Building Your Credit Union’s AI Inventory — Including the Shadow AI You Don’t Know About

You Probably Have More AI in Your Credit Union Than You Think

How many AI tools is your credit union running right now? If a number comes to mind quickly, it's probably low. Most executives find, once they start looking, that the real count is two or three times what they expected.

That gap has a name: shadow AI. It's the free ChatGPT accounts your loan officers are using to draft collection letters. The AI-powered grammar tool your marketing coordinator installed in her browser. The vendor module your core quietly switched on last quarter. None of it appeared on an IT ticket. None of it went through your security team. And some of it is touching member data right now.

Before you can govern AI at your credit union, you need to know what you have. That starts with building an AI inventory.

What Is an AI Inventory?

An AI inventory is a living document—a structured spreadsheet, a field in your vendor management system, whatever format your team will actually maintain—that catalogs every AI tool your credit union uses, who uses it, what data it touches, and who approved it.

Think of it like your vendor due diligence list, but focused on AI. You already track contracts, SOC 2 reports, and Business Associate Agreements for your technology vendors. An AI inventory applies that same discipline to the layer of intelligence sitting on top of those tools.

A solid inventory captures, at minimum:

• Tool name and vendor (e.g., ChatGPT / OpenAI)
• Department and use case (e.g., Lending — drafting adverse action letters)
• Data classification (Does it touch member PII? Account data? Internal-only?)
• Approval status (IT-approved, pending review, or discovered/unapproved)
• Contract or terms of service (Free tier? Enterprise agreement? Who signed it?)
• Named owner (Who is responsible for monitoring this tool going forward?)
• Review date (When did someone last look at this?)

That last column matters more than most people expect. AI vendors update their terms of service frequently, sometimes quietly. What was compliant six months ago may not be today.

Why Does Shadow AI Keep Appearing?

Here's the honest answer: your people are trying to do their jobs faster. When your member services team discovers that an AI tool can draft a response to a complicated member complaint in 30 seconds instead of 15 minutes, they use it. They're not trying to create a compliance problem. They're trying to close their queue.

Shadow AI isn't a discipline problem. It's a signal that your staff found a tool that helps—and that your credit union doesn't yet have an easy, approved path to get there.

That reframe matters when you're building your inventory. If you come at this as a gotcha exercise, you'll get incomplete answers. If you frame it as "we want to understand what's working so we can support it safely," you'll get honest ones. Loan ops, member services, marketing, collections—every team has a story. You want to hear it.

How Do I Build an AI Inventory for My Credit Union?

This doesn't have to be a six-month project. Here's a straightforward way to get started in the next few weeks.

1. Send a short survey to department heads. Ask three questions: What AI tools does your team use? What do you use them for? Does any member data pass through them? Keep it short. A five-question form gets completed; a 20-question audit does not.

2. Pull browser extension and software data from IT. Your IT team can often see what applications are installed and which browser extensions are active across managed devices. This surfaces tools staff may not think to mention because they feel incidental—the grammar checker, the meeting summarizer, the email autocomplete.

3. Review vendor contracts for embedded AI. Many of your existing vendors—your digital banking platform, your loan origination system, your CRM—have added AI features in recent updates. Check release notes and the last few emails from your account rep. You may have AI features already enabled that no one reviewed.

4. Walk your core and major platforms. Log into your core's admin portal and any major platform you use. Look for sections labeled "AI," "Intelligence," "Insights," or "Automation." Vendors don't always announce these features loudly. Sometimes they're just on.

5. Classify what you find. Sort each tool into three buckets: approved and governed, under review, or unapproved and in use. That third bucket is your immediate action list—not necessarily to shut tools down, but to make a deliberate decision about each one.

6. Assign a named owner to every tool. Someone needs to be responsible for monitoring each tool, flagging term changes, and confirming it's still in active use. Without ownership, inventories go stale within months.

7. Set a quarterly review cadence. The AI landscape moves fast. A snapshot from January tells you very little by October. Quarterly is realistic for most credit unions; annual is better than nothing but will almost certainly miss significant changes.

