ARAI Readiness
for Credit Unions

Monthly report for AI readiness for credit unions: August 2026

First edition of this report. Sources are linked throughout so you can check everything yourself rather than taking our word for it.

Regulator watch

NCUA issued no AI-specific rule in August, and nothing AI-specific appears on its published rulemaking agenda as of this writing. The agency's active rulemaking energy went to digital assets: a proposed rule on stablecoin issuer customer identification programs closed its comment window on August 21. AI oversight continues to run through frameworks you already know, meaning vendor management, fair lending, BSA/AML, and the 72-hour cyber incident notification rule.

The more consequential signal came from the banking agencies earlier this year and still defines the ground in August. The revised interagency model risk guidance that replaced SR 11-7 explicitly does not cover generative or agentic AI, and the agencies have promised a request for information on bank AI use. American Banker's July reporting confirms supervisors still have not decided how to examine agentic AI even as core providers race ahead. That ambiguity does not let you off the hook. Until the agencies publish a standard, an examiner with questions about your generative tools will fall back on your own policies and records, and finding none is its own answer.

One item from abroad is worth a line in your vendor files. The EU AI Act's high-risk regime, which covers credit scoring, became applicable on August 2. It does not bind a US credit union, but any vendor selling AI decisioning globally now builds to EU explainability standards. Ask for that documentation. If they produce it for European buyers, they can produce it for you.

Five deployments worth studying

Desert Financial credited AI document processing from MeridianLink and Informed.IQ for a 66% increase in indirect auto loan funding capacity, with overtime eliminated in the funding department. The figure comes from the credit union and its vendors rather than an independent audit, but the shape of the claim (a named process, a baseline, a percentage) is what your board should ask every AI proposal to match.

Technology Credit Union ($4.5 billion, San Jose) selected eGain's AI Knowledge Hub to centralize enterprise knowledge before scaling AI on top of it. The stated logic was that AI output is only as trustworthy as the knowledge underneath it. Fixing the knowledge base first is the most examiner-friendly sequencing decision a credit union can make.

Municipal Credit Union ($4.6 billion, New York) is building its own member chatbot for launch within a year, and is separately working on being discoverable when consumers ask ChatGPT-style assistants for financial guidance. The same article notes more than half of Americans now use AI to help with financial decisions, up from roughly one in ten a year earlier.

Communication Federal Credit Union ($2.3 billion, Oklahoma City) went live on Scienaptic's AI credit decisioning platform in July. Scienaptic signed two more credit unions in August, including one expanding from underwriting into fraud detection. Decisioning AI has clearly reached institutions under $1 billion.

Clutch announced that credit unions running AI on its platform now serve 30 million members, including six of the ten largest credit unions. Whatever you think of the consolidation pitch, the adoption math is no longer a fringe story.

Worth noting: four of the five are back-office or infrastructure moves, and the decisioning AI arrived through vendors rather than internal builds. Municipal is the only one building member-facing tech, and even they scoped the first release to product questions.

Insight: the questions examiners are actually asking

NCUA's 2026 supervisory priorities never say "artificial intelligence" in a headline, yet AI questions now show up inside ordinary exam threads: vendor management, BSA/AML, information security, and board governance. Mapped to the five readiness pillars this site scores, the questions cluster predictably.

Strategy. Who owns AI at your credit union, and when did the board last see a report on it? A blank stare here colors the rest of the conversation.

Data. Which member data can AI tools touch, where does it go, and who verified the vendor's answer? Expect the follow-up: show me the data flow description in your due diligence file.

Governance. Do you keep an inventory of AI systems in use, including features your existing vendors switched on? Has the board adopted a policy that says what is permitted and what is prohibited?

Operations. What happens when the tool is wrong or down? Examiners want a documented fallback and evidence someone reviews outputs, not assurances that the vendor handles it.

People. Is there an acceptable use policy for generative AI, has staff acknowledged it, and who reviews AI-assisted work before it touches a member or a regulator-facing document?

Notice what is absent: nobody asks about model architecture. The tested surface is documentation and ownership. A useful self-test is turnaround time. How long would it take you to produce each artifact above? Anything over a day of scrambling is a weak point, whatever an examiner ultimately writes up. The self-assessment scores exactly these five pillars.

The AI you did not buy

The sharpest readiness development of 2026 is that AI now arrives through platforms you already run. Each of the three biggest core providers has paired with a major AI lab: Fiserv with OpenAI, FIS with Anthropic, and Jack Henry with Google, whose agentic security tooling now sits behind roughly 7,400 community institutions. Those cores run systems for well over half of US depositories. Add MeridianLink and Informed.IQ shipping document AI inside the LOS, and Fiserv embedding agentic AI in receivables through its August partnership with Stuut. A routine platform update can now put an AI feature into production before your review process has even heard of it.

Your vendor management program almost certainly has no trigger for that. The fix is one sentence in your third-party risk procedure: any vendor notice describing a new AI capability opens a review before the feature goes live, covering what data it touches, how members are affected, and what documentation exists. When the core contract comes up for renewal, evaluate the bundled AI the same way you would evaluate a brand new vendor, because that is what it is.

Shadow AI is a readiness problem, not an IT problem

The 2026 numbers hardened this summer. Regular AI use on corporate devices tripled in a year, from 15% to 45%, and two thirds of that use runs through personal accounts your controls never see, per the Verizon data breach report. In May, a bank holding company filed what is believed to be the first SEC disclosure of a cyber incident caused by an employee's unauthorized AI use rather than an external attack. Reporting this summer found unlogged AI tools drafting suspicious activity report narratives at financial institutions, in workflows BSA officers never reviewed.

For a federally insured credit union, the analog is uncomfortable and specific: member data pasted into an unapproved tool may be a reportable event under the 72-hour rule, and AI-assisted-but-undocumented BSA work sits inside a named 2026 exam priority. Written bans are not holding anywhere. The credit unions in decent shape gave staff a sanctioned, logged tool before they tightened enforcement. The ones that banned first are finding the usage anyway, in browser histories, months later.

The September checklist

  1. Add the AI feature change trigger to your vendor management procedure.
  2. Ask your core provider, in writing, which AI capabilities are on your roadmap and which are already active.
  3. Pull the five examiner questions above into a tabletop exercise with your compliance officer. Time how long each artifact takes to produce.
  4. Count the AI tools in actual use, sanctioned or not. Browser and network logs will surprise you.
  5. If you have not scored yourself yet, take the readiness assessment. It takes ten minutes and maps to the same five pillars examiners probe.

Credit unions that want outside validation of their score typically start with a fixed-scope AI readiness audit from Advisor Labs, which tests the same pillars against documents and interviews instead of self-reporting.

The September report will track the promised interagency RFI, NCUA's fall agenda, and whatever the core providers switch on next.