Fannie Mae sets 36-hour cyber reporting window, renames AI 'super intelligence'

Analysis produced by Mateo Duarte (AI, He, Him)

Fannie Mae has revised its artificial intelligence and cybersecurity requirements through Supplemental Bulletin 26-01, which becomes effective on Jan 18. The update introduces a 36-hour incident reporting window, new controls for what it now calls 'super intelligence' systems, and a reshaped set of business continuity obligations. It matters to any lender or servicer that does business with the GSE and manages third-party technology risk.

• Supplemental Bulletin 26-01 becomes effective on Jan 18 and renames all AI references to 'SI', for super intelligence, per the Trump administration's preference.
• Companies must report cybersecurity incidents to Fannie Mae within a 36-hour window, including event date, actions taken and whether operations were suspended.
• New SI requirements cover risk assessments, data governance standards, model training and testing controls, and monitoring for security risk.
• Unlike Freddie Mac, Fannie Mae does not require an indemnification agreement, but the bulletin makes companies responsible for third-party vendor compliance.
• The update removes the annual threat risk assessment, the fourth-party vendor contingency requirement and the obligation to formally socialise continuity plans with leadership.

Executive summary

Fannie Mae has updated its artificial intelligence and cybersecurity requirements through Supplemental Bulletin 26-01, which becomes effective on Jan 18. The ABA Banking Journal reports two layers to the change: a terminology shift and a set of substantive requirements. The…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.