NIST AI RMF for credit unions: a practical starting point

Credit unions tend to hit the AI governance question later than banks — smaller vendor budgets mean AI features arrive more gradually — but the exam pressure is catching up fast, and most CUs are starting from zero rather than extending an existing model-risk program. Here's the order we recommend, based on what actually moves the needle first.

Start with Map, not Govern

Most frameworks present Govern first because it's listed first. In practice, writing governance policy before you know what you're governing produces a document that doesn't match reality. Start by inventorying every AI system actually in production — including the ones baked into your core processing platform, member-facing chatbot, and any fraud or underwriting tool from a third-party vendor. This usually takes a week of conversations with IT, lending, and member services, and it routinely surfaces two or three systems no one had flagged as "AI."

Then write Govern around what you found

Once the inventory exists, governance policy has something concrete to attach to: who signs off before the next vendor tool goes live, and what "review" means for a system already in production. For most credit unions, this doesn't require a new committee — it's a standing agenda item on the existing risk or supervisory committee, with clear ownership.

Measure only what's proportional

A member-facing chatbot doesn't need the same testing rigor as a loan-underwriting model. Reserve deep bias and drift testing for systems that materially affect member outcomes — credit decisions, account actions — and keep monitoring lightweight for lower-stakes tools. Over-testing a chatbot wastes the exact limited capacity a small compliance team needs to spend on the systems that matter.

Manage means having an answer before you need one

The single most common gap we find at credit unions isn't a missing policy — it's the absence of an answer to "what happens when a vendor pushes an update and something breaks." Write down, in advance, who gets notified, who can pause the system, and what the fallback process looks like. It's a short document, and it's the difference between a contained incident and a scramble during an exam.

What this looks like on a board agenda

If AI governance is currently one line on next quarter's agenda, the realistic first deliverable isn't a finished program — it's the inventory, plus a one-page plan for the other three functions with rough timing. That's enough to show the board (and, eventually, an examiner) that the work is underway and sequenced, rather than starting cold when someone asks.

If you want the inventory done for you rather than pieced together internally, that's the starting point of our assessment work. See the AI Risk & Gap Assessment →