Why “clever workflows” could become your biggest liability
There’s a trend happening right now that more people should be paying attention to...and more leaders should be slowing down before it gets out of hand.
Loan officers across the industry are starting to use AI tools to transcribe borrower phone applications, read handwritten 1003s, extract that data, and convert it into structured formats like XML for systems such as Arive or their LOS. On the surface, this looks like exactly what we’ve all been waiting for. Faster inputs, less manual work, and a more efficient process.
But underneath that surface, there’s a serious problem.
What’s being processed in these workflows isn’t just operational data, it’s a complete financial identity. A mortgage application includes full legal names, addresses, dates of birth, Social Security numbers, income, employment history, assets, liabilities, and credit-related information. This is some of the most sensitive data a borrower will ever hand over, and it carries a level of responsibility that can’t be treated casually.
The issue isn’t that AI is being used. The issue is how it’s being used.
Most of these workflows are being built informally. They live in prompts, chat tools, and instructions shared over email. There’s rarely a defined system architecture behind them, no formal security review, and no compliance validation. It’s a clever solution built quickly—but without the controls that should exist when handling regulated financial data.
That leads directly to the first major risk: loss of control over borrower information.
When borrower data is run through a standard AI tool, especially outside of an enterprise-controlled environment, it raises questions that most people aren’t asking. Where is that data actually being processed? Is it stored anywhere? Is it logged? Could it be used for training? Who has access to it? If those answers aren’t clearly defined and contractually understood, then the data is no longer fully under your control.
The second issue is something many people are brushing off as minor, but it’s not: read errors.
We’re already seeing cases where AI misreads Social Security numbers, phone numbers, email addresses, and income. That’s not just a nuisance. That introduces real risk into the system. A misread SSN or phone number can misidentify a borrower. Incorrect income data can impact underwriting decisions. And when that data is converted into structured formats and pushed into downstream systems, those errors don’t just disappear... they propagate.
Even worse, someone has to go back and fix those errors manually, which creates additional exposure points for sensitive data and further breaks any clean audit trail.
And that brings us to another major gap: there is often no audit trail at all.
In many of these AI-driven workflows, there’s no clear record of who processed the data, what was changed, what was original versus AI-generated, or where the data traveled. In a regulated environment like mortgage lending, that’s not a small oversight, it’s a fundamental failure in process control.
All of this compounds into a much bigger issue: compliance exposure.
Even if the intent behind these workflows is good, they can easily fall outside the boundaries of company policies, lender requirements, investor expectations, or state-level data protection standards. And the reality is simple, when it comes to handling borrower financial data, not knowing the rules doesn’t protect you from the consequences.
It’s important to be clear about something here: this is not an argument against AI.
AI is going to play a massive role in the future of mortgage origination. The efficiency gains are real, and the opportunity to improve the borrower experience is significant. But there’s a difference between implementing AI inside a secure, approved, and controlled environment, and pushing raw borrower data through ad hoc tools because it’s convenient.
Right now, a lot of what I’m seeing falls into the second category.
A responsible approach to AI in this space requires more than just making the technology work. It requires controlling the environment in which it operates, understanding exactly how data is handled, minimizing the exposure of sensitive information, validating outputs before they enter core systems, and ensuring that every step is documented, reviewable, and approved.
If those things aren’t in place, then what looks like innovation is actually unmanaged risk.
The industry is absolutely moving toward automation, AI-assisted workflows, and faster borrower experiences. That shift is already underway, and it’s not optional. But there are going to be two types of companies that emerge from this transition: those that build secure, compliant systems that can scale, and those that cut corners and deal with the fallout later.
Only one of those paths leads to a durable business.
At the end of the day, if you’re feeding borrower applications (especially anything containing Social Security numbers, income, or full identity data) into an AI workflow that hasn’t been formally secured and approved, you’re not just saving time.
You’re creating a liability.
And in this industry, that’s not a small mistake.
