BOULDER CITY, Nev. — Credit union examiners are likely to move rapidly from asking whether institutions use artificial intelligence to assuming they do — and demanding evidence of governance, board oversight, vendor management and controls around the technology, two industry leaders said during the second installment of a seven-part webinar series.
“The AI Imperative: The New AI Examination Reality” webinar, hosted by The CU Daily and Mitchell Stankovic and Associates, examined how regulators are approaching AI and what credit unions should expect as the technology becomes embedded throughout their operations.
Below is just a partial look at what was discussed. For more information on accessing the webinar series–which is available at one price for everyone at the same credit union or, separately, on the same board, go here.
Jason Stverak, chief advocacy officer with the Defense Credit Union Council, said regulators currently are largely treating AI as part of broader risk management rather than as a separate examination category.
That is likely to change as adoption grows.
“They’re going to ask questions of whether the credit unions use AI. They’re just gonna assume that you do,” Stverak said of examiner expectations over the next 12 to 24 months.
Brian Lee, CEO of Arizona State Credit Union and a former NCUA employee, said regulators aren’t telling credit unions to avoid AI.
“It’s — make sure you understand what you’re getting yourself into,” Lee said.
Governance, Board Oversight Become Critical
Lee said current regulatory guidance isn’t dramatically different from expectations governing other third-party relationships, but AI introduces additional risks involving cybersecurity, data integrity, credit and liquidity.
Boards need to understand those risks and establish appropriate governance standards, including AI policies, he said.
AI also shouldn’t be viewed simply as an IT issue.
Lee cited lending as an example. If an AI system significantly increases loan production, a credit union must understand whether it has the liquidity and risk-management capacity to handle the resulting growth.
AI-driven underwriting also creates potential fair-lending concerns.
Credit unions don’t need employees or directors capable of understanding every algorithm or writing code, Lee said, but they must be able to explain how systems make decisions.
“The output is something that we still own,” Lee said. “We have to understand that we own this. We can’t put it off on someone else.”
Vendor Oversight Gets More Complicated
AI is also making third-party risk management more complex.
Lee said Arizona State has expanded its vendor-management process to determine not only how its vendors use AI, but also what other companies those vendors use and where member information may ultimately be stored or processed.
A data breach or other problem could originate with a vendor’s vendor, he said.
Stverak said that scrutiny will become increasingly important because responsibility ultimately remains with the credit union.
Effective governance today could also help limit the severity of regulation following an inevitable future AI-related problem, he said.
“There will be a problem sometime in the future that will cause government and regulators to step in,” Stverak said.
DCUC is advocating for a principles-based regulatory approach rather than detailed prescriptive rules that could quickly become obsolete as AI evolves.
“We want to make sure that innovation isn’t regulated out of existence before it has the opportunity to serve our members,” Stverak said.
AI Can Help With Exams, Too
Credit unions can also use AI to make the examination process more efficient.
Lee said Arizona State is beginning to use the technology to summarize information and help employees determine where to look when responding to examiner requests.
The credit union has also maintained an open dialogue with examiners when considering new AI applications and vendors.
Examiners can share practices they’ve observed elsewhere and explain what regulators will expect to see if a credit union adopts applications such as AI underwriting, Lee said, even though they won’t recommend specific vendors.
Expectations Likely to Rise
Stverak said he expects examinations over the next two years to bring stronger expectations for formal AI governance frameworks, documentation, board involvement, third-party oversight and continuing model monitoring and validation.
Congress also remains concerned about issues such as bias in AI-driven decisions, particularly in lending, he said.
“The AI is only as good as the data” used by the system, Stverak said, creating the possibility that institutions could produce discriminatory outcomes even when that wasn’t their intent.
Ultimately, AI doesn’t transfer accountability away from the institution, he said.
“AI is not responsible for the decisions,” Stverak said. “There needs to be a human at the end of the chain somewhere.”
Disappearing Act
Lee said the period in which credit unions can excuse gaps in their understanding because AI is new is also disappearing.
In the future, he said, credit unions will be expected to understand their policies, governance and how AI affects risk throughout the organization.
“There’s no more time in the future to be ignorant to how AI affects us,” Lee said. “I think we’re all going to have to be very well versed in how it affects our overall risk.”
