BoardAlign
Menu
How it worksCredit unionsBanksResourcesAboutArrange a conversationClient login

Resources · Guide

AI oversight for boards: what to ask now

There are few AI-specific rules for credit unions and community banks. That makes the board's questions more important, not less.

Current as of October 13, 2026 · 3 minute read · Download the PDF

AI is already inside most institutions, often through vendor products rather than decisions the board saw: fraud scoring, chat, document reading, lending models. The rules have not caught up, and that gap leaves directors to set the standard themselves.

Where the rules stand

  • Credit unions: NCUA has said it has not issued AI-specific rules, and that its existing regulations are technology-neutral and apply to AI use (NCUA AI resource page, updated April 2026).
  • Banks: in April 2026 the OCC, Federal Reserve and FDIC replaced their model risk management guidance (Federal Reserve SR 26-2). The new guidance is not an enforceable standard, is aimed mainly at organizations with more than $30 billion in assets, and leaves generative and agentic AI out of scope. The agencies said they plan to ask for information on AI use.
  • Frameworks: the NIST AI Risk Management Framework 1.0 (2023) organizes AI risk into four functions: Govern, Map, Measure and Manage. NIST added a Generative AI Profile in 2024. In February 2026, Treasury released a Financial Services AI Risk Management Framework that adapts the NIST framework for financial institutions.

Five questions for management

  1. Do we have a written inventory of the AI in use, including AI that arrived through a vendor product update?
  2. Has the board approved a policy for AI use, and who is the accountable executive?
  3. Where does AI make or shape decisions about members or customers, such as lending, fraud or service, and how are those decisions checked?
  4. Is our data used to train a vendor's models, and did we agree to that?
  5. How would we know if an AI system started to behave differently?

Keep it proportionate

A community institution does not need a model risk department. It needs to know where AI is, who owns it, and what the board will hear about it. NIST's Govern function is a good place to start: roles, policies and accountability, before any technical measures.

BoardAlign asks directors what they know about AI in the institution, and checks it against the inventory, the policy and what the board has been told. Frameworks are cited as recognized practice, never as requirements.

Sources

  1. NCUA, Artificial Intelligence resource page
  2. Federal Reserve SR 26-2, Revised Guidance on Model Risk Management (April 17, 2026)
  3. NIST AI Risk Management Framework
  4. US Treasury, Financial Services AI Risk Management Framework and AI Lexicon (February 19, 2026)
  5. GAO-25-107197 (May 2025)

General information for directors, not legal advice. Current as of October 13, 2026. Rules change: check the cited source before relying on it.

More for directors

Guide

Questions every director should be able to answer

Twelve questions from our director questionnaire, one set for each part of cyber oversight, with what a well-supported answer looks like.

Explainer

Part 748, the OCC and the FDIC: what the board must see

The board's information security duties for credit unions and banks, side by side, with the citations.

Guide

What a good cyber report to the board looks like

One page the board can read in a meeting: what it should contain, how often it should arrive, and the signs it is not doing its job.

See how your board's record measures up.

A short conversation is the fastest way to see whether it fits.

Arrange a conversation