How do you know if an AI tool is safe enough to use at your credit union? And how do you explain that decision to your board—or your examiners—without sounding like you're winging it?
Those two questions come up constantly when credit union executives start rolling out AI tools. The answer isn't to block everything or approve everything. It's to build a simple mental model your whole team can use. The three-tier framework does exactly that.
What Is a Three-Tier AI Risk Framework?
A three-tier AI risk framework sorts every AI use case your credit union touches into one of three buckets based on the sensitivity of the data involved and the consequence of a mistake.
Think of it like your lending policy. You don't review a $2,000 personal loan the same way you review a $4 million commercial real estate deal. The scrutiny scales with the stakes. AI should work the same way.
Here's how the three tiers break down:
Tier 1 — Low Sensitivity. Public or general information. No member data. Mistakes are easy to catch and cheap to fix. Examples: drafting a social media post, summarizing an industry article, generating a first draft of a board education memo on interest rate trends.
Tier 2 — Moderate Sensitivity. Internal operational data. Non-public but not personally identifiable. Mistakes could embarrass the credit union or create confusion, but they're recoverable. Examples: summarizing a vendor proposal, building a training FAQ for your loan ops team, analyzing aggregate loan portfolio trends from internal spreadsheets with member identifiers stripped out.
Tier 3 — High Sensitivity. Member data. Regulated information. Compliance-adjacent decisions. Mistakes here can trigger examiner findings, member harm, or legal exposure. Examples: anything touching a member's account history, income, credit file, or personal information—or any output that feeds directly into a credit decision, a regulatory filing, or a member communication that carries legal weight.
The goal isn't to make AI harder to use. It's to make the risk conversation fast and repeatable, so your team isn't starting from scratch every time a new tool shows up.
Why Does This Matter for Credit Unions?
Credit unions operate under a compliance lens that most businesses don't. Your examiners aren't just checking financial ratios—they're paying attention to how you manage vendor risk, data governance, and third-party tools. AI vendors are third-party tools.
The NCUA has been clear that existing vendor management expectations apply to AI. That means due diligence, contractual protections, and ongoing oversight. The three-tier model gives you a documented, defensible basis for those decisions. When an examiner asks how you approved a tool, "we use a tiered risk classification and this tool only processes Tier 1 data" is a much stronger answer than "we Googled it and it seemed fine."
Beyond examiners, the framework helps your own team move faster. Right now, many credit union staff are either too cautious—they won't touch AI because no one told them the rules—or too loose, pasting member account notes into a free AI tool without realizing the risk. A three-tier policy gives everyone a shared vocabulary and a quick gut-check before they act.
How Do I Apply the Three-Tier Model at My Credit Union?
You don't need a 40-page AI policy to get started. Here's a practical path forward:
-
List your current AI touchpoints. Start with what's already happening: ChatGPT, Copilot, a core vendor's AI feature, a marketing tool with AI built in. Most credit unions already have more AI exposure than they realize. Write them down.
-
Assign each one a tier. For each tool, ask two questions: What data is it processing? And what happens if the output is wrong? Those two answers will tell you the tier. If member data could ever enter the tool, treat it as Tier 3 until you've confirmed otherwise.
-
Set tier-specific guardrails. Tier 1 tools might need only a brief usage guideline and a staff acknowledgment. Tier 2 tools may need a vendor review and a data handling checklist. Tier 3 tools need full vendor due diligence, contractual data protections, and a conversation with your compliance team before rollout.
-
Build a one-page decision tree. Your member services team shouldn't have to read a policy manual every time they want to use an AI writing tool. A simple flowchart—"Does this involve member data? Yes → Tier 3 approval required. No → Does this involve internal non-public data?"—makes the framework usable in the real world.
-
Document your reasoning. For anything Tier 2 and above, keep a brief record of why you placed it in that tier and what controls you put in place. This isn't bureaucracy for its own sake. It's your paper trail when an examiner or your board asks questions.
-
Review it quarterly. AI tools change fast. A vendor that was Tier 1-safe in January might add a data-sharing feature by June. Build a light quarterly review into your existing vendor management calendar, and verify any vendor's current data practices—privacy terms change constantly.
What Goes Wrong Without a Framework?
Without a structure like this, two failure modes show up reliably.
The first is analysis paralysis. Executives hear "AI risk" and freeze. No tools get approved. Staff get frustrated. Your competitors—fintechs and larger banks especially—pull further ahead on efficiency while your team is still copying and pasting manually.
