Q: Is there an approved or endorsed AI Model for regulatory references? Does the NCUA allow the usage of AI at all?
A: Credit unions may absolutely use AI; some early adopters have already incorporated AI tools into their operations. However, at this time there is not an AI model that has been approved or formally endorsed by the National Credit Union Association (NCUA), Consumer Financial Protection Bureau (CFPB), or any other regulatory body — even for research purposes. But there are different models intended for different purposes. The credit union may want to explore a specific model or vendor intended for legal research, regulatory news, or maintaining an internal knowledgebase. Keep in mind that these technologies are still evolving. While AI tools can be very useful for locating resources and staying on top of regulatory updates, we encourage you to validate any information against primary sources. AI should be used as a tool, not a replacement for review of official regulations, emerging legislation and other official guidance.
While there are currently no AI endorsements or preapproved vendors by the NCUA, the regulator does have a page of resources that can be helpful in selecting use cases and vendors. They encourage the adoption of new technologies generally, as long as it is done in a safe, sound, and compliant manner. Supervision over the credit union also applies evenly across the institution and will be evaluated along the same principles as other tools and vendors. In addition to general safety and soundness, the credit union will be evaluated on internal controls, risk monitoring/mitigation and adequate risk-based due diligence.
This due diligence will involve understanding how the AI tool functions, any risks introduced by the vendor or implementation, how the tool fits into the credit union’s overall business model and the vendor’s own controls. When considering some controls that could be implemented for this internal usage, we recommend gaining an understanding of how the credit union’s data is read and stored by the AI platform. The credit union should have a clear understanding of what the tool is intended for and how this translates to the credit union’s specific use case. For example, in acknowledging that a regulatory update should be checked against a primary source, the credit union may want to publish a job aid for employees using the service or performing ongoing training for proper usage. By identifying the risks involved specific to the credit union’s use case, you can determine where outsized exposure exists and address the risks appropriately.
Source: National Credit Union Association – Artificial Intelligence
Q: We’re testing an AI chatbot for our procedures and training. Are we required to disclose that employees’ questions are monitored by a person? So far, we’ve added a disclaimer to the procedure explaining that the information provided by AI/chatbot can be inaccurate and should be reviewed critically, and the chatbot should be used as a tool, not a replacement for training.
A: To answer your first question, there’s no specific requirement about disclosing that questions are monitored by a person. However, as a control, consider obtaining an agreement or attestation that employees will abide by the institution’s AI policy (or are otherwise aware of the credit union’s stance on AI tools) — we recommend this as a business risk decision. When implementing AI tools (even just for training on an internal-use only basis) examiners are likely to appreciate safeguards that ensure AI risk is limited. This could include a well-documented AI policy as well as user acknowledgement and specified training. While there is no requirement to notify employees that their chats are surveilled, the credit union may want to consider transparency as a preventative measure — if employees are aware that they are being watched, they’re generally less likely to use the AI in an unauthorized manner. Human monitoring should align with the training purpose that the AI is serving, and not be overly intrusive or disproportionate. For example, if the credit union has a practice of recording every keystroke even though the AI system itself stores usage records, this could have adverse consequences.
Overall, specific guidance relating to AI chatbots and especially their use of such for training is sparse. There are benefits from the flexibility this provides — the credit union can implement anything it wishes to mitigate its risks. In this case, the credit union may want to limit its risk of employee unauthorized use by setting clear policies and expectations regarding the usage of AI. Many institutions that have an internal chatbot or resource for employees will block and restrict the usage of other publicly facing AI tools. This can ensure the credit union is monitoring usage to ensure what, if any, personal data is being collected (such as the prompts being used or the timestamps relating to them) and it may be a good idea to provide employees a privacy notice to avoid the risk of improperly handling employee personal information.
In this situation, we recommend the credit union assesses the risks of using a chatbot in this manner. You’ve already identified incorrect information as a primary risk. Human monitoring, a binding AI acceptable use policy and training on appropriate inputs can go a long way in avoiding such occurrences.
Source: United States Treasury – Artificial Intelligence in Financial Services
Q: What privacy concerns should we evaluate before using an AI tool?
A: Privacy should be top of mind when evaluating any AI solution, especially if it interacts with any member information, internal documents, or other confidential data. While there are no AI-specific federal privacy regulations in place in the U.S. today, existing requirements regarding the protection of member information are technology neutral, so they apply regardless of methodology.
There is likely to be enhanced scrutiny over the credit union’s privacy program, even if AI tools will not directly interface with personally identifiable information (PII). The credit union should understand whether data is retained by the AI vendor, whether it is accessible to vendor personnel, where the data is physically stored and whether the information will be used to train the vendor’s models. Determining whether the credit union’s data can be used for training is critical; we would not recommend entering into an agreement that would allow this usage of the credit union’s data. You may also want to review the vendor’s privacy notice and other contractual commitments to ensure that they align with the credit union’s risk tolerance and privacy controls. These are especially important when an AI tool is public-facing; practices can vary significantly between vendors and products.
Finally, the use of an AI tool likely warrants updates to the credit union’s privacy procedures and information security controls. While adoption of AI does not automatically trigger new disclosures, you should evaluate if the new undertaking will change how member information is collected, used or shared. For example, if an AI vendor receives access to non-public personal information solely to perform services on behalf of the credit union, that relationship may fit within existing service-provider exceptions already contemplated by Regulation P. However, if information is shared with a third party in a manner that differs from existing practices, additional analysis may be necessary. Based on the existing federal privacy framework, at minimum we recommend determining if the implementation changes any of the required privacy notice items — what information the credit union collects, who receives access to the information, how it is used, whether it is being shared with new categories of third parties, and if they are permitted to use the information for any other purpose.
State privacy laws may differ — contact us through your league’s Compliance Hotline for more information!
Source: Consumer Financial Protection Bureau – Privacy of Consumer Financial Information (Regulation P)
This article was provided by ViClarity.
For more information, email Lisa Quaranta.
Your League-member benefits include the Compliance Hotline — providing exclusive access to dedicated compliance experts:
Using the above phone number and email address, you can gain access to a knowledgeable team that’s ready to address all your credit union’s compliance inquiries — promptly and efficiently. With the Compliance Hotline, you can proactively respond to impromptu questions and issues by getting clarity and insight on technical topics that normally slow you down. We want to help you unlock the full potential of your League membership by leveraging the resources and support you need to navigate the complex world of compliance effortlessly. We’re ALWAYS just a phone call or email away!
Additionally, other League-member compliance resources include:
For more information, email Lisa Quaranta.
Powered by ViClarity, a California’s Credit Unions and Nevada’s Credit Unions company.
