For the past two years, servicers and investors have been asking the mortgage industry the same question about AI: is this safe to trust with our data? Until recently, there was no shared, federal-law-grounded answer. That changed this year.

In June, the Mortgage Bankers Association published a white paper, prepared with Orrick, Herrington & Sutcliffe, that lays out how existing federal law, including the SAFE Act, Regulation B, RESPA, and UDAP standards, already applies to AI-powered mortgage origination and servicing. It arrived alongside two other signals that the secondary market is done waiting for Washington to write AI-specific rules. Freddie Mac updated its Seller/Servicer Guide in March to require seller/servicers to maintain clear governance frameworks for AI and machine learning adoption, and to fold AI risk management into its existing information security requirements. Fannie Mae followed in April with lender letter guidance calling for documented policies covering the development, implementation, maintenance, and risk measurement of any AI or machine learning system a seller/servicer uses.

Taken together, these three documents give the industry something it hasn’t had before: a working definition of what responsible AI governance looks like in servicing and investor reporting, grounded in law and investor expectations rather than vendor marketing language. It’s a useful moment to describe, plainly, how that maps onto the way we’ve built our own platform.

Review cycles built around what the model actually does

The MBA paper’s most relevant point for our side of the business is its guidance on model review and validation. It argues that traditional annual review cycles were designed for static models, and that AI systems capable of updating their own parameters need more frequent review, with version control documentation that tracks not just what the model does but what it has changed about itself over time.

This is close to how we’ve approached our own platform from the start. Our systems are deliberately narrow: they automate repetitive, baseline reconciliation tasks so our team can spend its time on identifying and resolving cash flow errors at their root cause, rather than reviewing routine calculations by hand. That scope is intentional. A narrow, well-documented system is easier to validate, easier to explain, and easier to hold to a fixed review cadence than a system making broad, self-directed decisions across the reporting process.

Explainability as the actual product

The MBA paper also flags explainability as a growing concern. AI models that weigh hundreds of variables can produce accurate outcomes while making it genuinely hard to state, in specific terms, why a particular result occurred. In investor reporting, that is not an abstract compliance problem. It is the difference between being able to tell an investor exactly why a cash flow adjustment happened and simply telling them a system flagged it.

Transparency into the underlying causes of cash flow errors is the core of what we do, not an add-on to it. When our platform identifies a discrepancy, the goal is always to surface the root cause, not just the symptom, so that servicers, investors, and MSR owners can see exactly what happened and why.

Governance that keeps pace with reporting itself

This framework is also arriving at a moment of real operational change. Fannie Mae’s Lender Letter LL-2026-05 retires the LAR, a reporting mechanism the industry has relied on for decades, and replaces it with a new investor reporting structure. That kind of shift is exactly why governance needs to be built into a platform from the ground up rather than layered on afterward. When the underlying reporting requirements change, a system with clear documentation and a defined validation process can adapt without losing the transparency that made it trustworthy in the first place.

The MBA paper, the Freddie Mac Guide update, and the Fannie Mae lender letter don’t just describe a compliance obligation. They describe the standard we’ve been building toward for 25 years: automation that earns trust by being explainable, not automation that asks servicers and investors to take accuracy on faith.

If you want to talk through how our approach to AI governance fits into your investor reporting function, contact PMSI for a conversation.