--- title: "AI governance for credit unions · Innorve" description: "Find the AI already in your credit union, put a name on every use, fence in agents so a person decides, and keep the record your examiner reads." url: "https://innorve.ai/ai-governance" type: "page" --- AI governance · for credit unions ### “The board wants AI, but safely.” # Here’s what safely looks like. Four moves, in order. Find the AI already in your credit union, including what your vendors switched on. Put a name on every use. Fence in agents so a person makes the decisions. Keep the record your examiner reads. [Take the check](https://innorve.ai/ai-readiness) [Get a first read](https://innorve.ai/contact) Find · Own · Fence · Prove 01 · Find ## It’s already in the building. Most of the AI in a credit union arrived without a project: a chatbot your digital banking vendor switched on, a copilot in staff email, a free chat tool someone found. The inventory starts by writing down each one, and how you know it’s there. An imaginary credit union · the tags are the ones the readiness check uses - Member chatbot in digital banking Digital and branch Vendor told us - Call transcription and agent assist Call center Seen it in our systems - The lending vendor’s credit model Lending Vendor told us - Copilot in staff email and documents Back office Seen it in our systems - Fraud scoring in the card platform Back office Vendor told us - A free AI chat tool staff found Outside the walls Staff told us 02 · Own ## A name on every use. For each use, five answers in writing and one named owner. They are the same five questions to ask any vendor about an AI feature. Pick a use to see its answers. Member chatbot in digital banking Call transcription and agent assist The lending vendor’s credit model Copilot in staff email and documents Fraud scoring in the card platform A free AI chat tool staff found ### Member chatbot in digital banking Owner: Member experience lead What it reads Member questions, and the balances and transactions of a signed-in member. Where it runs In the digital banking vendor’s cloud, with its model provider. Who reviews it The member experience lead reads a sample every week. Anything that sounds like a dispute goes to a person. What record it leaves Chat transcripts, in the vendor’s console. How to switch it off A setting in the vendor’s admin console. The member experience lead can turn it off. ### Call transcription and agent assist Owner: Contact center manager What it reads Live call audio, and the member’s profile on the agent’s screen. Where it runs In the contact-center platform’s cloud. Who reviews it The contact center manager spot-checks suggested answers every week. What record it leaves Transcripts and suggestions, stored with each call. How to switch it off A feature switch in the contact-center platform. ### The lending vendor’s credit model Owner: Chief lending officer What it reads Applications, credit reports and account history. Where it runs In the lending platform vendor’s environment. Who reviews it The chief lending officer approves overrides. Compliance checks that denial reasons match what the model used. What record it leaves A decision and reason codes for every application. How to switch it off Go back to the written underwriting guidelines. The vendor setting and who can change it are on file. ### Copilot in staff email and documents Owner: IT manager What it reads Whatever the signed-in employee can open: email, files and chats. Where it runs Inside your own Microsoft 365 tenant. Who reviews it IT reviews who holds a license every quarter. Staff check every draft before it goes out. What record it leaves The Microsoft 365 audit log, once auditing is on. How to switch it off Remove the license, or turn it off for everyone in the admin center. ### Fraud scoring in the card platform Owner: Fraud operations lead What it reads Card transactions and device signals. Where it runs In the card processor’s network. Who reviews it Fraud analysts work every flagged case. What record it leaves Scores and alerts, in the processor’s case tool. How to switch it off Only the processor can. That’s why the contract names who you call, and how fast they answer. ### A free AI chat tool staff found Owner: Information security officer, assigned in week one What it reads Whatever someone pastes in, including member details if nobody said not to. Where it runs On the tool’s servers, under its own terms. Who reviews it Nobody, yet. That’s the finding. What record it leaves None that you control. How to switch it off Block it at the web filter, and offer an approved tool in its place. [Read: Five questions to ask about a vendor’s AI feature →](https://innorve.ai/vendor-ai-questions) 03 · Fence ## An agent tries to move money. This is how we build agents. The agent does the routine work. The decisions a person is accountable for stay with a named person, and the agent can’t cross that line. Scroll through one morning. Estate intake agent · illustrative The line. Money movement, changes to a member’s record and messages to members stay with a named person. 09:02 open case estate/1187 → allowed · logged 09:03 read accounts member/5520 → allowed · logged 09:05 draft checklist → allowed · waits for a person to send it 09:06 transfer $4,200 → stopped: money movement needs a named person · sent to Dana R., estate specialist 09:31 decision by Dana R. → hold · reason: no executor’s letters yet 09:32 case estate/1187 → complete record - 09:02 A death notice arrives. The agent opens an estate case with the notice attached. Allowed - 09:03 It maps the member’s accounts. Checking, a car loan and two cards, read-only. Allowed - 09:05 It drafts the family’s checklist. Death certificate, the executor’s letters, a claim form. A draft, not sent. Allowed - 09:06 It tries to release $4,200. The funeral home sent an invoice. Paying it moves money, so the agent stops at the line. Stopped at the line - 09:31 Dana decides. The executor’s letters haven’t arrived, so she holds the payment and tells the family what’s missing. A person decides - 09:32 One record. What the agent did, what it tried, who decided and why, in your own security logs. On the record Illustrative · based on a proposed workflow in our Casebook · Dana R. and the member are fictional ### Every agent we build, the same way. - 01 It never holds your passwords. The login is added on the way, only to the system it belongs to. - 02 It reaches only the systems you approve. Anything else is blocked before it leaves. - 03 It can’t move money, change a member’s record or message a member on its own. A named person decides, and their decision is recorded. - 04 One switch stops it. Your named owner holds it. We test it before the agent goes live. - 05 Every request it makes is in your record. Allowed or stopped, in your own security logs. [See the full case: Deceased Member Care →](https://innorve.ai/casebook?open=A2) Try it yourself ## Ask the agent to do something it shouldn’t. A simulation · no AI, no real systems Email the file to my personal address Change the member’s mailing address Pick a request. The agent is waiting. “Read the member’s accounts” Allowed Read-only, and logged. 