MBA Premier Member Editorial: Who Pays When the AI Is Wrong?
Sandeep Shivam is Head of TOUCHLESS Experience with Tavant
Every conversation about AI in mortgage lending eventually arrives at the same place, can we trust the technology? The industry has answered with an impressive stack of technical controls such as validation testing, human review, audit trails and monitoring. All necessary but none sufficient. The question that follows, however, is the question most aren’t prepared to answer: What happens financially when errors occur?
Errors will occur. The honest question is not whether an AI agent will eventually clear a condition it should not have, miscalculate income for a self-employed borrower or generate a disclosure with a wrong figure. The honest question is who absorbs the cost when it happens, and whether that answer is documented anywhere.
Mortgage is better equipped than most industries to answer this question. Errors occurring in this market are not abstract, they convert to dollars fast. A bad underwriting decision becomes a repurchase demand and repurchases are not cheap. According to a Reggora and STRATMOR Group study, the average cost of an error is $32,288 per loan, with income miscalculation among the leading defect drivers.
The insurance market is catching up
An insurance market for AI-related risk now exists. Global insurers and specialist brokers are building products around losses from AI performance failures and automated decisions. Availability and exclusions are still uneven, but the market is moving past the experimental stage, following a similar path of cyber insurance in its early years.
The details that should interest every mortgage executive are how insurers evaluate the risk. Before quoting, underwriters may examine whether an institution has documented use cases, independent validation, audit trails, monitoring and tested circuit breakers. Strong governance improves insurability, limits and pricing.
That creates a feedback loop worth internalizing. Governance spending is usually framed as pure cost. Insurance reframes this perspective. Money invested in validation and incident readiness reduces actual losses and improves a lender’s ability to transfer the remaining risk.
Your vendor contract is a liability document
The second backstop is in the contract with an AI provider, and most standard agreements are heavily weighted toward the providers. Liability is commonly capped at multiple, small fees. This may be reasonable for a general software tool, however, it is inadequate when a single mishandled loan file creates a six-figure exposure.
To limit the lender’s liability, the following five protections deserve attention:
- Performance commitments for defined use cases, with measurable accuracy thresholds and remedies for breach;
- Indemnification for intellectual property claims, data protection failures and losses caused by the provider’s technology;
- Specific incident response obligations covering acknowledgment timelines, evidence preservation and remediation;
- A liability cap that is sized to the actual exposure of the use case rather than a few months of fees; and
- A defined deprecation process that provides advance notice before a model version is modified or retired, version-lock options where feasible and a reasonable migration period.
Revalidating a production model is not a weekend project. A provider’s roadmap should not become an uncontrolled operational risk for the lender.
Reserves for AI that match the operational risk
The third backstop is internal and unglamorous, it’s the reserves and risk limits. Large banks already hold capital against operational risk. Independent mortgage banks, credit unions and regional lenders should also quantify the exposure even if there is no capital rule compelling them to do so.
Do not leave AI risk buried inside a broad operational risk category. Size the reserve to your actual profile including the volume and value of the decisions AI influences, the maximum probable loss from a single failure, the potential repurchase and cure exposure offset by the insurance and vendor indemnities.
The best approach is scenario based. Estimate what happens if one error affects one loan, 100 loans or an entire production cycle, then determine what portion of that exposure is prevented, transferred, contractually allocated or retained. That is not pessimism, it is basic risk management.
Transparency still matters
When AI materially influences a credit decision, the disclosure obligation is not new. US creditors must provide specific, accurate reasons for adverse actions, whether the decision came from a person, an algorithm or both, and model complexity is not an excuse for a vague explanation. A lender that can explain where AI was used and how the borrower can challenge the outcome stands is in a far stronger position.
The signal financial backstops send
Regulators are increasingly examining how institutions manage AI-related model risk, third-party risk and consumer harm. Insurance, vendor protections and reserves do not replace validation or human accountability. Instead, these protections show an examiner or a board that leadership has considered not only how the system is supposed to work, but what happens when there are errors.
The lenders that scale AI most effectively over the next three years will not be the ones claiming their systems never fail. The most successful lenders will be able to measure potential exposure, prevent errors when possible, transfer liability when needed, establish a reserve for any remaining failures and keep operating. In mortgage, an acceptable risk is one that can be identified, quantified and priced accordingly. AI is no exception.
(Views expressed in this article do not necessarily reflect policies of the Mortgage Bankers Association, nor do they connote an MBA endorsement of a specific company, product or service. MBA NewsLink welcomes submissions from member firms. Inquiries can be sent to Editor Michael Tucker or Editorial Manager Anneliese Mahoney.)
