Resources / Governance Blueprints / Financial Services
Governance BlueprintsFinancial ServicesCredit Unions and Lenders
AI Governance Blueprint for Credit Unions
Who owns AI decisions at a credit union, how new AI uses get approved, how the board oversees AI, and how to size the structure to your asset size.
Aligned withNIST AI RMF · GovernISO/IEC 42001 · Leadership and roles
The short answer
AI governance at a credit union works best as an extension of the structures it already has. The board approves policy and receives reports, a small AI governance committee led by an executive reviews new uses, each AI system has a named owner, and compliance, information security, and the BSA officer review uses in their areas. Smaller credit unions can run this with three or four people meeting quarterly.
Who owns AI decisions
Approval flow for a new AI use
- 1RequestDepartment submits the use, vendor, and data
- 2TierCompliance and security assign risk
- 3ReviewOwner approves low risk; committee the rest
- 4Vendor checkAssessment and contract review
- 5RegisterApproved, logged, and scheduled for review
Sizing the structure
Under $500 million in assets
- Committee of three or four leaders
- Meets quarterly
- Annual board report
$500 million to $10 billion
- Committee of five to seven
- Meets monthly or as needed
- Semiannual board report
Over $10 billion
- Dedicated AI risk owner
- Formal model risk management
- Quarterly board reporting, with CFPB examination in mind
Frequently asked questions
Do we need a new committee for AI?
Not necessarily. Many credit unions add AI to an existing risk or technology committee’s charter. What matters is a clear owner, a defined approval path, and regular board reporting.
Who should chair AI governance?
An executive with authority across departments, usually the CEO or COO, so decisions stick across lending, operations, and member service.
More Guides for Credit Unions and Lenders
- AI Regulation Map for Credit Unions
- AI Use Policy Guide for Credit Unions
- AI Risk Register for Credit Unions
- AI Vendor Assessment Checklist for Credit Unions
- AI Training Guide for Credit Unions
- AI Impact Assessment Example for Credit Unions
- AI Incident Response Playbook for Credit Unions
- AI Board Oversight Guide for Credit Unions
- Privacy Program Guide for Credit Unions
- AI Contract Clause Library for Credit Unions
- State AI Law Tracker for Credit Unions
- AI Use Case Catalog for Credit Unions
- Data Protection Assessment Template for Credit Unions
- AI Tabletop Exercise Scenario for Credit Unions
Sources
- NCUA security program rule, 12 CFR Part 748, including Appendix A
- NIST AI Risk Management Framework (AI RMF 1.0), Govern function
- ISO/IEC 42001:2023, Artificial intelligence management system
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). AI Governance Blueprint for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-governance-blueprint-credit-unions
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
Fractional Chief AI or Privacy Officer
A named senior executive who owns your AI governance or privacy program and reports to your leadership.
AI Governance Readiness Assessment
A gap analysis of your AI governance against the NIST AI RMF, with a prioritized plan for what to fix first.
Leadership AI Briefing
A focused session for executives and boards on AI opportunities, risks, and oversight.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.