AI vendor due diligence questions for mortgage brokers

Fannie Mae's Security Supplement expects seller/servicers to govern their vendors' and subcontractors' AI use, and the FTC Safeguards Rule requires oversight of service providers that handle customer information. Send these questions to each LOS, CRM, pricing, and marketing vendor and file the answers. No email required. General information, not legal advice.

1. Which features in your product use AI or machine learning?
2. Does any of our borrower data or nonpublic personal information go to an AI model? Which one, and where is it hosted?
3. Is our data used to train or improve your models or anyone else's? Can we opt out in writing?
4. How long do you keep prompts, outputs, and uploaded documents, and how are they deleted?
5. Which subcontractors or AI providers process our data?
6. Do you have a written AI governance policy, and who owns it?
7. How do you test AI features for accuracy, bias, and security risks such as prompt injection or data leakage?
8. Can AI output reach a borrower without a human reviewing it first?
9. How will you notify us of material changes to your AI features or AI providers?
10. What security certifications or audit reports (for example SOC 2) cover the AI features?
11. How do you handle an AI-related incident, and how fast will you tell us?
12. Will you answer a wholesale lender's or GSE's questions about your AI if we are asked?

What to do with the answers

Record them next to each tool in your AI inventory, flag any vendor that sends borrower data to a model you have not approved, and re-ask at contract renewal. The AI Policy Kit ($497) (or the $149 Starter) includes an inventory worksheet with vendor-oversight sections, and Governance Done-For-You includes a vendor AI risk review. Background: Fannie Mae and Freddie Mac AI requirements, explained and the AI policy checklist.