What About AI Your Vendors Are Building In?

This is the part most credit unions miss. Your vendors are moving quickly. Many are embedding AI into products you already own—sometimes as an opt-in feature, sometimes as a default that's already live. Your core, your digital banking provider, your fraud detection tool, your member-facing chatbot vendor: all of them have AI roadmaps, and some of those features are available today without you realizing it.

Don't assume your existing vendor relationship automatically covers AI features they add later. Review your BAA and data processing addenda specifically for AI language, and consult your compliance team before enabling any vendor AI module that touches member data.

Ask your account reps directly, and ask in writing: "What AI features are active under our current contract? What's coming in the next two releases? What data does it use, and where does it go?" You want those answers documented.

How Does an Inventory Connect to AI Governance?

An AI inventory on its own is useful. Connected to your governance framework, it becomes the foundation everything else is built on.

Your board is going to ask about AI—if they haven't already. Examiners are beginning to ask questions too, and regulatory expectations are still evolving (consult your compliance team for guidance specific to your regulator and charter type). A documented inventory signals that your credit union is taking a supervised, deliberate approach rather than letting things happen by default. It gives your compliance team something concrete to work with when they build or update your AI use policy.

Many credit unions are also using their inventory to identify high-value, low-risk use cases worth expanding. If your marketing team is already using an AI writing tool on a patchwork of free individual accounts, your inventory surfaces that—and opens the door to an enterprise agreement that's actually governed and approved.

Start with the inventory. The governance conversations get a lot easier when everyone is working from the same map.

What's the Risk?

Shadow AI carries real risk for credit unions, and the biggest exposure is data. When a loan officer pastes a member's financial details into a free consumer AI account, that data may be used to train the model or stored in ways your BAA doesn't cover. Free-tier tools from major AI vendors are generally not appropriate for workflows that involve member NPI, account numbers, or any data covered by Gramm-Leach-Bliley. If your inventory turns up unapproved tools touching member data, loop in compliance before deciding whether to adopt or restrict them—don't just send a memo asking staff to stop.

The risk profile drops significantly for internal, non-member-data workflows: drafting internal training materials, summarizing vendor proposals, prepping board presentation outlines. For those use cases, an approved enterprise tool with appropriate data handling terms is a reasonable path forward and the compliance burden is manageable. The inventory itself is low-risk to build—the value is in what you do with what you find. Accuracy risk is also worth flagging: AI-drafted content (adverse action letters, member communications, policy summaries) should always have a human review it before it goes out. The tool that saves 15 minutes can also introduce an error that costs much more to fix.

Frequently Asked Questions

What is shadow AI in a credit union?

Shadow AI refers to AI tools employees use without formal IT or compliance approval—free ChatGPT accounts, AI browser extensions, or vendor features enabled without a security review. It's common at credit unions of all sizes, and it frequently involves member data.

What should a credit union AI inventory include?

At minimum: the tool name and vendor, the department and use case, whether member PII or account data is involved, the approval status, the contract or terms of service on file, a named owner, and a scheduled review date. Every tool needs an owner or the inventory goes stale quickly.

How do I find AI tools my credit union is already using?

Start with a short survey to department heads, pull browser extension and installed-software data from IT, and review recent release notes from your major vendors. Check your core admin portal, digital banking platform, and loan origination system specifically—many have AI features already active that were never formally reviewed.

Do I need to shut down unapproved AI tools immediately?

Not necessarily—the goal is a deliberate decision, not a reflexive one. Some unapproved tools may be worth formally adopting with an enterprise agreement and proper data handling terms; others may need to be restricted. The inventory gives you the information to decide which is which.

Will examiners ask about our credit union's AI tools?

Some credit unions have already received AI-related questions during exams, and regulatory expectations are still evolving. A documented inventory and a clear approval process demonstrate supervisory oversight. Consult your compliance team for guidance specific to your regulator and charter type.