T3
FHFA
Medium Confidence
Advisory
Artificial Intelligence/Machine Learning Risk Management
AI/ML risk management framework establishment for FHFA-regulated entities
HIGH
Impact Level
Top: model risk (5)
Classification
- Regulatory Program
- FHFA Supervision
- Doc Type
- Advisory
- Effective Date
- 2026-11-13 (est.)
- Days to Action
- 120
- Comment Deadline
- —
- Published
- —
Urgency Basis
Advisory bulletin with general guidance implementation timeline, typically 90-180 days for full compliance framework development
Operational Context
Flags
Ai Machine Learning
Board Reporting Required
Systems Change Required
Model Validation Trigger
Examination Focus
Affected Functions
Risk Management
Model Risk Management
Information Technology
Compliance
Data Governance
Vendor Management
Internal Audit
Institution Applicability
Gses (Fannie Mae/freddie Mac)
Federal Home Loan Banks
Fhfa-Regulated Entities
Impact by Category
Compliance
4
Operational
4
Data Governance
4
Model Risk
5
Reporting & Disclosure
3
Capital & Liquidity
1
Consumer Protection
3
Third-Party Risk
4
Key Requirements
- Establish comprehensive AI/ML governance framework
- Implement AI/ML model inventory and risk assessment processes
- Develop AI/ML model validation and monitoring procedures
- Create board-level AI/ML risk oversight and reporting
- Ensure third-party AI/ML vendor risk management
- Implement bias testing and fairness monitoring for consumer-facing AI/ML
- Establish data governance standards for AI/ML model inputs
Scoring Rationale
High impact across multiple operational areas due to comprehensive AI/ML risk management requirements. Model risk management receives critical (5) score as this directly addresses AI/ML model governance. Compliance, operational, data governance, and third-party risk all score high (4) due to significant framework development needs. Consumer protection and reporting score moderate (3) for specific requirements. Capital impact minimal (1) as guidance focused on risk management rather than capital requirements.
AI Analysis Disclosure — This record, including its scores, impact assessments, and Advisory
Assessment (impact, risk, and recommended actions), was generated by an AI model and may contain errors or
omissions. The Advisory Assessment is a starting point for analysis, not a substitute for professional judgment.
Effective dates, applicability determinations, impact assessments, and any recommended actions should be
independently verified against primary regulatory source documents and reviewed by qualified compliance or legal
personnel before taking compliance action. This output does not constitute legal or compliance advice.