Credit unions call AI model risk critical at a third the national-bank rate

Subtract readiness from concern and the segments stop resembling each other: credit unions leave 53 points between the 71% who say they are not prepared for AI model risk and the 18% who rate it a critical or high threat ^[1][2][1], where national banks leave 11 ^[2], community banks 11 and midsized banks 8 ^[3]. Two points separate credit unions from national banks on whether they are ready, and 44 points separate them on whether it matters ^[6].

The mechanism Javelin Strategy & Research's Tracy Goldberg names is what makes that belief expensive: credit unions often work with third-party vendors and assume the vendor is managing the AI risk ^[3]. Model risk here means a model performing poorly or outside its programming or training, leading to bad decisions or financial risk ^[4], and the decision still leaves the building under the credit union's name. Cornerstone Advisors' John Meyer supplies the concrete version his clients are already asking about: whether alternative credit decisioning carries a bias that creates fair lending or UDAAP problems ^[5], and where large language model data sits, down to whether a meeting notetaker parks member-services discussion in Europe or lets it train on other call data ^[6].

One alternative reading is that the 18% reflects calibration rather than complacency. A credit union running a handful of vendor models on narrow tasks does face less model surface than a national bank running hundreds, and "not prepared" is a cheap thing to concede in a survey where almost nobody claims to be prepared. The figure that would settle it is a model inventory by charter type, which the research as reported does not provide; nor does it break out the 63% of institutions raising budget, staff or tools for AI model risk over the next twelve months ^[7], the single largest destination for new risk spending and five points ahead of external fraud at 58% ^[7]. So whether credit unions sit inside that two-thirds or outside it is not knowable from here.

What an 18% rating reliably shows is that the money is going elsewhere. Teachers Federal Credit Union's Brad Calhoun frames the biggest risk as failing to prepare rather than moving too fast ^[8], and points to collaboration as the substitute for resources the largest banks have and credit unions do not ^[9]; Patelco's Kal Majmundar describes building governance and expertise in at the front end, across a stack that mixes in-house platforms with outside partners ^[10]. Both are describing documentation work, or rather the unglamorous half of it: model inventories, validation files, bias testing on decisioning models. That work is invisible until somebody asks for it, and it competes for budget with fraud tooling that shows a return this quarter. The 71% figure looks like the honest one; the 18% figure is more likely to be the one that gets revised, most likely by whoever first asks a credit union to produce the validation file behind an alternative credit model. If those inventories turn out to be as thin as the low concern rating implies, then the rating was accurate and the readiness answer was just modesty.