Randy Lindberg
I keep hearing the same sentence on calls with credit union leaders, and I understand exactly why they say it: "The NCUA hasn't told us what to do about AI, so we're waiting."
I want to talk you out of that position, because I think it has the logic exactly backwards. The absence of guidance is not permission to wait. It is the cheapest window you will ever get to build the program on your own terms.
Quick answer: The NCUA has not issued dedicated AI regulation, but examiners already ask about AI through lenses that have existed for years: vendor management, model risk, data governance, and incident response, and NCUA RISOs point to NIST frameworks by name. The defensible minimum today is five artifacts: a named owner with a committee home for AI decisions, an AI inventory including vendor-embedded features, an AI security policy, AI questions in your vendor due diligence, and an incident plan that covers AI failures that are not breaches. All five are inexpensive now and expensive under a deadline later.
AI Governance Resources For Financial Insitutions
Built for lean security teams at credit unions and banks
The regulator is not actually silent
Here is the thing. When people say the NCUA is silent on AI, they mean there is no document titled "AI Rule." True. But we host an annual panel with NCUA Regional Information Systems Officers, and I would encourage anyone in the wait-and-see camp to listen to how they talk about AI right now. On this year's panel, a RISO laid it out: lean on frameworks like NIST, AI still comes down to the basics of network permissions, data access, and the controls around those touchpoints, and the vendor products now arriving "laden with AI features" need to be vetted like anything else. He even praised a specific pattern he is seeing: institutions taking baby steps, opening a new AI tool to a small segment of staff, training them, watching how it goes, then expanding. That is not an agency with no expectations. That is an agency telling you the rubric before the test. Worth noting the NCUA's own website already points institutions to the NIST AI RMF.
And it is showing up in exam rooms, not just panels. A CISO on our March panel described his most recent NCUA exam: first the examiners asked whether he even had an AI policy, then what he was doing about governance and how. Another said AI governance questions were the new item in his latest exam, outside the ordinary. Every one of those is an AI question wearing an old lens: vendor management, data governance, model risk, training, incident response. The frameworks that already bind you do not stop applying because the technology is new, and the examiners who see one credit union with a real AI program will start expecting it from the next ten.
Waiting has a price; being early barely does
I think about this the way I think about any risk decision: what does each path cost?
Being early costs you a few weeks of work. An inventory, a policy, some added vendor questions, a tabletop scenario. Small dollars, mostly staff time.
Waiting costs you nothing today, which is the trap. The bill arrives later, in one of three forms: an exam finding with a remediation deadline, an AI incident with no plan behind it, or a scramble to retrofit governance onto tools your staff adopted years earlier. And retrofits are always the expensive version, because by then the AI is load-bearing. You are not writing rules for a tool you might adopt. You are un-adopting habits.
The analogy I keep coming back to is brakes on a car. Brakes look like the thing that slows you down, but applying them at the right times is what lets you drive fast overall. Without brakes, the risk of a crash is near certain, so you would choose not to drive at all, which is exactly what the institutions blocking AI outright are doing. AI governance is the brakes: it is not the department of no, it is the mechanism that lets your credit union adopt AI faster than the peers who either floored it with no controls or never left the driveway.
Put it in dollars, because that is how these decisions should be made. A policy and inventory effort might cost a few thousand dollars of time. A single ungoverned AI failure that reaches members, a wrong decision, leaked data in a prompt, a hallucinated communication, carries loss exposure orders of magnitude beyond that. When the ratio between prevention cost and exposure is that lopsided, waiting is not prudence. It is just an unexamined bet.
The defensible minimum: five artifacts
You do not need a moonshot program. You need five things an examiner can hold.
1. A named owner and a home for decisions. Before any document, answer one sentence: who owns AI risk here? The NIST AI RMF puts this first for a reason, requiring documented roles and executive accountability before anything gets mapped or measured. In practice, ownership most often lands with the CIO, and the decisions live in either a standalone AI committee or an existing ERM, InfoSec, or IT steering committee that adds AI to its agenda. Both work. Quarterly is the right cadence for most, monthly if you are onboarding new AI systems regularly. What does not work is a policy nobody signed and a committee that has never met, which describes most of the AI governance programs I see.
2. An AI inventory. Everything in use, including the AI features that arrived inside vendors you approved years ago, which is where most of it hides. If you have only sanctioned one tool, I promise the real list is longer. Our guide to finding shadow AI walks the three discovery sources, and it is a two-week project, not a two-quarter one.
3. An AI security policy. What is permitted, what is prohibited, what data can touch which tools, who approves new uses. One document, board-adopted, and a useful pattern we have seen work: a board-approved policy paired with a management-level playbook that can change without board approval, so the rules keep pace with the tools. This is the artifact examiners ask about first, and it is the difference between "we're figuring it out" and "here is our program."
4. AI questions in vendor due diligence. Does the vendor use your data for training, can the AI features be disabled, is there human review, how are you notified of model changes. Ask them at onboarding and at renewal, and re-review any vendor that adds AI regardless of its renewal date. And decide now what happens when a vendor refuses to answer: assume the controls are not there, weigh criticality, and if you keep them anyway, document the risk acceptance formally so your examiner sees a decision instead of a gap.
5. An incident plan for non-breach AI failures. Your IR plan covers a breach. It probably does not cover an AI tool giving a member wrong information or a model influencing a decision incorrectly. Add the scenario, name the owner, and tabletop it once.
That is the whole minimum. A team of two can stand it up in a quarter.
Make it part of the risk program, not a side binder
One more opinion, and it is the one I hold most strongly: do not build AI governance as a separate binder that gets dusted off for exams. Fold it into the risk program you already run. In Rivial Software, that is exactly how it works: AI systems sit in the same inventory as everything else, AI risks are assessed with the same quantified model, and the exposure shows up in the same board report, in dollars. When your board sees "member-facing AI: modeled expected annual loss of $150,000, within tolerance after controls" next to the same math for ransomware and vendor risk, AI stops being a mystery topic and becomes another number they can govern. That is speaking the language of business, and the security leader who brings that view to the boardroom before the regulator forces it is the one who gets treated as a strategic partner.
Start with the policy, today
Of the four artifacts, the policy is the fastest win and the one everything else hangs from. Kickstart yours with our free AI Information Security Policy Template: the structure, the permitted-use language, and the governance sections, ready to adapt to your institution. Instant download, no sales call required.
Here are the key takeaways from this blog:
- Silence is not absence: NCUA RISOs point to NIST frameworks by name, exam rooms are already asking for AI policies and governance, and consistency is coming.
- The cost asymmetry decides it: governance now costs weeks of staff time, while retrofitting under a finding or after an incident costs multiples more. Governance is the brakes that let you drive faster, not the department of no.
- Five artifacts are the defensible minimum: a named owner and committee, an AI inventory, an AI security policy, AI vendor questions, and a non-breach AI incident plan.
- Govern it in dollars: fold AI into your quantified risk program so the board sees AI exposure as a number beside every other risk, not a mystery.
AI Governance Resources For Financial Insitutions
Built for lean security teams at credit unions and banks