Thinking Worth Your Time

Occasional perspectives on AI strategy, regulatory developments, and what it means to lead a community financial institution thoughtfully in a rapidly changing environment.

Latest — Q1 2026

Perspective · Q1 2026 5 min read

The Exam You're Not Preparing For

AI vendors are moving faster than examiners are publishing guidance. The institutions that get caught flat-footed won't be the ones that moved too slowly — they'll be the ones that moved without a governance framework. A perspective on what that means for community credit union leadership right now.

Regulatory & Compliance AI Governance

Every week, another AI vendor is pitching a community credit union CEO on a platform that will transform member service, streamline lending decisions, or eliminate back-office inefficiency. The demos are impressive. The ROI projections are compelling. And the regulatory framework for evaluating any of it is still being written.

That gap — between the pace of vendor adoption and the pace of examiner guidance — is where institutions get into trouble. Not because they made a bad technology decision. Because they made a technology decision without the governance structure to defend it.

The institutions that get this right won't be the ones that moved fastest. They'll be the ones that moved most deliberately.

NCUA and FFIEC have been clear in broad strokes — model risk management, third-party oversight, data governance. What they haven't done yet is tell you exactly what an AI governance framework needs to look like for a $500M credit union in Southeast Texas. That specificity is still coming. The question is whether your institution will be ahead of it or behind it when it arrives.

The preparation that matters right now isn't technical. It's structural. Can your board articulate your institution's AI posture? Does your compliance team have a framework for evaluating AI vendors against your existing third-party risk management obligations? Do you know which AI applications in use today — including the ones your staff adopted quietly — fall under model risk management guidance?

Those questions don't require a vendor. They require leadership that's been thinking before acting.

Dr. Adam Wingate, Ph.D.

Founder & Principal Advisor, FinovoAI

March 2026

All Insights

▶ Examiner Checklist

What Examiners Are Looking For When AI Is in the Room

A practical checklist covering the specific questions NCUA and FFIEC are asking about model risk, SR 11-7, data governance, and third-party oversight. Read it in three minutes. Hand it to your compliance officer.

Regulatory & Compliance AI Governance

Read →

Coming · Q2 2026 6 min read

What Your Core Vendor Isn't Telling You About AI

Core banking vendors are building AI features into existing contracts. What that means for your third-party risk obligations — and the questions you should be asking before you opt in.

Strategy & Readiness Vendor Evaluation

Coming Q2 2026

Coming · Q2 2026 4 min read

The NCUA Is Watching: What the Latest Examination Trends Tell Us

A review of what examiners have been flagging in recent AI-related findings — and what community credit unions can do now to stay ahead of the curve.

Regulatory & Compliance Industry Trends

Coming Q2 2026

Receive Occasional Perspectives

No sales. No frequency commitment. When something worth your time is published — a new perspective piece, a regulatory development worth noting, a framework that might be useful — it will arrive in your inbox. That's all.

By sharing your email you agree to our Terms of Use and confirm this does not create a professional advisory relationship.

Examiners are not yet issuing AI-specific examination findings at community credit unions in volume. But the framework they will use when they do is already in place — and institutions that haven't thought through their posture are more exposed than they realize.

The following questions reflect what examiners are increasingly asking, drawn from NCUA examination guidance, FFIEC statements on model risk management, and SR 11-7. They are organized by the four areas of greatest examiner focus.

1. Model Risk Management

Has your institution identified which AI applications in use today qualify as models under SR 11-7?
Do you have a model inventory that includes AI tools adopted by individual staff members — not just formally procured platforms?
Is there a defined validation process for AI models before deployment?
Who owns model risk management at your institution, and does that person have the authority to pause or reject an AI deployment?

2. Third-Party Risk Management

Are AI vendors being evaluated through your existing third-party risk management framework?
Do vendor contracts include data governance provisions — specifically around member data used for model training?
Have you assessed what happens to your institution if an AI vendor experiences an outage, a data breach, or a regulatory action?
Is there a subcontractor or fourth-party AI provider embedded in a platform you've already approved?

3. Data Governance

Do you know what member data is being accessed, stored, or processed by each AI tool in use?
Are your GLBA data governance policies written broadly enough to cover AI applications — or were they drafted before AI was a consideration?
Is there a defined data retention and deletion policy for AI-generated outputs?

4. Board and Leadership Governance

Can your board articulate your institution's AI posture — what you will and won't do, and why?
Has leadership reviewed and approved an AI governance framework — or is AI adoption happening below board visibility?
Do your policies and procedures reference AI, or are they silent on the topic?

The institutions that fare best in AI-related examinations won't be the ones that have the most sophisticated technology. They'll be the ones that can show they thought about it deliberately before they acted.

None of these questions require a vendor solution. They require leadership attention and a governance framework built before the exam — not after.

If your institution can answer yes to the majority of these questions, you're ahead of most. If several of these are gaps, the time to address them is now — while the regulatory environment is still taking shape and examiners are looking for good faith effort, not perfection.