Can NCUA Examine Your AI Vendor? What Credit Unions Have to Document Themselves

No. NCUA has no statutory authority to examine technology service providers, and that includes AI vendors. Congress gave the agency temporary authority over vendors that expired on December 31, 2001. In May 2025, GAO's review of AI in financial services repeated a 2015 recommendation that Congress restore it. For a credit union, that means its own records of what an AI vendor receives, and how the vendor was vetted, are most of what an examiner has to review.

The question comes up whenever a credit union adopts an AI tool: if something goes wrong at the vendor, who looks? For banks there is an answer. For credit unions the answer is mostly the credit union.

What did GAO find about NCUA and technology vendors?

GAO-25-107197, published May 19, 2025, found that NCUA "lacks the authority to examine technology service providers," even as credit unions rely on them more for AI-driven services. GAO first recommended in its 2015 report (GAO-15-509) that Congress consider granting that authority. As of February 2025 Congress had not done so, and GAO reiterated the recommendation. GAO also found NCUA's model risk management guidance limited in scope and detail, and its recommendation to update that guidance remains open.

NCUA's own paper says the same. In a March 2022 paper, the agency traces the lapse to the sunset of its Examination Parity Act authority on December 31, 2001, and states that its Board's continuing policy is to seek third-party vendor authority from Congress. The paper explains that NCUA can reach a credit union service organization's books and records only through the contract the credit union holds with it, and that NCUA cannot directly enforce that access or start corrective action. It also notes that in 2016 the federal banking agencies ended NCUA's participation in FFIEC examinations of significant service providers, because NCUA lacks that authority.

How is that different for banks?

The federal banking agencies examine the service providers banks depend on. Under the Bank Service Company Act, services a bank has performed for it by contract or otherwise are subject to regulation and examination by the bank's federal banking agency, and the bank must notify the agency of the relationship within thirty days. NCUA's request to Congress uses language similar to that statute.

So a vendor serving banks can be examined by the banking agencies. The same vendor serving a credit union is outside NCUA's reach.

What does NCUA expect from a credit union that uses an AI vendor?

NCUA's AI resources page (last modified April 28, 2026) says credit unions may use AI tools and technologies, that NCUA has issued no AI-specific rules, and that existing regulations are technology-neutral and apply to AI use. A credit union that uses AI from a vendor must perform appropriate due diligence: understanding how the product works, the risks the AI introduces, and the vendor's safeguards, reliability and controls. The page points to two NCUA letters, 07-CU-13 (Evaluating Third Party Relationships) and 01-CU-20 (Due Diligence Over Third Party Service Providers). It says examiners review third-party due diligence as part of supervision, and that the board and management are responsible for oversight.

Letter 07-CU-13 asks a credit union to consider, among other things, the critical nature of the service and the vendor's level of expertise. Part 748 adds a clock: under the cyber incident notification rule effective September 1, 2023, a reportable cyber incident must be reported to NCUA as soon as possible and no later than 72 hours after the credit union reasonably believes it has occurred.

The responsibility sits with the board and management. The evidence sits in the credit union's own file.

Why can't a vendor contract carry that file?

Most credit unions answer the AI question with the contract. The agreement says the provider will not train on member data, will delete it after a set period, and will protect it while it holds it. Those are real protections, and a credit union should have them.

They describe what the vendor will do after it has received the data. They do not record what it received, in what form, or who could read it on arrival. When the examiner cannot inspect the vendor, a file made of the vendor's own promises is thin evidence. The data path is the one thing the credit union can document itself.

There is a second problem. AI now arrives inside tools a credit union already licenses: the core provider's assistant, the lending system's summarizer, the productivity suite's copilot. Each may sit on a foundation model from another company, and a vendor inventory that lists only direct relationships will miss it. Our earlier piece on what bank and credit union examiners now ask about AI covers the examiner questions this feeds into.

What questions should a credit union have documented answers to?

1. Where is AI in use today, including inside vendor products we already license?
2. For each use, what member data does the AI receive, and in what form?
3. Who can read that data when it arrives, including the foundation model company behind a vendor's tool?
4. What did we do to verify that, beyond the vendor's own statements?
5. Does our due diligence file map to NCUA letters 07-CU-13 and 01-CU-20 and to our Part 748 obligations?
6. If the vendor has an incident, how would we learn of it in time for the 72-hour notice, and what did the vendor already hold?
7. Who can shut each AI system off, and how fast?

What could change NCUA's authority over vendors?

Two things are in motion, and neither changes the position today.

On September 15, 2026, the OCC, the Federal Reserve, the FDIC and NCUA published proposed interagency third-party risk management guidance. It is a proposal, and comments are open for 60 days after publication, through November 16, 2026. The text does not mention AI.

Separately, on September 2, 2026, Rep. Bill Foster introduced the Strengthening Oversight for the Financial Sector Act, which would give NCUA and the Federal Housing Finance Agency authority to oversee third-party technology vendors used by the institutions they regulate. An earlier version passed the House Financial Services Committee in the 117th Congress without a floor vote, according to ICBA's coverage. Until a law passes, the position described above stands.

Where does confidential AI fit?

The documentation burden shrinks when the data is protected before it reaches the AI. That is how Nera is built: AI can be used on a credit union's most sensitive data while the data stays fully private and protected, and the AI never sees it. For the examiner, the answer to "what did the vendor receive" becomes a description of the architecture, not a promise in a contract. It also changes the shutdown answer, since cutting off a vendor that never held readable data leaves nothing to claw back.

If you handle risk, compliance or IT at a credit union and your last AI review ended with a contract, we would like to hear how it went. You can see how Nera works for financial institutions or book 20 minutes with Rami.

Sources

1. U.S. Government Accountability Office. (May 19, 2025). Artificial Intelligence: Use and Oversight in Financial Services (GAO-25-107197). gao.gov
2. National Credit Union Administration. (March 2022). Third-Party Vendor Authority. ncua.gov
3. National Credit Union Administration. Artificial Intelligence (AI) Resources, last modified April 28, 2026. ncua.gov
4. National Credit Union Administration. Letter to Credit Unions 07-CU-13, Evaluating Third Party Relationships. ncua.gov
5. Federal Register. (March 1, 2023). Cyber Incident Notification Requirements for Federally Insured Credit Unions (final rule, effective September 1, 2023). govinfo.gov
6. 12 U.S.C. 1867, Bank Service Company Act, regulation and examination of bank services. law.cornell.edu
7. Federal Register. (September 15, 2026). Proposed Third-Party Risk Management Guidance (91 FR 58536). federalregister.gov
8. Rep. Bill Foster. (September 2, 2026). Foster Introduces Bill to Improve Financial Sector Security Amid Rising AI. foster.house.gov
9. ICBA. (September 4, 2026). Bill Would Give NCUA Authority Over Credit Union Vendors. icba.org

Rami Akeela, Ph.D., is Founder and CEO of Nera Systems, a confidential AI infrastructure company. He holds PhDs in Electrical Engineering and Computer Engineering and has spent 20+ years in engineering and applied research. Nera Systems builds confidential AI infrastructure for organizations that cannot afford for their most sensitive data to be exposed to a model, a vendor, or each other.