AI governance for community banks and credit unions.
Your staff use AI tools, and your core, digital banking, fraud and contact-center vendors are adding AI features every quarter. We help you find it, vet the vendors, set board-approved rules and keep the evidence examiners will ask for.
No single AI rule. Several programs that already apply.
Financial regulators have not issued one AI rulebook for community institutions. Examiners look at AI through the programs you already maintain, which means gaps show up as third-party, information security or governance findings.
- Third-party risk management. Most AI at a community institution arrives inside vendor products. Due diligence, contract terms and ongoing monitoring apply to those AI features. The federal banking agencies proposed revised third-party risk guidance in September 2026; the 2023 interagency guidance remains in effect until a final version is issued. Credit unions follow NCUA’s third-party due diligence guidance.
- Information security. Customer data entered into AI tools is covered by your GLBA information security program. With the FFIEC Cybersecurity Assessment Tool retired in August 2025, many institutions now use NIST CSF 2.0 or the CRI Profile; AI controls should map to whichever you use.
- Model risk, where it applies. Revised interagency model risk guidance (April 2026) replaced SR 11-7, is aimed mainly at banks over $30 billion, and places generative and agentic AI outside its scope. Those tools still need governance; it simply has to come from your broader risk program.
- Fair lending and consumer protection. AI used in credit decisions must still support specific adverse action reasons under ECOA and Regulation B.
- Board oversight. Directors should approve AI risk appetite and policy, and receive regular reporting on AI use and incidents.
Regulatory references current as of October 2026. We work alongside your compliance officer and counsel; we do not provide legal advice.
What we deliver
- AI inventory covering staff tools and AI features inside core, digital banking, fraud, BSA/AML, lending and contact-center products
- Third-party AI due diligence questions and reviews: data use, model training on your data, retention, sub-processors, monitoring, audit rights
- Board-approved AI policy, acceptable-use rules and risk-appetite language
- Risk-ranked findings mapped to NIST AI RMF and your cybersecurity framework
- Examiner and auditor evidence package and a board briefing
Ongoing oversight: Fractional AI Officer at $2,500, $4,500 or $7,500 per month.
Book a 30-minute call →Common AI exposure at community institutions
Each of these is a governance question before it is a technology question.
Vendor AI features
Fraud scoring, chat and voice assistants, document processing and call summaries switched on inside products you already license.
Staff use of public AI tools
Employees pasting member or customer details, loan files or internal procedures into consumer chatbots.
Lending and underwriting
AI-assisted credit decisions and marketing that must still meet fair lending and adverse action requirements.
Copilot and productivity AI
Microsoft 365 Copilot and similar tools that can surface sensitive files if permissions are loose.
Fraud and deepfakes
AI-generated voice and video used in wire fraud and account takeover attempts against staff and members.
Mergers and conversions
AI and vendor dependencies inherited in a bank or credit union merger. See M&A cyber and AI due diligence.
An AI governance specialist inside your existing program.
You already run information security, vendor management and board reporting. We add AI-specific depth and capacity without a new full-time hire: AI vendor reviews, policy language, board education and the evidence package, delivered in your formats.
Engagements are led by Edmond K. Sarpong (CISSP, CISM, CISA, CRISC, PMP, AIGP, AAISM), who brings security, audit, risk and AI governance credentials to the same table as your examiners and auditors.
How it starts
- 30-minute call. Your institution, vendors and current AI use.
- AI Risk Assessment ($5,000). Inventory, vendor AI due diligence, gaps and a 30/60/90-day plan, in two to four weeks.
- Board readout. Plain-language findings and a draft AI policy for approval.
- Optional retainer. Fractional AI Officer for ongoing vendor reviews, reporting and exam preparation.
Frequently asked questions
Is there a specific AI regulation for community banks and credit unions?
Not a single AI-specific rule. Examiners evaluate AI through existing expectations: third-party risk management, information security, compliance (including fair lending and consumer protection), model risk where it applies, and board and management oversight. That is why AI governance should plug into the programs you already run.
Does the April 2026 model risk guidance cover generative AI?
No. The revised interagency model risk management guidance issued in April 2026 (Federal Reserve SR 26-2, OCC Bulletin 2026-13, and the FDIC), which replaced SR 11-7, states that generative AI and agentic AI are outside its scope and that it is expected to be most relevant to banks over $30 billion in assets. Generative AI used by a community bank still needs governance through your existing risk management, third-party and information security practices.
How do examiners look at AI inside our vendors' products?
Mostly through third-party risk management. Much of the AI at a community institution arrives inside core, digital banking, fraud, BSA/AML, lending and contact-center products. You should know where it is, what data it uses, what the contract allows, and how the vendor monitors it. We build that inventory and the due diligence questions.
What does it cost?
The AI Risk Assessment is a flat $5,000 and covers AI inventory (including vendor AI), data exposure, third-party AI due diligence, policy and board reporting. Ongoing oversight is available as a Fractional AI Officer retainer at $2,500, $4,500 or $7,500 per month, with a 3-month minimum.
Do you work with credit unions?
Yes. For credit unions we align the work to NCUA's third-party due diligence expectations and to your existing information security program. Most work is remote, so we serve credit unions nationwide.
We have a CISO and a GRC team. Where do you fit?
We act as an AI governance specialist inside your existing program: AI inventory and vendor reviews, AI policy and risk-appetite language, board education, and the evidence package for examiners and auditors. Your CISO stays in charge; we add capacity and AI-specific depth.
Do you provide legal or compliance opinions?
No. We provide technology, cybersecurity and AI governance advisory and work alongside your compliance officer and counsel on regulatory interpretation.
Preparing for examiner questions about AI?
Book a 30-minute call. We will tell you what we would look at first and confirm the fixed price in writing.