Resources / Tabletop Exercise Scenarios / Financial Services
Tabletop Exercise ScenariosFinancial ServicesCredit Unions and Lenders
AI Tabletop Exercise Scenario for Credit Unions
A ready-to-run scenario where a member service chatbot exposes account details, with timed developments and questions for each phase of the response.
Aligned withNIST AI RMF · Manage
The short answer
This scenario tests how a credit union’s leadership responds when its member service chatbot begins showing one member’s account details to another. It runs about two hours, involves executives, compliance, information security, member service, and communications, and tests decisions about containment, NCUA notice, member notice, and public communication.
Participants
CEO or COOChief information security officerCompliance officerMember service leaderCommunications leadLegal counsel
Scenario timeline
Member complaint
A member calls the contact center saying the chatbot showed them another member’s recent transactions.
Discuss
- Who decides whether to shut the chatbot off?
- What evidence do we preserve first?
More reports
Two more members report similar issues. The vendor says it is investigating a recent model update.
Discuss
- Does this meet NCUA’s definition of a reportable cyber incident?
- When does our 72-hour clock start?
Scope confirmed
Logs show 140 conversations may have displayed other members’ data over three days.
Discuss
- Which members must be notified, and how?
- Which state breach laws apply?
Media inquiry
A local reporter asks about “a chatbot leaking member data.”
Discuss
- Who speaks for the credit union?
- What can we say before the investigation ends?
Debrief questions
- Did everyone know who had authority to shut down the chatbot?
- Could we have met the 72-hour NCUA notice requirement with the information we had?
- Did our vendor contract give us the information and cooperation we needed?
- What will we change in our incident response plan?
Frequently asked questions
How long does this exercise take?
About two hours, including a 30-minute debrief. A facilitator introduces each development and guides discussion.
Who should facilitate?
Someone outside the response team, so every participant can focus on their role. An outside facilitator also makes it easier to raise gaps candidly.
More Guides for Credit Unions and Lenders
- AI Regulation Map for Credit Unions
- AI Use Policy Guide for Credit Unions
- AI Risk Register for Credit Unions
- AI Vendor Assessment Checklist for Credit Unions
- AI Governance Blueprint for Credit Unions
- AI Training Guide for Credit Unions
- AI Impact Assessment Example for Credit Unions
- AI Incident Response Playbook for Credit Unions
- AI Board Oversight Guide for Credit Unions
- Privacy Program Guide for Credit Unions
- AI Contract Clause Library for Credit Unions
- State AI Law Tracker for Credit Unions
- AI Use Case Catalog for Credit Unions
- Data Protection Assessment Template for Credit Unions
Sources
- NCUA cyber incident notification requirement, 12 CFR 748.1(c)
- NCUA guidance on response programs for unauthorized access to member information, 12 CFR Part 748, Appendix B
- Regulation E, 12 CFR Part 1005
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). AI Tabletop Exercise Scenario for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/tabletop-exercise-scenario-credit-unions
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
AI Incident Tabletop Exercise
A facilitated simulation of an AI failure or data exposure that tests how your team would respond.
AI Red Team Assessment
Adversarial testing that tries to make your AI system leak data, break its rules, or produce harmful output.
Fractional Security Officer (vCISO)
A part-time security leader who owns your security program, policies, and risk decisions, including AI systems.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.