On September 15, 2026, the OCC, the Federal Reserve, the FDIC and NCUA proposed a joint rule that would replace the detailed 2023 third-party risk management framework with a shorter, principles-based one. The proposal never mentions artificial intelligence. It doesn’t need to. Every AI model, AI feature and AI agent a credit union uses arrives through a business arrangement with a vendor, and that is exactly how the proposal defines a third-party relationship.
For a credit union running a two-person compliance team, that’s real relief: less process, more judgment. It also moves the weight of an exam onto a single question: can you show how you decided?
The gap credit unions answer alone
Banks get agency reports on their service providers. Credit unions don’t. NCUA has told GAO plainly that it lacks the authority to examine the technology service providers credit unions depend on, a gap GAO flagged back in 2015 and Congress still hadn’t closed as of last year. When a handful of core, digital banking, lending and fraud platforms add AI, that gap reaches a large share of the system at once. NCUA has said as much itself: many credit unions “do not possess the clout and subject matter expertise” to fully monitor their service providers.
Four shifts define what the proposal means for AI
1. The AI is already inside your vendors. Most credit unions didn’t sign a contract for an “AI vendor.” AI arrived as a feature in a platform they already use, through a routine release note. The proposal’s definition catches all of it: a model you license directly, an AI feature switched on inside your core, and an agent your vendor runs on your members’ behalf all meet the test. A new AI feature is reason enough to reassess the relationship.
2. Principles replace the checklist. Four components do the work a long list of examples used to: identify and assess inherent risk, build controls to mitigate it, determine residual risk, and govern. The word carrying the most weight is reasonable. Reasonable isn’t the same as undocumented. A decision made in a meeting and never written down looks, to an examiner, like a decision nobody made.
3. No one else is examining your vendor. The proposal is blunt: no supervisory or regulatory agency is responsible for an institution’s third-party risk management. Banks can at least read agency reports on certain large providers as one input. Credit unions often can’t.
4. Agents and the vendors behind your vendors. An AI feature answers a question. An agent takes an action, and the proposal treats that action “to the same extent as if the activities were performed by the banking organization internally.” You don’t need a contract with the model provider underneath your vendor. You do need to know who it is, what it sees, and when it changes.
What examiners are likely to ask
NCUA hasn’t published an AI exam procedure, but its own published expectations and this proposal point to the same handful of questions: Which of your vendors use AI in the services they provide? How did you decide which relationships are higher-risk? What did you do when a vendor turned on a new AI feature? What risk did you accept, and who accepted it? What happens if you have to turn it off? Each one has a one-line answer on paper and a very different answer when the evidence has to come from memory.
A readiness plan that doesn’t wait for final guidance
Six steps, sized for a team without a dedicated third-party risk function: build an inventory of AI-bearing vendors, tier each relationship by potential harm rather than by label, write diligence questions for AI specifically, put the few contract clauses that matter into renewals, monitor a small set of signals and report them to the board, and write down the risk you accept with a name and a date attached.
NCUA is taking comment on the proposal through November 16, 2026, docket NCUA-2026-1684 at Regulations.gov. Credit unions have a particular reason to weigh in: the proposal is written in the language of “banking organizations,” and if credit unions don’t say where their supervision differs, the final text is unlikely to reflect it.
Where Auditrol fits
Most of this is judgment, and judgment belongs to the credit union. What’s hard to produce on demand is the record underneath it: which vendor carries which AI, what data it reaches, which control applied, who owns it, and proof the control ran. Auditrol is an agentic AI platform for credit unions and banks to manage data and operational risk, built to keep that record as a by-product of the work rather than a project before the exam.
Your AI vendors are third parties. The record of how you govern them is yours. Download the guide, Your AI Vendor Is a Third Party.