Does SR 26-2 apply to credit unions? NCUA scope explained

Why the question is about authority, not content

SR 26-2 is a Federal Reserve supervisory letter. Compliance teams at credit unions often ask whether it applies because its subject, consequential AI and model use, overlaps with their own risk programs. But applicability follows the authority behind a requirement, not the topic it covers.

Federal Reserve supervisory letters are written within the Federal Reserve's supervisory remit. A credit union's obligations come from the regulator that charters, supervises and examines it. Reading the letter for useful practice is reasonable. Treating it as a binding standard for a credit union, without a legal or contractual path that makes it so, risks over-applying guidance and building controls against the wrong benchmark.

NCUA's independent authority over credit unions

NCUA is the primary federal regulator of credit unions. Federal credit unions receive their charters from NCUA and are subject to its supervision, examination and regulation. State-chartered credit unions answer to their state regulator, and if their deposits are federally insured they also fall under NCUA's jurisdiction.

NCUA has also shown that it does not simply adopt bank-agency guidance. It has stated that it is not a party to the Model Risk Management Guidance issued by the OCC, the Board and the FDIC. It monitors federally insured credit unions' model risk management through its own supervisory approach, looking for governance and controls appropriate to the size and complexity of the transactions, the risk to the credit union, and the credit union's capabilities and resources. That statement was made in the context of automated valuation models, and it should not be stretched into a general AI rule. It does show the proportionality principle NCUA applies to model use.

NCUA has also issued a statement clarifying the role of supervisory guidance. It describes NCUA's responsibility for safety and soundness and consumer protection at federal credit unions, and says NCUA will use numerical thresholds to tailor and clarify how supervisory guidance applies. Confirm whether any threshold applies at your institution's size.

Where SR 26-2 could still reach a credit union indirectly

Direct applicability and influence are different things. Three channels are worth checking.

First, contracts. If a credit union works with a Federal Reserve-supervised bank partner or vendor, that partner may ask its counterparties to meet certain expectations. Where a contract incorporates supervisory guidance, the contract creates the obligation, not the letter. Review the terms to see exactly what is required.

Second, vendor diligence. NCUA does not have authority to supervise technology service providers, including CUSOs, used by credit unions. The bank regulators, including the Federal Reserve, do have that authority over providers serving banks. NCUA instead uses its authority over credit unions to address provider risk through requirements and guidance. In practice, accountability for vendor-provided AI stays with the credit union.

Third, interagency alignment. In September 2026 the OCC, the Board, the FDIC and NCUA jointly proposed third-party risk management guidance. For that proposal, banking organizations include insured credit unions. The guidance is described as risk-tailored and addresses due diligence on a third party's risk management practices and alignment with the institution's own policies and controls. As of November 2026 it is a proposal, so track its status rather than assuming its final form.

What a credit union should be able to demonstrate

Start with a written applicability determination. It should separate direct legal applicability (NCUA rules and guidance), contractual obligations (partner and vendor terms) and indirect influence (guidance the institution chooses to consider). Counsel should review it, and it should be revisited if the proposed third-party guidance is finalized. Avoid claiming alignment with SR 26-2 in policy documents unless the institution has actually reviewed and adopted its text.

For each AI use, keep an inventory entry that states the purpose, the member information involved, the vendor, and the risk and complexity rating that justifies the chosen controls. Controls and evidence need to be observable on the credit union's side of the vendor boundary, because NCUA cannot supervise the provider. A vendor attestation is not a substitute for records of what the credit union permitted and what actually occurred.

Examiners will look for consistency. The governance described in policy should match what the evidence shows in operation, and the level of control should be proportionate to the risk of each use rather than uniform across all of them.

What can be enforced at runtime and evidenced

Policies on paper do not show what an AI system did at the moment of a member-facing or data-touching interaction. Enforcement at the point of execution can close that gap for individual interactions and tool calls.

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Each interaction or tool call can be allowed, redacted, blocked, rate limited or escalated for human approval. That enforcement generates continuous audit-ready evidence of what the AI was permitted to do and what it did. Trussed can be deployed self-managed in the customer's cloud, with configurable retention and data residency, which keeps evidence on the credit union's side of the vendor boundary.

This is a scoped capability. It addresses runtime control and evidence for AI interactions and tool calls. It does not replace the applicability determination, the third-party risk program or the incident reporting process. Trussed's evidence is mapped to frameworks including HIPAA, NAIC, NYDFS, the EU AI Act and NIST, and no mapping to NCUA requirements or to SR 26-2 is claimed here.