AI for credit unions.
What NCUA actually says, which is shorter than most pages on the subject suggest, and what to do about it.
NCUA has not issued AI specific rules or regulation — that is its own wording, on its own AI page. It also says credit unions may use AI tools and technologies and that it supports adoption when it is safe, sound and compliant. What governs instead are the technology-neutral frameworks you are already examined against, and principally third-party risk under Letters 07-CU-13 and 01-CU-20. AI readiness, in practice, is mostly vendor management readiness.
The guidance everyone cites is not yours.
Most material written for credit unions on this topic points at SR 26-2, OCC Bulletin 2026-13 or FDIC FIL-15-2026. Those are one piece of guidance issued jointly on 17 April 2026 by the Federal Reserve, the OCC and the FDIC. NCUA is not among them, and a federally insured credit union is supervised by NCUA.
Read it if you like — it is thoughtful and it is persuasive. It is not binding on you, and a credit union that builds a model risk programme to satisfy it while its vendor file stays thin has prepared for an examination it will not have.
The policy.
An AI policy for a credit union
Ten sections with the drafting language, ungated, including the lending and BSA/AML provisions the generic templates have nothing to say about. Plus what the board cannot hand over.
Five questions before you sign.
Does the integration write back, or only read?
The one the harvest found unanswered across every core. A tool that narrates instead of acting means the member calls anyway, and the saving was never real.
Do you train on our data or our members' data?
In the contract, not on the marketing page. Default settings change; terms do not.
Who are your subprocessors?
Member data is going somewhere past them. If they cannot name the list, they do not know either.
What does your audit trail actually contain?
Not whether it has logs. What one entry holds, and whether you can retrieve one from eighteen months ago for an examiner.
What happens to our data when we leave?
Export format, deletion timeline, who confirms it. Ask before signing, because afterwards you have no leverage.
Keep the answers whether or not you buy. A vendor file with five answered questions in it is most of what Letters 07-CU-13 and 01-CU-20 want documentation to be, and it is the thing you will not want to reconstruct from memory two years later.
If you do nothing else.
Write down every AI tool in use and who approved each one, including the AI inside products you did not buy for AI — the core, the digital banking platform, the contact centre.
Most credit unions cannot produce that list, and it is what the third-party framework reduces to when an examiner asks. It settles what a policy has to cover, which vendors need diligence, and what you are retaining.
Get the next one.
Field notes from real deployments, written the way this one was. No schedule promised and nothing sold to you. Unsubscribe whenever.
On the regulatory material.
Statements about NCUA's position are from its Artificial Intelligence page at ncua.gov and were read there rather than taken from a summary — which matters more than usual here, because a large share of what ranks for these queries describes an NCUA AI compliance regime that does not exist. Last reviewed at source: September 2026.
This is not legal advice. It is how a practitioner who implements these systems reads the rules, written down so you can check it.
Keep reading
Financial Services
How we work with institutions in this sector.
AI for financial advisors
The same treatment, adviser side.
Quick Wins Library
440 guides, free, no paywall.
AI consulting in Milwaukee
Local to the metro, remote by default, onsite days on request.
AI consulting in Chicago
The same practice, with onsite days in Chicago when a room is worth it.
Build with us in Milwaukee.
Thirty minutes, one real constraint, and a written description of what could be built. No pitch decks, no small talk.