An AI policy for a credit union.
Ten sections with the language, published in full. Plus the regulator mix-up that runs through most of what is written about this.
No rule requires a credit union to have an AI policy, because NCUA has not issued AI specific rules or regulation — its own words. What a board-approved policy does is answer, cheaply and in advance, the questions an examiner already asks through the third-party and IT frameworks: which tools are in use, who approved them, what member information they touch, and who is accountable for the output. Ten sections, with drafting language, below.
Most of what is written about this cites the wrong regulator.
Search this topic and you will be told to align your AI programme with SR 26-2, or OCC Bulletin 2026-13, or FDIC FIL-15-2026. Those three are the same guidance, issued jointly on 17 April 2026 by the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation.
NCUA is not one of those agencies. A federally insured credit union is supervised by NCUA. That guidance is worth reading, it is persuasive, and it does not bind you. Building a programme to satisfy it is a choice, not compliance — and a credit union that spends its effort there while its vendor file stays thin has optimised for the wrong examination.
What NCUA does say is short and easy to check. It has not issued AI specific rules or regulation. Credit unions may use AI tools and technologies, and NCUA supports adoption when it is safe, sound and compliant. Its AI resource page routes you back to Letter 07-CU-13, Evaluating Third Party Relationships, and Letter 01-CU-20, Due Diligence Over Third Party Service Providers. That is the frame. AI readiness is mostly vendor management readiness.
The inventory comes first.
A policy written before the inventory describes a credit union that does not exist. You cannot state which tools are approved until you know which are in use, and the gap between those two lists is usually the finding.
One row per tool: what it is, who approved it, what member data it touches, whether the vendor trains on that data, what it produces, and whether that output is retained. Include the AI already inside products you did not buy for AI — the core, the digital banking platform, the contact centre. It takes an afternoon and it determines every section below.
Ten sections, with language.
Bracketed text is a fill-in. Adopt the sections that describe how your credit union actually operates, and do not adopt a rule you have no intention of supervising.
Scope and definitions
Decides what the rest reaches. Most scopes are drawn too narrowly and miss the AI already running inside the core, the digital banking platform and the contact centre software.
This policy applies to all employees, volunteers and officials of the credit union, and to any software incorporating artificial intelligence used in the conduct of credit union business, whether licensed directly, embedded in another product the credit union uses, or accessed by an individual on any device.
Approved tools and how one joins the list
The section an examiner opens first, because it is the one that produces a list. Nothing else in the policy works without it.
Only tools recorded on the credit union's AI Tool Inventory may be used in the conduct of credit union business. A request to use a tool not on the inventory must be submitted to [role] and approved in writing before use. [Role] maintains the inventory and reviews it no less than [frequency].
Member information
The rule people actually break, usually by pasting something into a consumer tier. Name the categories rather than saying be careful.
Member non-public personal information, account numbers, Social Security numbers, loan files, and any information subject to the credit union's privacy obligations may not be entered into any tool that is not on the approved inventory. Where an approved tool is used with such information, only the credit union's licensed business tier may be used. Consumer and free tiers are prohibited for credit union business.
Human review
The provision that does the most work in an examination, because it is the one that puts a name against an output.
No output produced with the assistance of an AI tool may be sent to a member, filed, or relied upon in a decision until it has been reviewed by an employee competent to evaluate it. The reviewer is responsible for the content as though they had prepared it.
Lending and account decisions
The highest-risk use and the one with the clearest consumer-protection exposure. Regulation B requires specific and accurate principal reasons for adverse action, and a model you cannot account for cannot produce them.
AI tools may not be the sole basis for a decision to approve or deny an application, to close or restrict an account, or to set pricing. Where an AI tool contributes to such a decision, [role] must be able to identify the specific principal reasons for any adverse action and confirm they are accurate. Tools that cannot support this requirement may not be used in the decision path.
BSA/AML uses
Drafting and triage are legitimate; the filing decision is not delegable. The case file has to show a person reached it.
