What NCUA Examiners Ask About Your AI Agents in 2026

Key takeaways:

• Build a complete AI inventory. Track every AI agent, its owner, data access, permissions, validation status, and escalation procedures.
• Strengthen governance and vendor oversight. Document risk assessments, human oversight, security controls, and third-party due diligence to demonstrate compliance with existing NCUA requirements.
• Make AI agents auditable. Maintain records of member disclosures, authentication, agent actions, human handoffs, and interaction histories to support effective oversight and examinations.

---

The credit union sector is growing year over year. As of March 31, 2026, there were 4,250 federally insured credit unions with 145.8 million members, and total assets grew by $117 billion, or 4.9%, over the year to reach $2.48 trillion.

The National Credit Union Administration (NCUA), an independent federal agency created by the U.S. Congress in 1970, insures deposits at federally insured credit unions, protects the credit union members, and charters and regulates federal credit unions. 

The NCUA’s primary function is to identify and assess credit union system risks, threats, and vulnerabilities and determine the magnitude of such risks and mitigate unacceptable levels of risk through its examination, supervision, and enforcement programs. Certainly, these responsibilities are relevant in the artificial intelligence era. 

If you’re a CIO at a federally insured credit union deploying AI agents to handle member calls, process loan applications, or flag suspicious transactions, NCUA examiners will want to know how those agents are governed.

NCUA examiners conduct their AI reviews within the frameworks that already apply to NCUA-insured credit unions: safety and soundness, compliance with existing laws, internal controls around the technology, ongoing risk monitoring, and third-party due diligence. The agency states its position on its Artificial Intelligence resource page (last updated in April 2026): “NCUA has not issued AI specific rules or regulation. However, existing regulations are technology-neutral and apply to AI use.”

The NCUA’s 2026 Supervisory Priorities letter mentions six priorities: lending and credit risk, interest rate and liquidity risk, earnings and capital adequacy, payment systems, fraud prevention, and compliance risk management. All of them are impacted by AI. If an agent touches loan decisioning, it becomes a lending and fair lending issue. The letter also says examiners assess third-party risk management when lending, servicing, or collection functions are outsourced. If an agent moves money, the payment system priority comes into play, with examiners looking at governance, risk assessments, vendor management, and security. If it screens transactions, BSA requirements apply.

As AI will be evaluated under the existing rules that apply to your systems, you need to demonstrate that your controls, oversight, monitoring, and risk management extend to the AI systems your credit union uses.

What NCUA’s AI Governance Reveal About Examiner Expectations

NCUA published its AI Compliance Plan in September 2025, outlining how the agency governs its own use of AI internally. The plan itself creates no obligations for credit unions, but it is revealing in context. It offers the public view of what NCUA considers comprehensive AI governance to look like.

1. Maintain a shared AI inventory and library.

“NCUA promotes the sharing and reuse of AI among all offices through its centralized AI Use Case Inventory, accessible to all NCUA staff and the public via NCUA.gov.”

How credit unions could apply it:

• Track every AI system in use, including AI features embedded in existing platforms.
• Maintain a library of approved, reusable components to cut duplication and speed up future reviews.

2. Establish clear AI governance and review.

“Annually, each office must provide detailed information about current and proposed AI applications for security, privacy, and technical reviews by the Chief AI Officer, CIO, Senior Agency Information System Risk Officer, and Senior Agency Officer for Privacy, to minimize duplicative initiatives and verify policy compliance.”

How credit unions could apply it:

• Form an AI leadership committee to coordinate initiatives and catch duplication early.
• Involve enterprise architects and CISOs so new AI systems align with existing architecture, security, and governance requirements.

3. Prepare for higher-impact AI use cases.

“NCUA reviews each current and planned use of AI to identify high-impact opportunities. While the agency hasn’t created additional criteria for what counts as high-impact, it will implement minimum risk management practices.”

How credit unions could apply it:

• Identify where AI could have a material impact on members or operations.
• Apply governance and controls proportionate to that impact, even without a formal risk tier defined yet.

4. Create a formal exception process.

“NCUA is establishing a formal process for issuing, denying, revoking, certifying, and tracking waivers, with oversight by the Chief AI Officer and relevant governance bodies.”

How credit unions could apply it:

• Document why an exception was granted, who approved it, and when it expires.
• Review open exceptions on a set schedule and revoke any that are no longer justified.

5. Treat compliance as non-negotiable.

“AI systems that don’t meet operational, ethical, or regulatory requirements will be terminated. NCUA’s process: restrict access, isolate or shut down the system, archive data, document the decision, and notify stakeholders.”

How credit unions could apply it:

• Build compliance checks into every stage of an AI project’s lifecycle, not just at launch.
• Treat a failed compliance check as a dealbreaker, regardless of the system’s business value.

