A practical guide to AI governance and board readiness for credit unions and community banks

For most credit unions and community banks, the question is no longer whether to use artificial intelligence. Staff is already using it to draft emails, summarize documents, and run analysis, sometimes on personal accounts the institution never approved. Vendors are switching on AI features inside products you already own. The real question is whether anyone is governing it.

There is no single AI rule to point to. Federal regulators have largely said that the rules you already follow apply to AI too: protecting member and customer data, managing vendors, lending fairly, and explaining credit decisions. At the state level, expectations are getting specific. Michigan’s financial regulator issued a bulletin in January 2026 spelling out what it expects from the banks and credit unions it oversees, down to the documents an examiner may ask to see.

Good governance does not slow adoption. It is what lets an institution move faster with confidence, because the board knows what is in use, staff knows what is allowed, and vendors are held to clear standards. This article covers where AI risk is showing up today, what regulators expect, what a practical governance program looks like, and ten questions every board should be able to answer.

The AI you already have

Ask a leadership team how the institution uses AI, and you will often hear “we haven’t really started.” Ask the staff, and you will hear a different answer. A loan officer pastes financial statements into a free chatbot to speed up an analysis. A member service rep uses one to polish a reply. A marketing coordinator drafts a campaign with one at home.

None of it is malicious, and most of it is useful. But when member or customer information goes into a consumer AI tool, the institution may have lost control of where that data is stored and whether it is used to train someone else’s model.

That is not a productivity question. It can be a data exposure event that triggers your incident response obligations: for credit unions, the response program required under Part 748, Appendix B of NCUA’s rules, and for banks, the Interagency Guidance on Response Programs.

The second source of AI is your vendors. Core, digital banking, fraud, and member service platforms are adding AI features, often through a routine release rather than a separate decision. If no one is tracking those features, no one is asking what data they use or how they reach their outputs.

Banning AI is rarely the answer, and it rarely works. The better path is to give people approved tools, usually paid business or enterprise tiers that contractually limit data retention and do not train on your data, along with clear rules for using them.

What regulators expect today

The regulatory picture is uneven, but the direction is consistent: AI is governed by the obligations you already have, applied with more scrutiny.

Michigan is worth reading even if you are not in Michigan

The bulletin does not prescribe one way to comply, but it describes what a regulator will look for. It expects every institution it covers to develop, implement, and maintain a written AI systems program, proportionate to the risk of each use, covering governance, risk management controls, and internal audit, with senior management accountable to the board. Even an institution that chooses not to formally use AI is expected, at a minimum, to have an employee acceptable use policy.

The bulletin also reminds institutions that they cannot outsource accountability to a vendor, and it lists what may be requested in an examination: the written program, an inventory of the AI systems and models in use, the due diligence performed on AI vendors, and the contracts themselves. That is a useful preview of where other examiners are likely to go.

Fair lending risk changed shape, but it did not go away

In 2025, the OCC, FDIC, and NCUA took disparate impact out of their fair lending exams, and a Regulation B rule effective July 21, 2026, removed the effects test. The Fair Housing Act still recognizes disparate impact, however, and state laws and private claims still reach unfair outcomes.

Michigan’s bulletin, for example, points to the state’s civil rights law. Any AI that touches credit decisions, pricing, or account decisions still needs testing and a person accountable for the results.

What good AI governance looks like

An effective program for a credit union or community bank does not need to be a binder no one reads. It needs six working parts.

1. 1. An inventory. Every AI tool and AI-enabled vendor feature: who uses it, what data it touches, and what decisions it supports. You cannot govern what you have not listed.
   2. A board-approved AI policy with acceptable use standards. Which tools are approved, which data is off limits, and which uses are permitted, written down as specific use cases. Personal AI accounts are off limits for institutional work, and outputs that affect a member, customer, or the books get human review.
   3. Risk tiers. Controls scaled to the stakes. Drafting a newsletter is not the same as informing a credit decision, and the program should say so.
   4. Vendor oversight. Due diligence that asks whether the vendor trains on your data, where the data lives and for how long, and whether the contract gives you audit rights, regulator cooperation, and prompt notice of unauthorized access. Ask every vendor for its own AI policy. A vendor that cannot produce one is telling you something.
   5. Board reporting on a set cadence. A short, regular AI report: what changed in the inventory, new use cases approved, policy exceptions or incidents, vendor reviews completed, and training status.
   6. Training for staff and executives. Practical sessions on how to use the approved tools well, what not to do, and why. Most AI risk is a people risk, and most of it is solved by people knowing the rules.

Ten questions your board should be able to answer

1. 1. What AI tools are in use today, including features inside vendor products?
   2. Which of them touch member or customer data?
   3. Is there an approved tool list, and do staff know it?
   4. Has institution data ever gone into a personal or free AI account?
   5. Do our AI vendors train their models on our data?
   6. Do our contracts give us audit rights, regulator access, and breach notice for AI services?
   7. Where does AI influence a decision about a member or customer, and who reviews it?
   8. Could we explain an adverse action that a model influenced?
   9. Who owns AI risk, and how often does the board hear about it?
   10. What would we hand an examiner who asked for our AI program tomorrow?

Governance is what lets you move faster

Governance is not only about saying no. The institutions that get it in place first are the ones that can say yes to the right uses with confidence.

Member and customer service is a good example. AI can now handle a large share of routine questions, like password resets, balances, and branch hours, by text or by voice. Done well, it does not have to cost anyone a job. Service staff become the escalation point for the conversations that need a person, and the work gets more interesting. The same thinking applies to websites. Instead of making a member click through five pages to find a form, a site can simply answer the question.

Two lessons stand out from what we are seeing in the market. First, start from your own answers. Build member-facing AI on the approved answers your service team already uses, in your own voice, before turning on open-ended generative responses. It is cheaper, easier to control, and easier to defend.

Second, match the tool to the job. General-purpose models handle writing, summarizing, and everyday analysis well. Specialized tools make sense for narrow, high-volume work such as financial statement analysis. Most tasks do not need the newest, most expensive model, and building so you can switch models later keeps you from being locked in.

The same rule holds for any process you automate. Speed is the easy part. A person should still review every number before it reaches a member, a customer, or the board, and that review is the part every institution should protect.

The right use cases look different for every institution. A simple way to sort them is by value and by risk: start with high-value, low-risk uses, and revisit the list a couple of times a year as the tools and the rules change.

A practical path forward

Most institutions can put AI governance in place in phases, so leadership sees value early and the board stays informed throughout.

Build each phase to stand up to a board and an examiner, and end each one with something leadership can act on.

The bottom line

AI is already part of how your institution works. The only choice is whether it is managed on purpose or by accident. The institutions that put a simple, practical framework in place now will be ready for their next exam, will protect the member and customer data they have been trusted with, and will be the ones free to use AI where it actually helps.

A good place to start is the ten questions above. If your board cannot answer most of them today, a readiness assessment is the right first step.