ALEXANDRIA, Va.—NCUA lacks two key tools needed to effectively monitor how regulated financial institutions are using artificial intelligence, according to a new report from the Government Accountability Office (GAO).
The GAO found NCUA relies on model risk management guidance that is “limited in scope and detail.”
The report also pointed out that a decade-old GAO recommendation urging Congress to give the NCUA authority to regulate technology service providers has yet to be acted upon, even as credit unions increasingly depend on these providers for AI-powered services.
“Unlike the other banking regulators, the National Credit Union Administration (NCUA) does not have two key tools that could aid its oversight of credit unions’ AI use,” the report states. “First, its model risk management guidance is limited in scope and detail and does not provide its staff or credit unions with sufficient detail on how credit unions should manage model risks, including AI models. Developing guidance that is more detailed and covers more models would strengthen NCUA’s ability to address credit unions’ AI-related risks.
“Second, NCUA lacks the authority to examine technology service providers, despite credit unions’ increasing reliance on them for AI-driven services,” the report continues. “GAO previously recommended that Congress consider granting NCUA this authority (GAO-15-509), but as of February 2025, Congress had not yet done so. Such authority would enhance NCUA’s ability to monitor and mitigate third-party risks, including those associated with AI-service providers.
“The federal financial regulators are increasingly integrating AI into their general agency operations and supervisory and market oversight activities, with usage varying across agencies,” the report concludes. “The regulators use AI to identify risks, support research, and detect potential legal violations, reporting errors, or outliers. Most regulators told GAO that AI outputs inform staff decisions but are not used as sole decision-making sources.