What governance does your AI use case need?
A short self-assessment of the governance considerations your AI use case triggers. Four questions, two minutes, principle-based — not a determination of legal requirements.
What this check does
Produces a preliminary, principle-based read on governance practices to consider. The four questions probe what the use case does, how its outputs are used, what's at stake, and the materiality of failure. The result suggests a governance tier, not a regulator-prescribed classification. Credit unions should start with applicable technology-neutral law and NCUA-relevant guidance. Useful as a starting point for internal AI governance discussions, vendor evaluation conversations, and pre-examination self-assessment.
What it doesn't do
Does not constitute a regulatory compliance determination or substitute for your institution's legal and compliance review. The check is principle-based and framework-agnostic — it doesn't tell you whether you've met any specific binding rule, and it doesn't certify your governance practices to any examiner. NCUA has not issued AI-specific rules or regulations; existing legal obligations and institutional accountability still apply. SR 26-2 superseded SR 11-7 in April 2026. It is nonbinding bank supervisory guidance and excludes generative and agentic AI; that exclusion does not revive SR 11-7. The 2023 interagency third-party guidance was issued for banking organizations, not by NCUA. SR 24-2 is a voluntary community-bank resource. These bank references and voluntary frameworks can inform analysis, but are not direct, binding credit-union requirements. Your legal and compliance teams own the institution-specific applicability review.
Not legal or supervisory advice. Intended for internal AI governance discussions with risk, compliance, and technology stakeholders.