Resources / AI Impact Assessments / Financial Services
AI Impact AssessmentsFinancial ServicesCredit Unions and Lenders
AI Impact Assessment Example for Credit Unions
A worked example assessing an automated personal loan decision model, from purpose and data to risks, controls, and approval.
Aligned withNIST AI RMF · Map and MeasureISO/IEC 42001 · AI system impact assessment
The short answer
An AI impact assessment documents what an AI system does, who it affects, what could go wrong, and which controls reduce that risk, before the system goes live and at each major change. For a credit union, the systems that most need one are those that affect credit decisions or account access, such as an automated personal loan decision model.
Worked example: automated personal loan decisions
- System
- Vendor-provided model that approves, denies, or refers personal loan applications under $10,000
- Purpose
- Faster decisions for small personal loans and consistent application of credit policy
- Members affected
- All personal loan applicants, about 4,000 a year
- Data used
- Credit report, income, existing relationship, and application data
- Role in decisions
- Approves or refers automatically; a loan officer reviews every referral and may override
- Risk tier
- High: directly affects credit decisions
- Laws involved
- Regulation B, Fair Credit Reporting Act, Gramm-Leach-Bliley Act, state laws for members in other states
- Key risks
- Discriminatory effects, adverse action reasons that do not reflect the model’s actual drivers, data errors, vendor model changes
- Controls
- Fair lending testing before launch and quarterly, reason code validation, monthly sampling of decisions, contractual notice of model changes
- Residual risk
- Medium after controls
- Approved by
- AI governance committee, with the decision reported to the board
- Next review
- Twelve months, or sooner if the model or data changes
Risk before and after controls
Before controlsAfter controls
Scores out of 100, illustrative.
Steps in an assessment
- 1DescribeSystem, purpose, users, and decisions
- 2Map dataSources, use, and protection
- 3Identify risksFairness, accuracy, privacy, security
- 4Set controlsA tested control for each risk
- 5DecideApprove, condition, or decline
Why assessments are becoming standard
Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 expect organizations to assess AI systems before deployment, and state laws increasingly require documentation for automated decisions. A completed assessment is also the clearest evidence an examiner can review.
Frequently asked questions
Which AI systems need a full impact assessment?
Start with high-risk systems: anything that affects credit decisions, pricing, or account access. Medium-risk systems can use a shorter version.
Who should complete the assessment?
The system owner leads it, with input from compliance, information security, and the vendor. The AI governance committee reviews and approves it.
More Guides for Credit Unions and Lenders
- AI Regulation Map for Credit Unions
- AI Use Policy Guide for Credit Unions
- AI Risk Register for Credit Unions
- AI Vendor Assessment Checklist for Credit Unions
- AI Governance Blueprint for Credit Unions
- AI Training Guide for Credit Unions
- AI Incident Response Playbook for Credit Unions
- AI Board Oversight Guide for Credit Unions
- Privacy Program Guide for Credit Unions
- AI Contract Clause Library for Credit Unions
- State AI Law Tracker for Credit Unions
- AI Use Case Catalog for Credit Unions
- Data Protection Assessment Template for Credit Unions
- AI Tabletop Exercise Scenario for Credit Unions
Sources
- Regulation B, 12 CFR Part 1002
- Fair Credit Reporting Act, 15 U.S.C. 1681
- NIST AI Risk Management Framework (AI RMF 1.0), Map and Measure functions
- ISO/IEC 42001:2023
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). AI Impact Assessment Example for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-impact-assessment-credit-unions
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
AI Risk Review
An independent review of one AI tool, vendor, or use case before you adopt it or expand it.
ISO/IEC 42001 Gap Assessment
An assessment of your AI management system against ISO/IEC 42001, the international standard for governing AI.
AI Governance Readiness Assessment
A gap analysis of your AI governance against the NIST AI RMF, with a prioritized plan for what to fix first.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.