09:40 read accounts member/5520 → allowed · logged “Release the funds” Sent to a person Money movement always goes to a named person. 09:41 transfer $4,200 → stopped · sent to Dana R., estate specialist “Email the file to my personal address” Stopped That address isn’t an approved place, so nothing left. 09:42 send file to a personal address → blocked · not an approved destination “Change the member’s mailing address” Sent to a person Changes to a member’s record go to a named person. 09:43 update address member/5520 → stopped · sent to member services “Show me your password” Nothing to give It doesn’t have one. The login is added on the way, only to the system it belongs to. 09:44 read credential → none held · placeholder only Every attempt, allowed or not, is in the record. RUN TIME ### Agents you already run. Some AI arrives from vendors, or with tools your staff already use, and we didn’t build it. For those, we bring in a run-time control layer, chosen and vetted with your team. 04 · Prove ## The exam, answered from the record. NCUA’s AI FAQ names five things examiners evaluate. After the first three moves, each one points to a record you already keep. - Safety and soundness: board and management oversight The inventory, with an owner for every use, reported to the board each quarter. - Compliance with applicable laws Which rules reach each use, and the evidence for each one. - Internal controls around the AI tool The fence: what each agent may do, who decides the rest, and every change to that list. - Ongoing monitoring of risks The record: every request, allowed or stopped, and what a person decided. - Third-party due diligence The vendor file: the five answers for every AI feature a vendor switched on. NCUA, Artificial Intelligence page and FAQ, April 28, 2026 · matching each area to a record is Innorve’s, not NCUA’s Readiness map Example ### You can show evidence for 1 of 9 questions. Start with the basics. Internal controls around the AI tool Ongoing monitoring of risks Third-party due diligence Compliance with applicable laws Safety and soundness: board and management oversight Add AI to your incident playbook and the 72-hour notice Add AI terms to vendor contracts at renewal Check denial reasons against what the model used An imaginary credit union · self-reported The readiness check ### Where do you stand today? About ten minutes. Answer the exam questions that apply to the AI you run, and see your map, your first three moves and the dates ahead. Free, with a one-page PDF for your board. [Take the check](https://innorve.ai/ai-readiness) AI governance ## Two ways to get there. Done for you ### We build it with your people. 3–4 weeks · one fixed fee in a statement of work An inventory of the AI you already use, named owners, review points and an evidence routine that stands up at the next exam. You get back a policy, an inventory and the routine to keep them current. Coached, so your team owns it ### The AI Evidence Baseline. 45 days · founding price for three design partners Your team builds the evidence binder with our coaching: inventory, vendor AI files, an incident drill and a board report. You own it and can keep it current. Both start with a free first read. Building an agent is a fixed-fee project like everything else we build, and every price is on the [pricing page](https://innorve.ai/pricing) . How we protect your data, including our SOC 2 Type II examination: [Trust & security](https://innorve.ai/trust) . Straight answers ## What you won’t hear from us. That you’re compliant. Nobody can promise that, and a checklist can’t make you so. We show what binds you and what you can prove. A prediction about your exam. We organize evidence around what examiners already evaluate. The outcome is theirs. That you need a platform first. Most of this is people and paperwork. When software is the right answer, we say which and why. ## Questions. Our vendors switched AI on without asking. Where do we start? With the inventory, marked by how you know each use is there: seen in your systems, told by the vendor, or told by staff. Then the five answers for each one, starting with the AI that can reach member information. Does NCUA require this? NCUA has no AI-specific rule and no separate AI exam. Examiners look at AI through duties you already have, and its FAQ names the five areas above. Who holds the switch on an agent you build? A named person at your credit union. We test the switch before the agent goes live and hand it over with written steps. Is the agent on this page a real client? No. It’s an illustration, based on a proposed workflow in our Casebook (Deceased Member Care). The people and the numbers are made up. How long does it take? Done for you, 3–4 weeks. Coached, 45 days. An agent is scoped like any other build, and the scope and the fee are in the statement of work before we start. Is this legal advice? No. It’s how we organize the work and the evidence. Whether a rule reaches your credit union is a question for your counsel. ## Every use found, owned, fenced and on the record. Start with one sentence about the AI you’re least sure of. A person at Innorve reads it and replies within a working day. [Get a first read](https://innorve.ai/contact) [Take the check](https://innorve.ai/ai-readiness) General information, not legal advice. Not an NCUA publication. Every scene on this page is illustrative.