AI tools may assist in alert triage, research and the drafting of narratives. The determination whether to file a suspicious activity report, and the content of any report filed, remain the responsibility of [role]. The case file must record the reviewer and their conclusion independently of any tool output.
Vendor due diligence
This is the frame NCUA already supervises through. The answers belong in a file, not in somebody's memory.
Before a tool is approved, [role] obtains and documents the vendor's answers on: whether credit union or member data is used to train its models, the identity of its subprocessors, whether zero retention is available and configured, what the integration is permitted to write as well as read, what happens to credit union data on termination, and what its audit trail contains. This documentation is retained for the life of the relationship and [period] thereafter, consistent with the credit union's third-party risk program.
Records and audit trail
Retention does not care what produced a record. Decide at the category level in advance rather than per document.
Records created or assisted by an AI tool are subject to the credit union's retention schedule on the same terms as any other record of the same type. [Role] determines the record category for each class of AI-assisted output and documents that determination on the inventory.
Training and attestation
A training record nobody can produce is decoration. The attestation is what turns it into evidence.
All employees and volunteers receive training on this policy upon adoption, upon hire, and no less than annually. Each attests in writing that they have read and will comply with it. [Role] retains the training and attestation records.
Incident reporting and board review
Turns a bad afternoon into a documented response, and ties the policy to the oversight the board cannot delegate.
Any individual who becomes aware that member information has been entered into an unapproved tool, that an AI-assisted output containing a material error reached a member, or that a tool has behaved outside its approved use, must report it to [role] immediately. [Role] documents the incident, the remediation and any required notification. This policy is reviewed and approved by the board no less than annually, and the review tests whether the artifacts this policy requires exist rather than whether the wording remains current.
What the board cannot hand over.
NCUA's third-party guidance puts planning, due diligence and ongoing monitoring on the credit union regardless of who performs the work. Outsourcing the activity does not outsource the responsibility, which is why a policy the board never saw is difficult to describe as oversight.
For a seven-person board and a small IT function, that does not mean a governance apparatus. It means the board approves the policy, sees the inventory at a stated cadence, and is told when an incident happens. Three things, minuted.
Two things that do not belong in it.
Capability claims. What the credit union's AI does for members belongs in member-facing disclosure, not in an internal policy, and anywhere it overstates it creates a problem in a document you wrote yourself.
Rules you will not enforce. A policy prohibiting a tool that half the staff use daily is worse than no policy. It records that the credit union knew the rule and did not supervise it, which converts a training gap into a supervision failure. If a prohibition will not be checked by somebody, either name the somebody or drop the prohibition.
This is not behind a form.
Every competitor for this query gates the template, which is why the pages that rank alongside NCUA are the ones with nothing to protect. A gated PDF cannot rank for somebody searching for the document.
The credit unions that hire an implementation consultancy are not stopped by a form. They are stopped by not being able to judge whether the firm knows the subject. So the artifact is on the page.
Get the next one.
Field notes from real deployments, written the way this one was. No schedule promised and nothing sold to you. Unsubscribe whenever.
Sources and standing.
The statements about NCUA's position are from its Artificial Intelligence page at ncua.gov, which states that NCUA has not issued AI specific rules or regulation and routes credit unions to Letters 07-CU-13 and 01-CU-20. NCUA's 2026 Supervisory Priorities, published January 2026, named AI oversight among examiner focus areas. SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026 were issued jointly by the Federal Reserve, OCC and FDIC on 17 April 2026 and are cited here only to explain why they do not apply. Last reviewed at source: September 2026.
The language above is a drafting starting point, not an adopted policy, and it needs your facts and your counsel before it goes to a board. This is not legal advice. If something here is wrong, tell me and it gets corrected.
Keep reading
Build with us in Milwaukee.
Thirty minutes, one real constraint, and a written description of what could be built. No pitch decks, no small talk.