Credit union or vendor: who has the answer when the AI says no?

An industry contact put that question to me about auto loans. The fault version is one for counsel, not me. But NCUA has already put in writing where oversight sits, and with AI lending vendors announcing credit-union partnerships, at least one aimed at smaller credit unions, it is worth reading closely.

NCUA has issued no AI-specific regulations. Its rules are technology-neutral, so they apply whatever sits behind the loan. A credit union using a vendor’s model is expected to do due diligence on how the product functions, what risks it introduces, and what safeguards and controls the vendor has. In NCUA’s words, “the credit union’s board and management must ensure proper oversight to maintain safe and sound operations.”

The practical question, then: what record can the credit union produce of that decision, and what does its contract oblige the vendor to hand over when a member asks, or to give notice before it changes, replaces, or subcontracts the model behind the decision?

A credit union with no compliance department does not need to build one for this. It needs a small standing body, the CFO or controller and one or two people it already has, meeting on a cadence, reporting to the board, and owning that record: the due diligence above, documented and current, the contract terms behind it, and a re-check on a schedule or whenever the vendor gives notice.

Written for compliance and risk readers in regulated financial firms. Informational, not legal advice; Mike Bidun is not a lawyer.