AI in Financial Institutions: October 2026

If you lead a credit union, CUSO (credit union service organization) or community bank, you've seen a lot of AI headlines this fall. Most of them don't change what's expected of you tomorrow, but a few do. This update covers what regulators said in September and October, plus two earlier items that still apply. It also covers a few vendor moves from earlier this year that still matter, and one step to take this month. Every item has a source listed at the end so you can check it yourself. This is education, not legal advice.

What regulators said

Proposed vendor guidance, and credit unions are in it. On Sept 11, the National Credit Union Administration (NCUA), the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve and the Office of the Comptroller of the Currency (OCC) asked for comment on proposed third-party risk management guidance. That's guidance on managing the risk that comes with using vendors and other outside firms. Once final, it would replace the 2023 guidance the bank agencies issued without NCUA. The proposal says that, for its purposes, banking organizations "also include insured credit unions." Comments are due Nov 16, 2026.

It's guidance. The proposal says non-compliance "will not result in supervisory action," though the agencies "may take action for violations of laws or regulations, unsafe or unsound practices, or other material risks" that come from weak third-party risk management. The core idea stays: using a vendor "does not diminish" your responsibility.

What it means for you: the proposal doesn't mention AI. Our read is that an AI tool from a vendor is a vendor relationship like any other, so the same tailoring applies. Match your review to the risk. Give the most attention to places where a vendor's AI touches member or customer data or decisions.

A statement on core providers, for community banks. The same day, the FDIC, the Fed and the OCC issued a Joint Statement on Community Banks' Engagement with Core Service Providers, and the Fed issued it as SR 26-7 on Oct 5. It covers the factors the agencies will consider when deciding how much supervisory attention core providers' services get. NCUA didn't join this one. The Fed also proposed a companion third-party risk guide for the community banks it supervises.

State bank supervisors published an AI exam framework. On Sept 16, the Conference of State Bank Supervisors (CSBS) released its AI Supervisory Framework. It's for state examiners looking at AI at "state-chartered banks and state-licensed nonbank financial institutions." CSBS calls it a "discretionary tool" and says institutions can use it to "assess their own AI programs" and "prepare for examinations." It includes a document request list and an optional worksheet for rating the risk of each AI use.

CSBS says "each state agency will determine the extent" it's used. We haven't seen DIFS say how it will use it, and the announcement doesn't name credit unions.

Still in force: Michigan's DIFS bulletin. On Jan 14, Michigan's Department of Insurance and Financial Services (DIFS) issued Bulletin 2026-03, addressed to the financial service providers it regulates. DIFS supervises Michigan state-chartered credit unions and banks. The bulletin doesn't name CUSOs.

Its center is a written AI Systems Program. If you don't formally use AI, DIFS still expects a staff acceptable-use policy at a minimum. DIFS called it guidance when it issued it, and the bulletin "does not prescribe specific practices or documentation requirements." If you're federally chartered, DIFS doesn't charter or examine you. Your primary regulator is NCUA (federal credit unions) or the OCC (national banks and federal savings associations). Check your case with counsel.

A correction you may hear about. On Apr 17, the Fed (SR 26-2), the OCC (Bulletin 2026-13) and the FDIC replaced the 2011 model risk guidance known as SR 11-7. Some say the new guidance covers AI. It's narrower than that: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."

The guidance says it applies to "traditional statistical and quantitative models and non-generative, non-agentic AI models". It also says your own risk management and governance should still guide controls for tools it doesn't cover. It's expected to be most relevant above $30 billion in assets. It doesn't set enforceable standards. NCUA isn't a party to it. The agencies plan a separate request for information on AI, and we hadn't seen it published as of Oct 10.

NCUA's position hasn't changed. Its AI page says: "NCUA has not issued AI specific rules or regulation." Examiners look at AI inside existing reviews, including vendor due diligence.

What vendors and cores are doing

• Jack Henry: In an Aug 20 release about Prevail Bank, Jack Henry said it had recently announced AI-assisted drafting of Suspicious Activity Report (SAR) narratives for its Financial Crimes Defender product. Jack Henry says the feature "saves at least one hour per suspicious activity investigation."

Earlier this year, still worth knowing

• Fiserv (May 14): launched agentOS, a system for running AI agents across its core and other platforms. The first four Fiserv agents are Commercial Loan Onboarding, Daily Operational Analysis and Reporting, Agentic Deposit Intelligence and Agentic AML Triage Analysis. Fiserv said it expected agentOS to be widely available by August 2026. We haven't confirmed that it is.
• CU*Answers (May 12), a CUSO and core provider headquartered in Grand Rapids, posted that it has a formal AI policy, keeps staff to approved uses, and gives clients "a reasonable expectation of knowing when AI has materially contributed to the work we deliver." The lesson: a short public policy gives clients a starting point for their vendor AI questions.

