Resources / AI Incident Response Playbooks / Financial Services
AI Incident Response PlaybooksFinancial ServicesCredit Unions and Lenders
AI Incident Response Playbook for Credit Unions
What a credit union should do, hour by hour, when an AI tool exposes member data, makes wrong decisions, or misleads members.
Aligned withNIST AI RMF · Manage
The short answer
When an AI tool fails at a credit union, the first priorities are to contain it, preserve evidence, and determine whether member data was exposed or member decisions were affected. If the incident is a reportable cyber incident, NCUA requires notice as soon as possible and no later than 72 hours after the credit union reasonably believes it occurred. Member notice and state breach laws may also apply.
At a glance
Response timeline
- First hour
Contain
Disable the AI tool or feature, stop affected processes, and preserve logs, prompts, and outputs.
- First day
Assess
Determine what happened, whether member information was exposed, and which members or decisions were affected.
- Within 72 hours
Notify NCUA if required
If it is a reportable cyber incident, notify NCUA as soon as possible and no later than 72 hours after you reasonably believe it occurred.
- As required
Notify members
Follow your member notice program and applicable state breach notification laws if member information was compromised.
- Next 30 days
Remediate
Correct affected decisions or accounts, fix the root cause, and update controls before turning the tool back on.
- After closure
Review
Document lessons learned, update the risk register, and report to the board.
Severity levels
Severity 1
Critical
Member data exposed, or wrong credit decisions at scale
Response: Contain within an hour; executives and counsel engaged
Severity 2
High
Chatbot giving wrong account or fee information
Response: Contain the same day; compliance review
Severity 3
Moderate
Internal tool producing unreliable output
Response: Fix within a week; notify the system owner
Severity 4
Low
Minor errors with no member impact
Response: Log, track, and fix in the normal cycle
Common AI incidents
| Incident | Main concern | First step |
|---|---|---|
| Staff enter member data into a public AI tool | Data exposure | Determine what was entered and request deletion from the provider. |
| Chatbot gives members wrong information | Unfair or deceptive practices, Regulation E | Correct the content, identify affected members, and review transcripts. |
| Credit model denies loans in error | Fair lending and adverse action accuracy | Suspend automated decisions and re-review affected applications. |
| AI vendor reports a breach | Member data and NCUA notice | Get facts from the vendor fast enough to meet the 72-hour window. |
Frequently asked questions
Is every AI incident reportable to NCUA?
No. The 72-hour notice applies to reportable cyber incidents as NCUA defines them. Your incident response team should decide quickly whether an AI incident meets that definition and document the decision.
Should AI incidents be part of our existing incident response plan?
Yes. Add AI-specific scenarios and contacts to your current plan rather than creating a separate one.
More Guides for Credit Unions and Lenders
- AI Regulation Map for Credit Unions
- AI Use Policy Guide for Credit Unions
- AI Risk Register for Credit Unions
- AI Vendor Assessment Checklist for Credit Unions
- AI Governance Blueprint for Credit Unions
- AI Training Guide for Credit Unions
- AI Impact Assessment Example for Credit Unions
- AI Board Oversight Guide for Credit Unions
- Privacy Program Guide for Credit Unions
- AI Contract Clause Library for Credit Unions
- State AI Law Tracker for Credit Unions
- AI Use Case Catalog for Credit Unions
- Data Protection Assessment Template for Credit Unions
- AI Tabletop Exercise Scenario for Credit Unions
Sources
- NCUA cyber incident notification requirement, 12 CFR 748.1(c)
- NCUA guidance on response programs for unauthorized access to member information, 12 CFR Part 748, Appendix B
- Regulation E, 12 CFR Part 1005
- Regulation B, 12 CFR Part 1002
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). AI Incident Response Playbook for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-incident-response-playbook-credit-unions
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
AI Risk Review
An independent review of one AI tool, vendor, or use case before you adopt it or expand it.
Fractional Chief AI or Privacy Officer
A named senior executive who owns your AI governance or privacy program and reports to your leadership.
AI Governance Essentials
Monthly AI governance support from our team: tool reviews, policy updates, and register upkeep.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.