AI Board Oversight Guide for Credit Unions

The short answer

Credit union directors do not need to understand how AI models work, but they do need to know where AI is used, which uses are high risk, who owns them, and how management knows the controls work. The board should approve the AI policy, review a summary of the AI register at least annually, and receive prompt reports of significant AI incidents.

What a quarterly AI report should show

Sample quarterly AI report to the board (illustrative figures)

14AI uses on the register

3high-risk uses

100%high-risk uses with a named owner

1AI incident this quarter

Staff trained on AI policy86%

High-risk models fairness-tested this year67%

AI vendors with current assessments75%

Questions every board should ask

Where we use AI

Where is AI used across the credit union today?
Which uses affect loans, pricing, or account access?
Which AI comes from vendor systems we already use?

How it is controlled

Who owns each high-risk use?
How do we test credit models for fairness?
How do we know vendors aren’t training on member data?

What we’d do if it fails

What happens if a model makes wrong decisions?
Can we meet the 72-hour NCUA notice for an AI-related incident?
When would the board hear about it?

What the board reviews and approves

Item	Board role	How often
AI use policy	Approve	When adopted and when materially changed
AI risk register summary	Review	At least annually
New high-risk AI uses	Informed before launch	As they arise
Significant AI incidents	Informed promptly	As they occur
AI governance program	Review effectiveness	Annually

Warning signs

Management cannot say where AI is used across the credit union.
No one can explain why a credit model approved or denied a member.
AI features were turned on in vendor systems without review.
There is no AI-related scenario in the incident response plan.

Frequently asked questions

Do directors need AI expertise?

No. Directors need enough understanding to ask good questions and judge management’s answers. A short annual briefing usually provides that.

Is AI oversight a board responsibility at a credit union?

The board is responsible for overseeing the information security program and risk generally, and AI now runs through member data, lending, and operations, so oversight belongs on the board’s agenda.

More Guides for Credit Unions and Lenders

Sources

How this guide is built

Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.

Cite this guide

Cogent Assurance. (2026). AI Board Oversight Guide for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-board-oversight-guide-credit-unions

Report an issue

See something out of date or incorrect? Tell us and we’ll review it.

Report an issue with this guide

This guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.