Questions to ask your rep:

1. Is this feature on for us now, or do we choose to turn it on?
2. What member or customer data does it use, and is any of it used to train models?
3. Who at our institution reviews the output before it's used or filed?
4. What in our contract changes when we turn it on?

These four questions and a blank table are the Vendor AI kit for credit unions and community banks.

What peers are doing

• Prevail Bank, a Wisconsin mutual bank, chose Jack Henry in August. Its president said: "As we build out our AI strategy, it was important to choose a provider that's already embedding AI across its platform." The lesson: if AI is part of how you'll pick a core, write down what you want before the sales meeting.
• Boulder Dam Credit Union, an early agentOS pilot, said its daily operational analysis agent is "cutting report times down from 10 minutes to a matter of seconds" (CEO quote in Fiserv's May 14 release). The lesson: start with a narrow, repetitive internal task.

One step for this month

Add vendor AI to your AI inventory, which is the list of AI tools your institution uses. List the vendors that touch member or customer data, then send each one the four questions above. Put the answers in a one-page table your board can read.

If DIFS regulates you, this is a start on item 1.8, which says your program should address AI from third-party vendors as well as AI you build. The proposed vendor guidance doesn't mention AI, but it covers vendor risk in general.

Finding out which vendor AI features are on, what data they use and who checks the output takes time a small team doesn't have. Our guide, AI Strategy in a Regulated Institution, is in the works. If your vendor list is long and you'd like help sorting it out now, talk it through with us.

Education, not legal advice. Check how any guidance applies to you with your counsel.

Sources

1. FDIC, FIL, "Proposed Interagency Third-Party Risk Management Guidance and Issuance of Joint Statement on Community Banks' Engagement with Core Service Providers," Sept 11, 2026. https://www.fdic.gov/news/financial-institution-letters/2026/proposed-interagency-third-party-risk-management-guidance
2. NCUA press release, "Agencies Seek Comment on Proposed Third-Party Risk Management Guidance and Issue Statement on Community Bank Engagement with Core Service Providers," Sept 11, 2026. https://ncua.gov/newsroom/press-release/2026/agencies-seek-comment-proposed-third-party-risk-management-guidance-and-issue-statement-community
3. Federal Register, "Proposed Third-Party Risk Management Guidance," 91 FR 58536 to 58544, Sept 15, 2026, FR Doc 2026-18859 (comments due Nov 16, 2026). https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm
4. Federal Reserve, SR 26-7, Oct 5, 2026. https://www.federalreserve.gov/supervisionreg/srletters/SR2607.htm
5. CSBS, "CSBS Announces AI Supervisory Framework," Sept 16, 2026. https://www.csbs.org/newsroom/csbs-announces-ai-supervisory-framework and framework page https://www.csbs.org/csbs-artificial-intelligence-supervisory-framework
6. Michigan DIFS, Bulletin 2026-03-BT/CF/CU, Jan 14, 2026. https://www.michigan.gov/difs/-/media/Project/Websites/difs/Bulletins/2026/Bulletin_2026-03-BT-CF-CU.pdf ; DIFS press release, Jan 14, 2026. https://www.michigan.gov/difs/news-and-outreach/press-releases/2026/01/14/difs-issues-bulletin-to-address-use-of-artificial-intelligence-in-the-financial-services-industry
7. Revised Guidance on Model Risk Management, Apr 17, 2026, Section II (Purpose and Scope), p. 3, footnote 3. OCC Bulletin 2026-13 https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html (attachment https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13a.pdf) ; Fed SR 26-2 https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm (attachment https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf) ; FDIC release https://www.fdic.gov/news/press-releases/2026/agencies-issue-revised-model-risk-guidance
8. NCUA, Artificial Intelligence (AI) resources and FAQ. https://ncua.gov/regulation-supervision/regulatory-compliance-resources/artificial-intelligence-ai
9. Jack Henry, "Prevail Bank Selects Jack Henry to Differentiate Through Open Ecosystem and AI Innovation," Aug 20, 2026. https://ir.jackhenry.com/news-releases/news-release-details/prevail-bank-selects-jack-henry-differentiate-through-open
10. Fiserv, "Fiserv Launches agentOS: The Operating System for Agentic AI in Banking," May 14, 2026. https://investors.fiserv.com/news-releases/news-release-details/fiserv-launches-agentos-operating-system-agentic-ai-banking
11. CUAnswers, "An Update from Your Cooperative: Responsible Use of Artificial Intelligence at CUAnswers," May 12, 2026. https://www.cuanswers.com/2026/05/an-update-from-your-cooperative-responsible-use-of-artificial-intelligence-at-cuanswers/ ; HQ: https://www.cuanswers.com/about/ ; CUSO: https://www.cuanswers.com/tour/cuso-model/