Freddie Mac Establishes Comprehensive Governance Framework for AI Systems

Freddie Mac recently released Bulletin 2025-16, which announces, among others, updates to the Single-Family Seller/Servicer Guide “to establish a comprehensive governance framework for the responsible development, deployment and oversight of artificial intelligence (AI) and machine learning (ML) systems.”

Under updated section 1302.2 of the Guide, the currently required HR security training “should incorporate current cybersecurity threats, including phishing, social engineering, supply chain attacks, malware/ransomware, credential compromise via weak password hygiene, insider threats, artificial intelligence (AI)-powered tactics (e.g., deepfakes, targeted phishing content) and threats to AI systems (e.g., model inversion, data poisoning, prompt injection).  When necessary, the organization personnel and partners must receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures and agreements.”

Under updated section 1302.8 of the Guide, a Seller/Servicer must ensure that:

• Policies, processes, procedures and practices across the organization related to the mapping, measuring and managing of AI risks are in place, transparent and implemented effectively.
• Legal and regulatory requirements involving AI are understood, managed and documented.
• The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures and practices.
• Processes, procedures and practices are in place to determine the level needed of risk management activities based on the organization’s risk tolerance.

Additionally, a Seller/Servicer must:

• Assess AI/ML for specific threats such as data poisoning and adversarial inputs.
• Conduct regular internal and external audits to identify any potential vulnerabilities or deviations from established policies.  Ongoing monitoring and periodic review of the risk management process and its outcomes must be planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.
• Regularly monitor AI systems for performance, security breaches and biases.
• Conduct audits to ensure compliance with standards like National Institutes of Standards and Technology 800-53 and International Organization for Standardization 27001.
• Establish clear policies and codes of conduct to ensure the following:
  • The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures and practices.
  • Processes, procedures and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.
  • The risk management process and its outcomes are established through transparent policies, procedures and other controls based on organizational risk priorities.
• Apply segregation of duties to prevent conflicts of interest and ensure the following:
  • Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible and trained for mapping, measuring and managing AI risks.
  • Roles and responsibilities and lines of communication related to mapping, measuring and managing AI risks are documented and are clear to individuals and teams throughout the organization.

These provisions become effective on March 3, 2026.