AI Risk Register for Credit Unions

The short answer

Most credit unions already use AI in lending, fraud detection, member service, and marketing, often through features built into vendor systems. A risk register lists each use, the member data it touches, how it affects decisions, its risk tier, and the controls in place. Uses that affect credit decisions or account access are high risk; internal tools with no member data are low risk.

Risk heat map

Impact on members

Likelihood of harm

1Loan underwriting model
2Automated small-dollar loan decisions
3Card fraud detection
4BSA and AML alert triage
5Member service chatbot
6Contact center call summaries
7Marketing copy generation
8Internal knowledge assistant

Sample register

AI use	Data used	Effect on members	Risk tier	Key controls
Loan underwriting model	Credit reports, application data	Approves, denies, or prices loans	High	Adverse action reasons, fair lending testing, model validation, human override
Automated small-dollar loan decisions	Account history, application data	Instant approve or deny	High	Decision explanations, testing for disparate impact, periodic sampling of denials
Card fraud detection	Transaction data	Declines or holds transactions	Medium	Threshold tuning, fast member unblock path, false positive tracking
BSA and AML alert triage	Transaction and member data	Prioritizes suspicious activity alerts	Medium	Human review of every alert, BSA officer decides on reports, documentation
Member service chatbot	Account questions, member messages	Answers questions, routes requests	Medium	AI disclosure, dispute routing, human handoff, transcript review
Contact center call summaries	Call recordings, member data	None directly	Low to medium	Approved vendor, retention limits, access controls
Marketing copy generation	None	Content members see	Low	Compliance review before publishing
Internal knowledge assistant	Policies and procedures	None directly	Low	Approved sources only, answers reviewed for accuracy

How to assign risk tiers

High

Affects credit decisions, pricing, or account access
Uses consumer report data
Has fair lending or legal rights implications

Medium

Affects member experience or compliance processes
A person reviews outputs before action
Handles member data

Low

Internal productivity only
No member information
No effect on member outcomes

What to record for each use

Register fields

Business owner and technical owner
Vendor and product name
Purpose and the decisions it influences
Member data used and where it is stored
Risk tier and the reason for it
Controls in place and how they are tested
Approval date and next review date

Frequently asked questions

Do AI features inside our vendor systems belong on the register?

Yes. Many credit unions’ largest AI exposure comes from features vendors add to core, lending, and fraud systems. If it influences member outcomes or touches member data, it belongs on the register.

How often should the register be reviewed?

Review high-risk uses at least annually and whenever the model, vendor, or data changes. Review the full register at least once a year and report a summary to the board.

More Guides for Credit Unions and Lenders

Sources

How this guide is built

Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.

Cite this guide

Cogent Assurance. (2026). AI Risk Register for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-risk-register-credit-unions

Report an issue

See something out of date or incorrect? Tell us and we’ll review it.

Report an issue with this guide

This guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.