What NCUA says about AI, in plain English.

Yes. NCUA's own answer starts with that word: "Yes. Credit unions may use AI tools and technologies." NCUA adds that it supports AI when it's put in place in a safe, sound way that follows the rules. So for your credit union, the question isn't whether AI is allowed. It's how you manage it.

That answer comes from a short set of questions and answers on NCUA's AI resource page. NCUA wrote them to explain how it supervises AI. Every NCUA quote on this page comes from there unless another link says otherwise.

This is general information, not legal or compliance advice.

No. NCUA says it "has not issued AI specific rules or regulation." It also says "existing regulations are technology-neutral and apply to AI use." In plain words, the rules your credit union already follows still apply when AI is involved. NCUA hasn't written a separate set just for AI.

NCUA gives one instance. It says "information security standards must be followed regardless of whether a credit union communicates via email, phone, or an AI-enabled tool." The channel changes. The rule doesn't.

So when someone asks whether an AI use is allowed, start with a familiar question: which rule already covers this work, and does AI change how you meet it? Your compliance team and counsel answer that for your credit union.

NCUA says it supervises AI within its existing supervisory framework. Examiners evaluate safety and soundness practices, compliance with applicable laws and regulations, internal controls around the AI tool, ongoing monitoring of risks, and third party due diligence when you use vendors. In NCUA's words, AI "is not treated differently than any other innovative technology."

NCUA also lists what it expects when you use AI. You're expected to identify risks that may be unique to AI, monitor and measure them regularly, and put controls in place for operational, compliance and security risks.

NCUA adds that "these expectations are the same as those for any new product or service." If your team has brought in a new product before, you already know the shape of this work.

NCUA says credit unions using AI from a third party vendor "must conduct appropriate due diligence." That includes understanding how the product or service works, the risks the AI brings, how it fits your business model, and the vendor's safeguards, reliability and controls. NCUA adds that your board and management "must ensure proper oversight."

For vendors in general, NCUA's AI page points to its letter Evaluating Third Party Relationships. It's from October 2007, still marked active, and covers risk assessment, due diligence, contracts and ongoing oversight.

If you want the questions to send, read The AI questions to ask your vendors. It turns NCUA's four points into plain questions about member data, member decisions and contracts.

Oversight sits with your board and management. When AI comes from a vendor, NCUA says they "must ensure proper oversight to maintain safe and sound operations." NCUA's AI page doesn't say what form that oversight takes. A credit union league article recommends a written AI policy that reaffirms the board's oversight, which is one way to show it.

An article on the California and Nevada credit union leagues' site calls a clear AI policy "one of the most significant ways" a credit union's compliance team can help it take on AI. It says the policy should reaffirm "the board's ultimate oversight of all AI-related activities" and name, by title, who is accountable for enforcing it.

The same article says many institutions are already dealing with "shadow AI," which it describes as AI use "without formal approval or oversight." It recommends briefing the board on the risks, and on areas where AI may already be in use, before the policy is written.

None of this makes a policy a rule. It's a way to put your board's oversight in writing. If staff already use AI with no written rules, read what that gap looks like day to day.

Start with NCUA's AI resource page. It holds the questions and answers quoted here, links to NCUA's letters on third party vendors, and outside resources on AI risk, data security and fraud. NCUA last updated it on April 28, 2026. CU Daily covered the collection on May 5, 2026.

The outside resources NCUA points to include:

• AI risk management resources from NIST, part of the U.S. Department of Commerce
• Tools from the Treasury Department and its AI Executive Oversight Group on AI cybersecurity risk
• A COSO research paper on AI and enterprise risk management, including board oversight
• CISA papers on AI data security and on deploying AI systems securely
• A FinCEN report on fraud schemes that use deepfake media

NCUA also has its own AI page about how the agency itself uses AI. For credit union resources, it sends you back to the resource page above.

Will having an AI policy get us through an exam?

No one can promise an exam outcome. NCUA says its "supervisory focus is on risk management, not the tool itself." A written policy records who is responsible for AI and how you mean to manage it, and your compliance team and counsel decide what else you need.

Is NCUA's AI page a rule?

No. NCUA says its AI questions and answers are "intended to clarify NCUA's supervision approach to AI and other innovation." The rules themselves are the regulations you already follow, which NCUA says apply to AI use.

• Staff use ChatGPT and we have no AI policyPhoto by Matheus Bertelli on Pexels
• We don't know what our vendors do with AIPhoto by RDNE Stock project on Pexels

Plain answers: AI questions to ask your vendors

Why waiting doesn't stop AI use · Home