UAD 3.6 and the Danger of Corporate Pragmatism

The rollout of the new UAD 3.6 framework has triggered a major wave of compliance literature, and a perfect example is a recent article by Woody Fincham at Valuation Nation, titled “Certification 25: What’s the Real Risk to the Appraiser?”. In his piece, Woody sets aside the rhetoric and lists my AppraisersBlogs article regarding our legal defenses under this dataset as a citation reference at the end of his post. While he acknowledges the existence of this perspective, his broader argument claims that the legal risks of signing Certification 25 are low, the threat of regulatory discipline is minimal, and the entire shift is just a natural economic progression of the digital age. I believe his conclusion represents a dangerous path of corporate pragmatism for independent business owners. Accepting this framework as an unavoidable reality forces independent appraisers to step into a massive corporate liability trap simply because it is presented as the only way to maintain access to the traditional lending and secondary market pipelines.

Compliance driven commentary frequently uses the legacy Certification 21 template to suggest that Certification 25 is nothing new, but this comparison glosses over a profound legal canyon. The legacy Certification 21 simply controlled the distribution of the final completed document to relevant parties inside the lending loop, allowing a client to share the completed appraisal report without granting secondary parties any right to extract or weaponize the underlying analysis. Certification 25 keeps that original list but adds a brand new sentence granting any recipient the explicit legal right to store, copy, reproduce, analyze, use, and distribute the data for internal or external purposes without our consent. Under legacy rules, they could only view the final document; Certification 25 forces us to give them a permanent, uncompensated data license to strip out our interior photos, condition scores, layout metrics, and defect observations. This is not a routine update; it is a hostile corporate asset grab that fundamentally alters data ownership.

I also see a significant flaw in how Woody minimizes the copyright and data protection angle. He explicitly agrees with the risk analysis published by Isaac Peck over at Working RE Magazine, acknowledging that Certification 25 removes the passive nature of the legacy rules and creates an express written contract that strips away copyright defenses under federal law. Yet, after admitting that this text erases our primary legal defense against data exploitation, Woody rates the actual risk as low simply because errors and omissions insurers have not seen an influx of lawsuits yet. This is a problematic approach to risk management. While there may have been fewer claims under the legacy framework when our legal defenses were still intact, the post-3.6 landscape is an entirely new environment. Advising independent business owners to sign away their fundamental legal rights and intellectual property protections just because a claim has not materialized under a completely different set of rules is a major corporate blind spot.

Woody even attempts to soothe privacy concerns by echoing the argument that once a borrower name and street address are stripped out of the report, the Gramm-Leach-Bliley Act no longer applies, allowing the data to be safely released into public files and used to train machine learning models. This logic is completely uncoupled from the reality of modern technology. New artificial intelligence platforms can now instantly pinpoint the exact physical location of a property using just a single interior photograph. Ripping text lines off page one is legally meaningless when modern computer vision can reverse engineer a living room or even a laundry room photo back to a specific doorstep in seconds. The photograph itself remains linkable personal data, and pretending it is anonymized is a massive compliance illusion.

The historical reality is that our reports are protected by federal copyright law, which is exactly why Certification 25 was engineered as a workaround. A landmark case from the industry archives perfectly illustrates this power. A commercial appraiser named Tim Vining discovered that a major brokerage firm had stolen his custom field metrics and proprietary property analysis to use in their own corporate marketing materials without his permission. Instead of rolling over, Vining registered his appraisal report with the United States Copyright Office and sued the firm for copyright infringement, unfair competition, and unjust enrichment. The defendants completely folded before the trial even ended, paying Vining a $50,000 settlement and legally acknowledging his valid copyright. This case established a powerful legal truth: appraisers own their investigative text and data compilations. The GSEs and their legal teams read cases like Tim Vining’s and realized they could not legally scrape our data archives to train their machine learning models without running into massive copyright lawsuits. Certification 25 is their solution, forcing appraisers to sign a certified, unilateral license agreement that gives away the exact copyright protections that won Vining his settlement.

Our actual legal exposure under this framework is not from the tech companies harvesting the data, but from the homeowners and borrowers whose private spaces we photograph and analyze. When a tech platform intercepts our proprietary appraisal analysis, including interior photographs, condition and quality ratings, functional obsolescence notes, or our estimated remaining economic life of a roof, that data gets funneled into a massive web of data brokers, insurance carriers, and third party risk pools. If a borrower is financially harmed because their private interior photos are circulating without permission, or if their homeowner insurance policy spikes or gets canceled because a confidential roof lifespan or functional obsolescence notation was leaked to an insurance risk pool, that consumer can and will file suit. Unrestricted third party data harvesting turns our reports into a consumer surveillance trap, and signing Certification 25 converts a passive corporate data scrape into a certified legal waiver where the appraiser takes all the blame when a consumer is harmed.

Furthermore, I disagree with Woody’s interpretation of the USPAP Ethics Rule. He claims that because Certification 25 deals with organizations authorized by the lender, these entities fall inside the “parties authorized by the client” exception under the Confidentiality section, and that what the client does with it downstream is outside the appraiser’s control. That logic completely ignores the timeline of contract law and the mechanism of the signature. Under legacy rules, a client leaking data downstream was indeed an independent, subsequent action where the appraiser remained entirely passive. But under UAD 3.6, the appraiser is being forced to actively sign a personal certification block that preauthorizes that data mining upfront, at the exact moment of signature. This active signature transforms a subsequent client leak into an active personal authorization by the appraiser. No one can claim they are taking reasonable steps to safeguard confidential assignment results under USPAP when they are actively signing a document that legally strips away their right to restrict that use. The two positions simply cannot coexist.

Woody freely admits that independent appraisers are being forced to provide a royalty free commercial license to their own data, and that this data is being used to train automated valuation models built to compete with them, slash their fees, and eventually replace them. He even warns that appraisers who refuse to touch UAD 3.6 are trading a low probability legal risk for a near certain loss of revenue. This is the ultimate corporate leverage: sign the waiver, feed the machine that replaces you, and accept 1990s pricing for skyrocketing liability, or get left behind.

But independent business owners who have completely stepped off the lending treadmill over the last two decades are proving that a highly profitable business model already exists outside of corporate frameworks. They focus entirely on private sector work, estate assignments, and non GSE clients who actually respect their data and their time. True independent appraisers are not cogs in a centralized data conveyor belt unless they choose to sign the paper that bolts them to it. Woody’s article inadvertently confirms that the contract loophole is real and the liability gap is real. I respect his willingness to engage in the broader data conversation, but the time to hold the line on the Ethics Rule is now.

• Author
• Recent Posts

Desiree Mehbod

Certified Real Estate Appraiser at EAppraise Co.

Desiree is a Certified Real Estate Appraiser with over 30 years of experience serving Northern Virginia. She serves on the Veterans Affairs Fee Appraisal Panel (VA) as a fee appraiser and is the founder and president of Dast2Dast Inc., a local nonprofit that provides food assistance to the homeless in the DC metro area.

Latest posts by Desiree Mehbod (see all)

• UAD 3.6 and the Danger of Corporate Pragmatism - October 14, 2026
• Our Metrics, Their Millions: Exposing the Backdoor Data Rush - October 13, 2026
• Inspectors Blocked the Door, Appraisers Handed Over the Keys - October 12, 2026