things:

Vendor governance scope. The agency frameworks expressly extend to AI tools provided by vendors. A lender’s program must cover not only its own AI use, but its vendors’ AI use of the lender’s data. Most vendor agreements do not, today, provide the visibility the lender will need.
Annual review documentation. Both frameworks require annual review of the governance program. The first review must be a real review, with documented findings and updates. A program that exists on paper but has never been tested is, in agency examination, equivalent to no program.
Audit trail by loan. The defining test is whether the lender can produce, for any specific loan, the record of which AI tools touched the file, what data they used, what outputs they produced, and how those outputs were reviewed by a human. Most lenders cannot produce this record because they did not design their systems to capture it.
Adverse action and fair lending overlay. AI tools used in underwriting must still comply with ECOA and Regulation B. A governance program that addresses operational risk but ignores fair lending leaves a much larger problem visible to a different regulator.

Where counsel makes the difference

AI governance is not a compliance project. It is a contract drafting project, a policy drafting project, a vendor renegotiation project, a regulatory interpretation project, and a litigation-defensibility project, all at once. Each of those is something counsel does. None of them is something the AI tool itself can do for the firm.

Lenders that rely on AI tools to design their own AI governance programs are, in effect, asking the tool to audit itself. The agencies are not going to accept that answer. The buyers conducting diligence on the secondary market are not going to accept it either.

The window is closing

Lenders that wait until August 6, 2026 to start building a governance program will not be ready. Lenders that built a program in-house without legal review will discover, in their first agency examination, what their gaps are. Lenders that engaged counsel ahead of the deadline will be in a materially stronger position — not because counsel is faster, but because counsel knows which provisions of the framework are testable, which are aspirational, and which carry the most regulatory weight.

The audit trail problem is solvable. It is not solvable cheaply, and it is not solvable by the tool that created it.

Goldsmith Associates represents depository institutions, non-bank lenders, fund managers, loan servicers, and broker-dealers in connection with the purchase, sale, servicing, and financing of whole loans and mortgage servicing rights. If you are facing any of the issues raised in this article, or if you are pricing a trade, negotiating a purchase agreement, defending a repurchase demand, or working through a counterparty event, we are on call and at the ready 24/7. Call 844-4-GOLDSMITH, email info@goldsmithpllc.com, or visit goldsmithpllc.com.