Credit Union IndexThe latest growth strategies in marketing and AI enablement for credit unions
Last updated Nov 13, 2026Written and edited by Credit Union IndexNo ads. No sponsors.
AI at Work · Action

Rank your AI uses in four levels, as bank examiners do

Published Nov 13, 2026 · Last checked Nov 13, 2026 · Last changed Nov 13, 2026
The short answer

A bank regulator published the framework its examiners use to review AI. It ranks each AI use by what can go wrong, in four levels. A credit union can make the same list in one afternoon and take it to the board.

Verdict
ACT
For
All charters. All sizes. Compliance officer, IT lead, CEO, board member.
Cost and time
No cost. About one afternoon for the first list.

Why

The Office of the Comptroller of the Currency (OCC) supervises national banks. It published the framework on Nov 4, 2026. It is a guide for bank examiners, and the OCC says it sets no new requirements. It shows how examiners think. They rank an AI use by its consequences, by how much it acts on its own, and by how much a person oversees it. They do not rank it by how advanced the technology is. A law firm's summary describes four levels. Level 4, low, is an internal tool that sees no personal or financial data and takes no action. Level 3, moderate, supports a decision that a person must review. Level 2, high, takes part in an important decision or contacts people, with a person monitoring it. Level 1, critical, acts on its own, and the action is hard to undo. NCUA says on its AI page that it has issued no rules specific to AI. The page lists what its examiners look at: safe and sound practice, compliance with the law, controls around the tool, ongoing monitoring, and vendor due diligence. It gives no levels. The four levels help a credit union sort its own list.

What to do

  1. List every place AI is used today. Include tools staff use on their own and AI features inside vendor products.
  2. For each use, write three things: what it is allowed to do, what data it sees, and who oversees it.
  3. Give each use a level from 4 (low) to 1 (critical).
  4. For levels 1 and 2, name the person who can stop the tool. Test that the stop works.
  5. Ask each vendor in writing whether it added AI to its product this year.
  6. Ask each vendor whether it will tell you before it changes that AI.
  7. Check how AI answers members about a rate, a fee or an account. Each answer should come from a fixed, approved text or go through a person.
  8. Take the one-page list to the board. Update it every quarter.

What data may go in

The list itself holds no member data. For each tool on it, write what data the tool sees. Member data belongs only in tools that passed vendor review.

Who checks the output

The compliance officer owns the list. The IT lead confirms what each tool can reach. The board sees the list each quarter. Have it ready when the examiner asks about AI.

The rule to check

The OCC framework is for bank examiners. It is not an NCUA rule. NCUA expects a credit union to find, measure and control AI risks as it does for any new product. Its AI page points to its letters on vendor due diligence, 07-CU-13 and 01-CU-20. If AI takes part in a loan decision, the member must get the real reasons for a denial. The credit union must also test for fair treatment.

What can go wrong

A vendor can add AI to a product you already use and not tell you, and the list is then out of date. The framework also says that a reviewer who only clicks a button is not oversight. The person who reviews needs the knowledge, the time and the authority to reject an output or stop the tool.

Sources

Plain text version