The second is the opposite: accidental overexposure. A well-meaning employee pastes a member complaint—with the member's name, account number, and loan balance included—into a free AI tool to get help drafting a response. The data leaves your environment. You may not even know it happened. That's a potential data governance finding waiting for an examiner to discover it.
A clear, simple tier model addresses both failure modes. It gives cautious executives a framework to approve low-risk tools with confidence. And it gives well-meaning staff a clear boundary they can actually remember.
A one-page AI risk policy that your loan officers actually read is worth more than a 50-page policy that lives in a SharePoint folder nobody opens.
How Does This Connect to Your Broader AI Strategy?
The three-tier framework isn't your entire AI strategy. It's the foundation that makes everything else safer to build on. Once your team has a shared vocabulary for risk, you can start piloting more ambitious tools—custom AI assistants, document summarization for your lending team, AI-generated first drafts of member newsletters—with confidence that guardrails are already in place.
Think of it as the credit analysis process for AI. You wouldn't skip underwriting because a loan looks good on the surface. You wouldn't skip a risk tier review because an AI tool has a clean interface.
The framework also gives your board something concrete to point to. When AI comes up in your next board meeting—and it will—you can say your credit union has a documented classification system, that you've inventoried your current tools, and that Tier 3 use cases go through the same rigor as any other high-risk vendor relationship. That's a board-ready answer.
Consult your compliance team before finalizing any AI risk policy, especially for Tier 3 use cases that touch member data or feed into regulated decisions.
What's the Risk?
The three-tier framework itself carries very little risk—it's a thinking tool, not a technology. The risk sits in how well you apply it. The most common mistake is misclassifying a Tier 3 use case as Tier 2, usually because the data "feels" internal rather than personal. If member identifiers are present anywhere in the data flow—even embedded in a spreadsheet you thought was anonymized—the use case is Tier 3. Treat that line as hard.
From a regulatory standpoint, NCUA examiners are increasingly asking questions about AI governance. A documented framework helps, but documentation alone isn't a shield. If your controls don't match what's on paper, that's worse than having no policy at all. For marketing copy, board education materials, and internal drafting tasks with no member data involved, the risk of using this framework is low—go ahead and build it. For any workflow that touches member NPI, loan data, or outputs that feed into regulated decisions, loop in your compliance team before you finalize the classification. The framework is a starting point, not a substitute for that conversation.
Frequently Asked Questions
What is a three-tier AI risk framework for credit unions?
It's a classification system that sorts AI use cases into three buckets based on data sensitivity and the consequence of a mistake. Tier 1 covers low-risk tasks using public or general data. Tier 2 covers internal non-public operational data. Tier 3 covers anything touching member data or regulated decisions.
Does the NCUA have rules about how credit unions use AI tools?
The NCUA hasn't issued AI-specific regulations as of this writing, but has made clear that existing vendor management and third-party risk guidance applies to AI tools. Consult your compliance team for current regulatory expectations, as this area is evolving quickly.
Is it safe to use ChatGPT or other public AI tools at a credit union?
For Tier 1 tasks—drafting general content, summarizing public information, brainstorming—many credit unions use public AI tools with basic usage guidelines in place. The firm rule: never input member data, account information, or non-public personal information into a tool that hasn't been vetted for Tier 3 use.
How long does it take to build an AI risk framework?
A functional first version can be drafted in a single working session. The goal isn't a perfect 40-page policy—it's a one-page decision tree your staff can actually use. Start with an inventory of current AI tools, assign each a tier, and set tier-appropriate guardrails, then refine from there.
What happens if a staff member accidentally puts member data into an AI tool?
Depending on the tool's data handling practices and your state's breach notification requirements, it could trigger internal incident response, member notification obligations, or an examiner finding. This is exactly why a clear Tier 3 policy—established before anything goes wrong—is worth the investment. Consult your compliance and legal team immediately if an incident occurs.
Want to Dig Deeper?
CU 2.0 works with credit union executive teams—at institutions of every size—to build practical AI adoption plans that hold up in front of examiners and boards. Whether you're still figuring out which tools are safe to touch or you're ready to automate entire workflows with custom AI assistants, we can meet you where you are. We've helped credit unions go from "we're not sure we should be doing this" to "we have a documented framework and a working pilot"—without the lengthy consulting engagement. Ready to take the next step? Book a session with our team.
