Fannie Mae recently updated its AI and cyber security requirements. The agency published the new requirements to its Supplemental Bulletin 26-01, which become effective on Jan 18.
The revised guide changes all AI references to SI — “super intelligence” — per the Trump administration’s preference. The bulletin, however, stipulates that the updated terminology “is not intended to alter the scope, meaning, or applicability of the requirements.”
Among the new requirements is a 36-hour cybersecurity incident reporting window requiring companies to provide Fannie Mae with “prompt” details about the incident, including the event date, details of actions taken and if the event caused suspension of business operations.
Additional requirements were added for the development and use of SI systems, including establishing SI risk assessments, data governance standards, model training and testing controls, and monitoring SI for security risk.
While Fannie Mae does not require an indemnification agreement like Freddie Mac, the updated bulletin makes companies responsible for ensuring third-party vendor compliance. The bulletin also updated the requirement that a company’s business continuity plan ensure the ability to recover from disruption of a relationship with a third-party that is “material to business conducted with Fannie Mae.” It also replaced threat assessment and continuity plan requirements with business impact analysis and added a requirement that a business continuity plan includes a communication strategy around incident response, removing a previous requirement specific to a crisis management plan.
The update also removed the requirement for companies to conduct an annual threat risk assessment, as well as removed the requirement for a business continuity plan to be “formally socialized” with company leadership. It also eliminated the requirement for companies to establish contingencies for fourth-party vendors.
