AI Vendor Assessment Checklist for Credit Unions

The short answer

Before buying an AI product or enabling a new AI feature, a credit union should confirm how the vendor uses member data, whether that data trains the vendor’s models, how the system is secured, whether credit models can explain their decisions, and what the contract allows if something goes wrong. Because NCUA generally cannot examine third-party vendors directly, the contract and the credit union’s own oversight carry the weight.

What good answers look like

Member data

Will our member data be used to train your models?

Good answerNo. Our contract prohibits training on customer data, and we can show you the clause.

Red flag“We may use anonymized data to improve our services.”

Security

How fast will you notify us of an incident?

Good answerWithin 24 hours of discovery, in writing, with the facts you need for regulators.

Red flag“Promptly,” with no time commitment in the contract.

Fairness

Can the model explain why it denied an applicant?

Good answerYes. It returns ranked reason codes we have validated against actual model drivers.

Red flag“The model is proprietary, so we can’t share how decisions are made.”

Contract

Can we turn off AI features without losing the service?

Good answerYes. AI features can be disabled at any time without affecting the core product.

Red flagAI features are bundled and can’t be separated or switched off.

Checklist

Member data and privacy

Will our member data be used to train or improve the vendor’s models?
Where is our data stored, and for how long?
Which subprocessors can access our data?
Can we require deletion of our data when the contract ends?

Security

Can you provide a current SOC 2 Type II report?
How is our data encrypted in transit and at rest?
How quickly will you notify us of a security incident, in time for our 72-hour NCUA notice?
Who at the vendor can access our data, and how is access logged?

Model performance and fairness

How was the model tested for accuracy on populations like our members?
Can the system provide specific reasons for adverse credit decisions?
Has the model been tested for discriminatory effects, and can we see the results?
How will you tell us about model changes before they take effect?

Contract terms

Do we have audit and examination support rights?
Who is liable for errors caused by the model?
Can we turn off AI features without losing the rest of the service?
How is our data returned or destroyed at exit?

Why the contract matters more at a credit union

NCUA has long sought authority to examine third-party vendors directly but generally lacks it, so examiners look at how the credit union itself manages vendor risk. Strong contract terms, documented due diligence, and ongoing monitoring are what demonstrate that oversight.

Frequently asked questions

Do we need to assess AI features in systems we already use?

Yes. When a vendor adds AI to an existing product, treat it as a new use: confirm the data terms, assess the risk, and approve it before turning it on.

What is the single most important question to ask?

Whether your member data will be used to train the vendor’s models. The answer affects privacy, confidentiality, and your obligations to members.

More Guides for Credit Unions and Lenders

Sources

How this guide is built

Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.

Cite this guide

Cogent Assurance. (2026). AI Vendor Assessment Checklist for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-vendor-assessment-checklist-credit-unions

Report an issue

See something out of date or incorrect? Tell us and we’ll review it.

Report an issue with this guide

This guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.

AI Vendor Assessment Checklist for Credit Unions

What good answers look like

Checklist

Member data and privacy

Security

Model performance and fairness

Contract terms

Why the contract matters more at a credit union

Frequently asked questions

Do we need to assess AI features in systems we already use?

What is the single most important question to ask?

More Guides for Credit Unions and Lenders

Sources

Services that help

AI Risk Review

AI Governance Readiness Assessment

Fractional Chief AI or Privacy Officer

Talk through your AI and privacy questions