AI Governance Maturity Score

Question 1 of 7

Board received AI/cybersecurity training in the last 12 months

Board members have completed training covering AI-specific risk within the last 12 months.

NCUA 2026 Supervisory Priorities Letter (Jan. 2026) — annual board cybersecurity training named as an examiner focus area for the first time, extended to AI-specific risk.

Question 2 of 7

Fair lending review completed for credit-related AI

Any AI use case involved in a credit decision has a documented fair lending disparity review on file.

ECOA/Regulation B, 12 CFR 1002.9 (adverse action statement-of-reasons requirement), as applied to AI/complex algorithms by CFPB Circular 2022-03 (May 26, 2022) — algorithmic complexity is not a defense against ECOA’s specific-reasons requirement.

Question 3 of 7

Written AI systems program adopted

A board-approved, written program governing the institution's use of AI systems, covering scope, roles, and review cadence.

No standalone NCUA rule requires a written AI program by name. NCUA 2026 Supervisory Priorities Letter (Jan. 2026) and NCUA AI Resource Hub (updated Dec. 2025) name documented AI governance and board oversight as an examiner focus area, evaluated through existing safety-and-soundness and IT risk-management frameworks.

Question 4 of 7

Incident response playbook covers AI-specific incidents

The institution's incident response plan explicitly addresses AI-specific failure modes (e.g. model drift, hallucinated output, automated decisioning errors), not just general cybersecurity incidents.

12 CFR 748.1(c), Cyber Incident Notification Requirements for Federally Insured Credit Unions — 72-hour reportable-incident notification rule, effective Sept. 1, 2023.

Question 5 of 7

Model risk management documentation maintained

Documentation covering model development, validation, and ongoing monitoring exists for every model-driven AI use case.

SR 26-2 / OCC Bulletin 2026-13, Model Risk Management: Revised Guidance (Apr. 17, 2026), superseding SR 11-7/OCC 2011-12 — applied by analogy for credit unions. Note: explicitly excludes generative/agentic AI from its "model" definition; use alongside NIST AI RMF for LLM-based use cases.

Question 6 of 7

AI use-case inventory exists and is current

A complete, current inventory of every AI use case in use, under review, or proposed, reviewed on a defined cadence.

NIST AI RMF 1.0, Govern function (Tabassi, E., NIST AI 100-1, Jan. 26, 2023, https://doi.org/10.6028/NIST.AI.100-1).

Question 7 of 7

Vendor AI risk due diligence documented for all high-risk AI vendors

Due diligence records exist for every vendor supporting a high-risk AI use case, refreshed on a defined cadence.

NCUA Letter to Credit Unions 07-CU-13, Evaluating Third Party Relationships (Dec. 2007), and Letter 01-CU-20, Due Diligence Over Third-Party Service Providers (2001) — applied to AI vendors per NCUA’s AI Resource Hub (Dec. 2025).