Taking Inventory on AI Solutions Comes First

The first step in AI governance is knowing what is already in the environment. AI may enter a credit union through a technology purchase, a vendor update, or a new feature added to a platform the organization already uses. When an examiner asks about AI controls, the credit union needs a clear picture of the systems those controls cover.

Many credit unions do not have a complete inventory of AI solutions. A contact center may include AI as part of a vendor solution. A core provider may introduce new AI capabilities through a product update. A marketing platform may enable an AI feature without a new contract or procurement review. Gartner’s April 2026 guidance on managing AI agent sprawl projects that the average global Fortune 500 enterprise will run more than 150,000 agents by 2028, up from fewer than 15 in 2025. Credit unions operate at a different scale, yet the underlying trend still applies: more agents are coming.

A defensible AI inventory should record for each agent including a named owner, the underlying model and hosting location, the systems and member data it can access, the actions it can take without human approval, its escalation path, the date of its last validation, and whether AI use was disclosed during procurement.

What Examiners Ask About Your AI Vendors

NCUA’s AI guidance points examiners and credit unions toward four basic areas of due diligence:

• Understanding how the product works;
• Identifying the risks it introduces;
• Assessing how it fits the credit union’s business model;
• Reviewing the vendor’s safeguards, reliability, and controls.

NCUA specifically points to its resources on third-party vendors that provide AI services (07-CU-13, Evaluating Third-Party Relationships and 01-CU-20, Due Diligence Over Third-Party Service Providers) as the foundation for this review.

A credit union should be able to explain what the system does, what data it receives, where that data goes, what decisions or actions the system can influence, and what happens when it fails. The review should also cover the vendor’s monitoring, security controls, model changes, incident response, and ability to support the credit union when something goes wrong. NCUA emphasizes that the level of due diligence should reflect the credit union’s size, complexity, and risk profile.

The board and management remain responsible for oversight even when an outside provider operates the technology.

How to Document Voice Member-Facing AI Agents

Voice member-facing AI agents need clear documentation because the conversation itself may become part of the member experience, the decision process, and the audit trail. A strong record should show how the agent interacts with members, what it is allowed to do, where human oversight comes in, and how the credit union can reconstruct what happened after the fact.

Documentation should cover:

• Disclosure: When and how members are told they are interacting with AI.
• Authentication: How the member’s identity is verified before the agent provides account information or takes action, including safeguards against synthetic voice and other forms of impersonation.
• Boundaries: Which actions the agent can complete on its own and which require human approval.
• Escalation: What triggers a handoff to a person, with communication fabric maintaining context as the interaction moves between voice, chat, email, or other channels.
• Context and continuity: How relevant member history and preferences are carried across interactions so members don’t have to repeat information when moving between channels.
• Retention: How transcripts, decision logs, model versions, and other interaction records are stored and retained, with enough history to reconstruct what happened when needed.

The same documentation should support both day-to-day oversight and examination. If an agent handles a member interaction, the credit union should be able to determine what the agent was asked to do, what information it accessed, what action it took, and when a person became involved. NCUA also points credit unions to FinCEN guidance on deepfake fraud for relevant red flags, making authentication and impersonation controls especially important for voice-based systems.

How AI Governance Makes NCUA Exams Easier

By the time an examiner asks about AI, many credit unions have been using it for a while. Wipfli’s 2026 survey of 100 credit union executives found that 66% are actively implementing AI solutions, while 16% reported having an enterprise-wide AI roadmap that includes governance frameworks and measurable business impact. Adoption moved first. Oversight is still catching up, with 47% of respondents naming data readiness, quality, and governance among their top barriers to AI adoption.

Credit unions that build their controls early get two things in return. The exam becomes a retrieval exercise because the inventory, approval records, validation dates, and shutdown procedures already exist in a form leadership can hand over. Problems also surface internally, on the credit union’s own timeline. For example, a model has drifted, an agent still has access it no longer needs, or a vendor has added a feature that hasn’t been reviewed. Each is a maintenance issue when the credit union finds it and a documented finding when the examiner does.

FAQs

1. What does NCUA look for when examining AI use at credit unions?

NCUA examiners evaluate AI under the existing rules that apply to credit unions, including safety and soundness, compliance, internal controls, risk monitoring, and third-party risk management. Credit unions should be able to show that these controls extend to the AI systems they use, including vendor-provided AI.

2. What should a credit union include in its AI inventory?

A credit union’s AI inventory should cover every AI system in its environment, including AI features embedded in existing platforms. For each system, document the owner, underlying model and hosting location, data and systems it can access, actions it can take without human approval, escalation path, last validation date, and whether its AI use was disclosed during procurement.

3. How should credit unions prepare AI systems for an NCUA examination?

Credit unions should maintain records of AI approvals, validation, risk assessments, vendor due diligence, member-facing interactions, and shutdown procedures. For voice AI, documentation should also cover disclosure, authentication, action boundaries, escalation, context continuity, and retention so the credit union can reconstruct what happened during an interaction.