AI is Already Part of Mortgage Servicing.
Is Your AI Governance Keeping Up?

Underwriting models flag risk. Chatbots field borrower questions. Anti-fraud tools score home equity transactions in real time. Everyday AI makes further inroads into mortgage servicing. In a previous article, “AI and Bias: What Everyone is Worried About,” my Covius colleague, Kara Snow, explored why regulators are concerned about bias in AI-driven lending and real estate decisions. In this article, we’re asking the next question: what does effective AI governance look like for mortgage servicers, and what does the current regulatory landscape require?

Why AI Governance Matters in Mortgage Servicing

Automated underwriting, credit scoring, fraud detection and consumer-facing chatbots are becoming accepted tools in mortgage servicing. As a result, examiners are increasingly asking for documentation: how AI systems are tested for bias, monitored over time and reviewed for compliance. Servicers without a governance structure in place face compliance, examination and reputational risk – even if the underlying AI tools themselves are sound. 

The good news is that servicers don’t have to build a framework from scratch. Freddie Mac, Fannie Mae and MISMO have each introduced guidance to help organizations manage AI risks and establish governance structures:

GSE and Industry AI Guidance

• Freddie Mac’s Bulletin 2025-16 – Effective March 3, 2026. Established a governance framework for AI and machine learning systems focused on transparency, accountability, ethical use and risk management. 
• Fannie Mae’s Lender Letter LL-2026-04 – Effective August 6, 2026. Requires seller-servicers to maintain governance controls and, upon request, disclose AI use cases, purposes, safeguards and related information. 
• MISMO’s FRAME – Provides mortgage-specific guidance on responsible AI design, deployment and oversight for lenders, servicers and vendors. 

Federal Laws Affecting AI Use in Mortgage Servicing

AI doesn’t create a new compliance regime so much as raise the stakes on existing ones. AI-powered decisions and borrower interactions still must comply with federal laws, including the Equal Credit Opportunity Act, the Fair Housing Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act and the Truth in Lending Act. The CFPB’s Circular 2022-03 clarified that creditors cannot rely solely on AI-generated outcomes when denying credit and must still provide required adverse action notices. Servicers using AI tools for loss mitigation evaluations, customer assistance, or automated valuation functions should treat discriminatory outcomes and privacy violations as live risks, not theoretical ones. 

State Law is Evolving Rapidly 

State AI regulation is expanding rapidly and much of it directly touches on aspects of servicing operations such as automated decision-making, transparency, disclosures and consumer rights. Recent examples include:

• Colorado’s ADMT Act – Effective January 1, 2027. Imposing documentation, disclosure and notification requirements for AI systems affecting consumers’ access to financial services and automatic decision-making technology.
• California Executive Order N-5-26 – Effective March 30, 2026. Promoting responsible AI practices with a focus on transparency, privacy, data minimization and civil rights protections.
• Texas Responsible AI Governance Act (TRAIGA) – Effective January 1, 2026. Restricts discriminatory and manipulative AI practices.

In addition to these specific laws, Utah has also taken a series of steps to establish AI governance provisions and transparency requirements. For example, Utah’s comprehensive AI governance law was signed on March 18, 2026, and established provisions relating to its Office of AI Policy and regulatory agreements. Additionally, Utah’s Senate Bill 38, signed by the Governor on March 17, 2026, amended Utah’s consumer protection statute, and added Title 13, Chapter 77, Generative Artificial Intelligence – Consumer Disclosures and Enforcement, to the list of chapters the Division of Consumer Protection enforces. Chapter 77 implements transparency, liability, and safety framework requirements when mortgage servicers are utilizing generative AI that is consumer facing. 

New York, Iowa, and Illinois have also passed laws establishing various transparency, safety, and reporting requirements. New York’s Senate Bill 8828, enacted March 27, 2026, implements transparency requirements for AI developers, while Iowa’s AI governance law, effective July 1, 2026, established requirements for conversational AI services. Illinois’ AI law, effective January 1, 2027, establishes safety regulations for AI developers, and creates requirements for frameworks, transparency, and incident reporting.

Privacy laws are also increasingly addressing automated decision-making. Several states, including California, Louisiana, Oklahoma, Alabama and Vermont, have enacted measures providing consumers with rights related to automated processing, including opt-out rights, transparency requirements and opportunities to challenge certain AI-driven decisions.

What This Looks Like in Practice: Colorado’s ADMT Act 

Colorado’s Automated Decision-Making Technology (ADMT) Act takes effect January 1, 2027, and offers a preview of what servicers can expect. Under the rule, if AI materially influences a loss mitigation or credit-related decision, the consumer must be notified. In practice, this could mean enhanced adverse action notices that:

• Disclose the role AI played in the decision
• Explain the key reasons behind the outcome
• Distinguish between automated and human review
• Inform consumers of their right to request human review, correct inaccurate data, or appeal

This act is a useful model for what “AI governance” translates to operationally, not just a policy on paper, but changes to notice language, review workflows and system documentation.