Fannie Mae is bringing "Super Intelligence" governance into its corporate security requirements, requiring companies using the technology in work connected to the mortgage-finance institution to meet new oversight and disclosure obligations. The update also introduces a 36-hour cybersecurity reporting deadline, tightening expectations for incident response.
According to JD Supra, the changes appear in an updated version of Fannie Mae's Information Security and Business Resiliency Supplement, announced through a recent bulletin. The revised rules become effective on January 18, 2027, giving affected companies a defined transition period.
Super Intelligence enters governance
The updated supplement replaces the previous term "Artificial Intelligence" with "Super Intelligence", using terminology that Fannie Mae says better reflects evolving industry language. However, the institution explicitly states that this wording change does not expand or narrow the existing requirements.
Companies using SI for activities performed under, or connected to, their Fannie Mae agreements must follow governance requirements. These extend beyond internal oversight to include supply chain management and disclosures to Fannie Mae about their use of the technology.
Cyber reporting gets stricter
The supplement establishes an initial notification deadline of 36 hours following a cybersecurity incident. Companies must then provide further information promptly as additional details become available.
Reporting obligations also expand. Companies must disclose every affected individual's data attributes and send a notification letter to impacted people, with a copy provided to Fannie Mae.
Broader security changes
The update introduces several additional requirements:
- Companies must maintain an insurance policy.
- Multifactor authentication implementation requirements are revised. This security method requires multiple forms of identity verification.
- Encryption rules are brought into alignment with industry standards.
- Independent security assessments must be conducted by an independent third-party security professional rather than a qualified independent auditor.
- Companies' responsibilities for third-party compliance are updated.
Business continuity plans must also address the potential loss or disruption of relationships with third parties essential to Fannie Mae-related operations. They must include a communication strategy for responding to incidents.
The previous threat assessment and continuity plan requirement is replaced by a business impact analysis, which examines how disruptions affect operations. Several earlier obligations are removed, including annual threat risk assessments and contingency arrangements for fourth-party vendors.
Why it matters
The changes combine technology governance, cybersecurity reporting and operational resilience into a revised framework for companies working with Fannie Mae. The SI terminology change is particularly notable, although the institution says it does not change the underlying scope of its requirements.
The January 2027 implementation date gives affected businesses time to review their technology suppliers, incident notification procedures, insurance arrangements and continuity plans. The key issue ahead is whether their existing security controls and reporting processes can satisfy the expanded obligations when the revised supplement takes effect.