Credit Union AI Vendor Risk Assessment Checklist: How to Vet Third-Party AI Tools Securely

The AI Vendor You Didn’t Know You Approved

As a credit union CEO or CIO, you have a rigorous vendor due diligence process for your core processor, digital banking platform, and loan origination system. But what about the AI vendor operating inside those platforms? Today, nearly every major fintech vendor serving credit unions has embedded generative AI — from automated loan decisioning and intelligent document processing to member service chatbots and AI-powered fraud analytics. Add to that the marketing platform that quietly added an AI copywriter and the HR tool now using AI to screen resumes. Without a dedicated credit union AI vendor risk assessment checklist, you may have already onboarded a dozen AI vendors without a single security review. Under NCUA guidance on third-party risk management, your credit union remains fully responsible for the security, compliance, and performance of these AI capabilities, even when the AI is a sub-component of an existing vendor. This invisible expansion of your vendor ecosystem is creating one of the most underestimated sources of regulatory and reputational risk for financial institutions.

Why Traditional Vendor Due Diligence Fails for AI

Standard third-party risk questionnaires were designed for traditional SaaS — not for non-deterministic, data-hungry AI models. Applying the old checklist to AI leaves critical gaps in your AI vendor due diligence for credit unions.

• Black Box Risk: Unlike conventional software with predictable logic, AI models can hallucinate, produce biased outputs, or drift over time as they encounter new data. A traditional vendor review that checks uptime and SOC 2 coverage will miss questions about model training data, bias testing, and explainability.
• Data Training and Retention Exposure: Many AI vendors retain customer data to train future models unless you negotiate otherwise. For credit unions, this means member non-public personal information (NPI) could be used to improve a model that also serves other financial institutions or commercial clients, violating GLBA data handling expectations and your own privacy notice.
• Fourth-Party Cascade: Your AI vendor is likely built on top of another AI model — such as OpenAI, Anthropic, Google, or AWS Bedrock. This creates a nested fourth-party risk chain where your member data may flow to a large language model provider you have never directly vetted. Your contract with the primary vendor may not disclose or control these downstream transfers.
• Compliance and Liability Ambiguity: If an AI-powered tool makes an adverse credit decision or generates a non-compliant disclosure, regulators will hold the credit union accountable, not the vendor. Without clear contractual language on model governance, audit rights, and liability, you absorb all the risk with none of the visibility.

To close these gaps, credit unions need a purpose-built approach to third party AI risk management for credit unions that extends, not replaces, their existing vendor management program.

Credit Union AI Vendor Risk Assessment Checklist: 5 Critical Controls Before You Sign

Before approving, renewing, or continuing use of any product with embedded AI, apply this five-pillar assessment. It aligns with NCUA Letters to Credit Unions on model risk management and third-party due diligence while addressing the unique nature of AI.

1. Data Governance and Zero Data Retention Requirements

This is the most critical control for protecting member data. Your assessment must document exactly what data the AI will access, where it is processed, and what happens to it afterward. Require vendors to provide written attestation on data residency, encryption in transit and at rest, and a zero data retention agreement where member data is not used for model training and is purged immediately after processing. Verify whether data is used for human review or reinforcement learning. For any tool that processes NPI, insist on contractual language that prohibits training on your data, requires immediate deletion within 24-48 hours, and grants you audit rights. If a vendor cannot provide this in writing, classify that AI capability as high-risk and restrict its use.

2. Model Transparency, Explainability, and Bias Testing

For any AI that influences a member outcome — credit decisions, pricing, collections, fraud flags, or member communications — you must understand how the model works. Ask for model documentation that covers the model’s purpose and limitations, the type of data it was trained on, known bias risks, and how explainability is achieved. Request evidence of independent testing for disparate impact and fair lending compliance, including under the Equal Credit Opportunity Act (ECOA). A trustworthy vendor should be able to explain in plain language why the model made a specific recommendation and what data points were most influential. If they respond that the model is proprietary and cannot be explained, that is a red flag for examination risk and potential regulatory scrutiny.

3. Security Certifications and Regulatory Alignment

Move beyond a generic SOC 2 Type II. Your AI vendor due diligence for credit unions should verify specific AI-relevant controls. Request the vendor’s SOC 2 report with AI system boundaries clearly defined, penetration testing results for AI endpoints and APIs, and alignment with frameworks such as NIST AI Risk Management Framework. Confirm the vendor’s incident response plan explicitly covers AI model incidents, including data leakage or model manipulation, and that they have defined notification timelines that meet your breach notification obligations. Also verify that the vendor carries technology errors and omissions insurance that covers AI-related failures. Document how the vendor supports your NCUA AI compliance obligations, including access to audit logs, model version history, and compliance reporting.

4. Fourth-Party and Sub-Processor Disclosure

Require a complete and current list of all sub-processors and fourth parties that touch member data or provide underlying AI models. This must include the specific foundation models used, cloud hosting providers, and any human-in-the-loop review services. Your contract should require prior notification and approval for any new sub-processor or model change, not just post-facto disclosure. Assess whether those fourth parties meet the same data governance standards you require of the primary vendor. This step is essential for true third party AI risk management for credit unions, as it prevents member data from silently flowing to an unvetted offshore model provider through the back door.

5. Continuous Monitoring, Performance Testing, and Exit Rights

AI risk does not end at procurement. An AI model that passed due diligence on day one can degrade or drift within months. Establish contractual rights for continuous monitoring, including ongoing access to model performance metrics, audit logs of AI prompts and outputs, and regular re-certification of bias and accuracy testing. Define clear service level thresholds for model accuracy, unfair bias, and hallucination rates, along with the right to suspend use if thresholds are breached. Most importantly, secure a clean exit strategy. Ensure you can export your data, revoke model access, and require certified deletion of all member data and fine-tuned models upon termination, preventing your data from remaining embedded in the vendor’s systems.

Building a Repeatable AI Vendor Governance Program

A checklist is only effective if it is consistently applied. Leading credit unions are operationalizing this credit union AI vendor risk assessment checklist by integrating it into their existing vendor management lifecycle. Start by creating a centralized AI inventory that captures every approved system with AI capabilities, its risk tier, data classification, and due diligence artifacts. Low-risk tools that only draft internal content may require light review, while high-risk tools that process NPI or inform credit decisions require full committee review. Assign ownership to a cross-functional AI governance committee — chaired by the CIO or Chief Risk Officer with compliance, lending, and IT representation — that reviews all new AI vendors, conducts annual reassessments of existing ones, and reports AI vendor risk posture to the board. This structured program turns ad-hoc approvals into a defensible, examiner-ready process that enables innovation without expanding risk. When every AI vendor is vetted with the same rigor as your core, you protect member trust while confidently leveraging AI to better serve your field of membership.

Ready to streamline AI vendor oversight and protect member data? Learn how AI Guard gives credit unions visibility and control over third-party AI risk.