What Will an NCUA Examiner Actually Ask About Your AI?

There is no standalone NCUA rule on artificial intelligence. If your credit union is waiting for one before it builds an AI governance program, you're waiting for something that, as of this fall, isn't scheduled to arrive. Examiners, meanwhile, are not waiting.

Here's what the public record actually supports.

What the NCUA has said

The NCUA maintains an AI resource page for credit unions. It points to existing frameworks, including guidance from the National Institute of Standards and Technology, rather than writing new requirements. The agency's position, as summarized by several industry sources, is that its existing rules are technology-neutral and apply to AI use just as they apply to anything else.

At a 2025 board meeting, NCUA staff said that updating model risk management guidance alone would not give credit unions timely, practical direction for all the ways they use AI, and that any new binding requirements would have to go through formal rulemaking. At the same meeting, all three board members reiterated that credit unions remain responsible for compliance violations that come from their use of AI.

The vendor gap

A 2025 Government Accountability Office report added an important detail. The NCUA does not have authority to examine technology service providers, even though credit unions depend on them heavily, and GAO again urged Congress to consider granting it. The practical effect is that the examiner can look at your credit union but not at the company whose model you bought. The questions land on you.

Where commentary disagrees

It's worth being honest about one point. Commentary is split on how prominently AI appears in the NCUA's 2026 supervisory priorities letter. Some industry write-ups say the letter names AI and emerging technology as an examiner focus. Another analysis says AI does not appear in the letter at all. We'd suggest reading the letter itself rather than trusting any summary, including ours.

Questions worth being ready for

Based on the public record, a reasonable examiner conversation is likely to cover these:

1. Do you have a board-approved policy on AI use, and does it say who is responsible?
2. Can you list the AI tools in use, including features your vendors added to products you already own?
3. For each one, what member data does it touch?
4. How did you evaluate the vendor, and what documentation did they give you?
5. Where does a person review or override what the tool does?
6. What happens if the tool gets it wrong, and how would you find out?

None of these require a new regulation to ask. They're ordinary risk management questions pointed at a newer kind of technology.

A practical next step

If you can answer the first two questions in writing today, you're ahead of most. If you can't, start with the inventory. A one-page list of tools, owners, and data touched is the foundation everything else rests on.

Sources

• Artificial Intelligence: Use and Oversight in Financial Services, GAO-25-107197 (GAO)
• NCUA Board hears briefings on AI, ombudsman, CLF (America's Credit Unions)
• NCUA Board Meets; Harper and Otsuka Attend (GoWest Association)
• NCUA AI Guidance 2026: What Examiners Will Actually Ask (Multimodal)
• NCUA is watching how your credit union is using AI (Nintex)