The AI questions to ask your vendors.

Because AI may already run inside products your credit union pays for, and nobody on staff may be able to say what it does. NCUA says credit unions using AI from a third party vendor "must conduct appropriate due diligence." You can't do that for AI you haven't asked about, and contracts keep renewing in the meantime.

State bank supervisors have put this question in writing too. The Conference of State Bank Supervisors (CSBS) approved an AI Supervisory Framework for examiners on August 13, 2026. It asks whether an institution has "sought to identify where artificial intelligence is embedded in third-party products and services it uses."

That framework is written for examiners of banks and nonbank institutions, not for NCUA, and it says it creates no new legal obligations. It's still a clear, public list of what examiners may ask, so this page cites it alongside NCUA.

This is general information, not legal or compliance advice.

NCUA lists four things to understand about an AI vendor: how the product or service functions, the risks the AI technology introduces, how the AI fits into your business model, and the vendor's safeguards, reliability and controls. It adds that your board and management must ensure proper oversight to keep operations safe and sound.

Those four points come from NCUA's AI resource page. The same page says AI vendors can bring challenges that "may extend beyond traditional third-party vendor management."

The same page links NCUA's letter Evaluating Third Party Relationships, from October 2007 and still marked active. It covers vendor risk assessment, due diligence, contract terms and oversight. The questions below draw on both.

Ask where your members' data goes when the vendor's AI uses it, whether anyone trains AI on it, how long it's kept, how it gets deleted, and which other companies can see it. The CSBS framework lists contract terms covering "the use, retention, sharing, or training of AI systems" on customer data among the papers examiners may request.

• Where is our members' data processed and stored when your AI uses it?
• Do you, or any company you work with, use our data to train or improve AI?
• How long do you keep what goes into the AI and what comes out of it?
• How do we get that data deleted, and how will you confirm it's gone?
• Which subcontractors or other companies can see the data?

NCUA's 2007 letter already lists "data security and member confidentiality" and "subcontractor oversight" among the things vendor contracts should address. These questions apply that to AI.

Ask whether the vendor's AI makes, recommends or shapes any decision about a member, loans included. If it does, ask how the vendor tests it for fair lending, how a decision that goes against a member gets explained, and how the vendor monitors results over time. The CSBS framework names these areas for examiners when AI shapes decisions.

• Does your AI make, recommend or shape any decision about our members or their loans?
• How do you test it for fair lending, and will you share what you find?
• When a decision goes against a member, can you explain why in plain terms?
• How do you monitor results over time, and what will you report to us?

NCUA's AI page names some of the same challenges: "understanding algorithmic decision-making processes" and "ensuring fair lending compliance." The CSBS framework lists explainability, adverse outcomes and fair lending among what examiners may review where AI affects consumer decisions or outcomes.

NCUA's third party letter also asks officials how they will "gauge the positive or negative impacts of the arrangement on credit union members." A vendor's AI that shapes member decisions is part of that picture.

Ask for notice before the vendor changes its AI model or how the AI uses your data, a way to pause or turn off AI features, and a clean exit with your data returned. NCUA's third party letter lists termination and escape clauses among contract terms, and asks whether there's "a reasonable way out of the relationship."

• Will you tell us before you change the AI model, the data it uses or what it does?
• Can we pause or turn off the AI features without ending the whole contract?
• If we leave, how and in what form do we get our data back?

The CSBS framework lists change management among what examiners may review in vendor relationships. For AI that can take actions with little human direction, it also points to "the ability to restrict or halt the system."

NCUA's letter says credit unions "should exercise their right to negotiate contract terms," and that in many cases "early termination, escape clause, and default terms are negotiable." It also calls it prudent to have qualified outside counsel review vendor contracts.

Start with the vendors you're least sure about. Good places to begin: vendors whose product updates mention AI, vendors that handle member data or shape member decisions, and vendors whose contracts renew next. You don't need answers from every vendor at once. A few written answers beat a long list nobody has asked.

Keep the answers in writing, with the date and the name of who gave them. Then you can show your board which vendors you asked, what they said and what's still open.

If nobody owns this question at your credit union yet, see how that gap shows up at work.

Do we need to ask vendors who say they don't use AI?

It's worth asking once and getting the answer in writing. The CSBS framework says that when an institution reports no AI use, or isn't sure, examiners may check that against its vendor list and "recent product or platform changes." A dated answer from each vendor gives you something to check against too.

Will these questions satisfy an examiner?

No one can promise that. These questions follow what NCUA and the CSBS framework say examiners look at, but your compliance team and counsel decide what your credit union asks vendors and how you keep the answers.

• We don't know what our vendors do with AIPhoto by RDNE Stock project on Pexels
• Staff use ChatGPT and we have no AI policyPhoto by Matheus Bertelli on Pexels

Plain answers: What NCUA says about AI, in plain English

Why waiting doesn't stop AI use · Home