The mortgage industry is on an AI binge. Let’s make the hangover optional.

I watched mortgage leaders embrace AI at The Gathering in Austin. And for good reason: The tools are getting good, the productivity math is starting to math and the competitive pressure is doing what classic IMB horse races do. I left more bullish about AI in the industry than when I arrived.

I also left with a concern that I didn’t hear enough airing. The AI conversation in mortgage is currently first-order focused: efficiency, automation, cost reduction. The harder question of how to instill confidence across the many constituencies that must trust these systems has yet to hit the headlines.

Regulatory confidence is one of those constituencies. Capital markets is another that operates on a shorter clock. Investors price execution confidence directly, without waiting for an examination to show up in spreads and bids. The industry has had binges before – let’s figure out how to prevent the hangover. 

The pattern, and the pause

Credit scoring and fair lending. Quantitative models and the financial crisis. Fintech partnerships and third-party risk. The plot is consistent: new capabilities outpace governance, leading to loss events, followed by regulation written around the worst observed behaviors. Those who built governance before the barn doors closed wrote their own narratives. Those who did not had it written for them.

The AI cycle is a breathtakingly up-tempo game whose pace is only quickening. Up-tempo play creates coverage gaps. In our industry, compliance is coverage. And we are only starting to see the broken coverage.

Four things I observed at The Gathering gave me reason for concern, ordered by how directly they touch the regulated core of the business.

1. Vendors casually dismiss how AI implementations brush up against RESPA, ECOA and Fair Lending. These are not background constraints; they define the structure inside which any decision affecting a borrower’s price, product fit or approval must be defensible at that moment. The lenders buying these tools own the regulatory exposure regardless of how the vendor characterizes the product.
2. A proliferation of point AI solutions with no coherent lender strategy. Every vendor on the demo floor had its own AI implementation in its own corner of the workflow. The architectural question of which layers of the stack are appropriate homes for probabilistic AI, and which require deterministic commitments that probabilistic systems are incompatible with, is not being asked. Every lender is making locally rational vendor decisions that, in aggregate, produce a model risk and fair lending surface area no one has mapped.
3. The emergence of Model Context Protocol (MCP) layers across platforms, opening broader AI tool access in ways most have yet to register – agentic promiscuity? AI capability is no longer arriving as a discrete product. It is arriving as an interface inside something else. A governance program built for a world of discrete vendor AI tools is already obsolete for the world in which it is being deployed.
4. Pervasive personification masks real gaps in accountability. “AI will review the file. AI will flag the exception.” Models do not bear regulatory obligations. Institutions do. Every “AI will” sentence describes an action that, when an examiner or litigant arrives, will need to be traceable to a person, a control or an artifact.

A different first principle

The operating principle today – unstated but real – is deploy fast, govern later. The hangover is what gets built when that approach collides with post-mortem examination or enforcement. The principle I am proposing is scalable, compliant AI adoption. Not slower deployment, but a different underlying foundation, with a more precise unit of analysis.

Scalably compliant means governance infrastructure that is proportionate to systemic consequence, built at the layer where decisions are actually made and designed to adapt as both AI deployment and regulatory expectations evolve, rather than governance retrofitted after the fact to the worst observed behavior.

The examination frameworks governing mortgage lending were designed around visible, document-level artifacts: the loan file, the disclosure, the appraisal. Those are the right units for a world of human decision points and paper audit trails. They are the wrong units for a world where consequential decisions are being made one layer beneath them; in model weights, confidence thresholds and agentic handoffs that no examination manual currently names. Governance drawn at the wrong boundary produces the compounding error of over-restricting what doesn’t need it while under-governing what does.

In practice, scalably compliant means three things. First, know what you have, including what arrived as a feature in a platform upgrade or was activated when a vendor updated a product you’ve used for years. This inventory has to be a live register, not an episodic exercise. Knowing what’s in your shop creates a firebreak that doesn’t just protect upward, it licenses execution velocity downward. The institutions treating this as a compliance exercise are solving half the problem. The institutions treating it as infrastructure are building a competitive asset.

Second, govern the vendor relationship, not just the vendor contract. The regulatory obligation – fair lending testing, adverse action documentation, ongoing monitoring – sits with the institution regardless of who built the model. Most contracts today don’t provide model documentation, right-to-audit or cooperation when regulators come. Fixable now. Meaningfully harder once switching costs are high.

Third, build to principles, not to rules. The specific rules will change. Governance built around transparency, auditability, accountability and resilience survives those changes. Governance built around specific rules becomes obsolete the day the rule is revised.

The regulatory channel is the threat most governance programs are designed to see. It moves slowly –  exams, findings, remediation cycles. The capital markets channel moves faster and doesn’t announce itself. When investors and counterparties begin to question the integrity of AI-enabled origination processes, the signal arrives as spread widening and tightening bid interest, not as a formal inquiry.

Scalably compliant governance is not just a posture toward regulators. It is the operational evidence that capital markets counterparties need to sustain execution confidence in an environment where they are increasingly sophisticated about how loans are made.

The question to take back

Every leader will leave the AI Summit later this summer with a list of AI tools to deploy or refine. That list needs to be paired with answers to a harder question: if a regulator, or a counterparty conducting diligence, asked you tomorrow to produce your AI governance file, how long would it take, and who would you call?

Worth saying plainly: Scalably compliant is not a synonym for cautious. Overcorrection and undercorrection can produce the same strategic outcome. Indiscriminate restrictions without credible substitutes are their own form of paralysis. And unlike an enforcement action, paralysis generates no incident report and no visible cost. The deployment simply doesn’t happen at the pace it needed to, and the competitive window closes quietly. The goal is precision: concentrate governance where systemic consequences are highest, accept managed exposure where they aren’t and sequence investment so that governing the decision-logic layer enables rather than constrains everything beneath it.

If the answer is uncomfortable, it is not too late. The binge is the deployment. The hangover accumulates under adversarial conditions because the deployment ran ahead of governance. One is happening already. The other is still optional.

 Marvin Chang is Executive in Residence and Associate Director of the Master of Engineering in FinTech program at Duke University’s Pratt School of Engineering, and Principal of Mercer Knoll Strategies.

This column does not necessarily reflect the opinion of HousingWire’s editorial department and its owners. To contact the editor responsible for this piece: zeb@hwmedia.com.