AI for Banks (2026): What a Community Bank or Credit Union Can Hand AI, What Stays Human, and How to Vet the Vendor

How should a community bank start with AI?

A community bank or credit union should start with AI as a drafting tool for staff and keep it away from decisions about customers. Hand it procedures, member and customer letters, credit memo narratives, board summaries and training material. Keep credit decisions, BSA/AML work and anything a regulator would call a judgment with people. And before a single customer record goes in, run the AI vendor through third-party risk management like any other vendor. As of 2026, that order (vendor review, data rules, then drafting) is what keeps an AI pilot from becoming an exam finding.

This page is for community banks and credit unions with somewhere between 10 and 200 employees, where the CEO, the compliance officer and the head of lending are often in the same weekly meeting. The big-bank conversation about AI credit models and fraud platforms is real. It's also not where you start.

What AI does well at a bank, and what stays human

Banking gets this split handed to it by regulation, which is honestly a gift. The line is the same one every other industry has to invent for itself: AI drafts, people decide.

• Drafts well: procedure manuals and policy updates for the board to approve, customer and member letters, rate-change notices from your own approved language, the narrative sections of a credit memo built from a spreadsheet the lender already prepared, board and committee summaries, job aids for tellers and new accounts staff, and first drafts of training.
• Stays human: approving or declining credit, pricing exceptions, anything in BSA/AML monitoring and suspicious activity reporting, complaint resolution, collections decisions, and what you tell an examiner. AI can format a document about any of these after a person has decided. It doesn't get a vote.

Why credit decisions stay human: the Reg B "specific reasons" line

Here's the reason that's sharper for banks than for most businesses. When a lender takes adverse action on a credit application, Regulation B requires a statement of reasons that is "specific and indicate[s] the principal reason(s) for the adverse action." It also says that a statement that the applicant "failed to achieve a qualifying score on the creditor's credit scoring system" is not enough (12 CFR 1002.9(b)(2)).

Now picture a general-purpose AI assistant recommending a decline. Can anyone at the bank say, specifically, why? If not, that tool can't be the one making the call. That's why my advice to a small lender is simple: let AI write the memo the credit officer reads, never the decision the applicant receives.

The bank data map: which records can go where

My one-page AI acceptable use policy sorts company data into green (public), yellow (internal, approved company AI account only) and red (no AI tool without a written, specific approval). Here's that rule applied to a bank's records, line by line, so a compliance officer can mark it up instead of starting from a blank page:

Two things make this work. The yellow rows assume a business account under a signed agreement, never a personal one. If you're comparing what a team seat actually includes, the Claude Team plan breakdown is a reasonable place to start. And the carve-outs are written down, because "use your judgment" is how a loan file ends up in somebody's free account on a Saturday.

Vet the AI vendor like any other vendor: a five-stage checklist

Banks already have the process for this. In June 2023 the Federal Reserve, the FDIC and the OCC issued final interagency guidance on third-party relationships. It lays out a life cycle for every vendor relationship, scaled to the bank's size and the risk involved. An AI assistant is a third party, so it goes through the same five stages. Here's what each one means for an AI tool specifically:

1. Planning. Write down the one job you want AI to do first (say, procedure drafting) and which data classes it will touch. A narrow first job keeps the review proportionate.
2. Due diligence and selection. Ask where data is stored, whether your data trains their models (the business plans from the major vendors say it doesn't by default; get it in the contract), what admin controls and audit logs exist, and who their subprocessors are.
3. Contract negotiation. Data use, retention and deletion, breach notification, the right to audit or receive audit reports, and what happens to your data at the end.
4. Ongoing monitoring. Re-read the vendor's terms when they change (they change often), review the admin log on a schedule, and spot-check drafts against the source documents.
5. Termination. Know how you export your projects and confirm deletion before you sign, not after.

Credit unions: the NCUA didn't sign that guidance. Ask your examiner what they expect for AI vendors; the five stages are still a sensible way to organize your file.

A worked example: what drafting is worth in a loan department

Do this on your own numbers. The example below uses placeholders, labeled as such, so the arithmetic is visible.

• Assumption: a lender closes 8 small commercial loans a month and spends 3 hours writing each credit memo narrative from a spreadsheet the lender already built. That's 24 hours a month.
• Draft-first: the lender pastes de-identified bullets, AI drafts the narrative, the lender checks every number against the spreadsheet. Call it half the time: 12 hours back.
• What 12 hours is worth: the median loan officer earns $36.87 an hour (O*NET, 2025 wages). That's about $442 a month of a lender's time, against one $25 seat billed monthly.
• Breakeven: the seat pays for itself at about 41 minutes a month.

Scale it across a bank of 40 people with 15 seats on an annual Team plan ($20 a seat, $300 a month). Loan interviewers and clerks (median $24.05) and new accounts clerks ($22.92) don't need hours back to justify a seat. A clerk who saves 15 minutes a day on procedure lookups and customer letters gets back about 5 hours a month, roughly $120 of time. The honest catch: none of that starts until the vendor review and the data rules are done, and that's weeks, not days.

AI for credit unions: same rules, different examiner

Everything above applies to a credit union with two changes. The examiner is the NCUA or your state regulator, so ask them what they want to see for AI vendors. And your letters go to members, not customers, which matters for tone: member-owned institutions usually want letters that sound like the branch, not like a bank. Load two or three of your best member letters into the shared project as style examples and most of that problem goes away.

Where to put AI governance at a small bank

At a community bank, AI governance shouldn't be a new committee. It's an addition to the ones you have: the vendor goes through your third-party program, the data rules go in your information security policy, and the board gets a short annual report on what AI is used for. If you want a structure to adapt, my AI governance framework fits a bank's existing committees without inventing new ones. If your institution also manages wealth or advisory accounts, Claude for financial services covers Anthropic's package for that side.

Who can help a community bank roll out AI?

I work with leadership teams at organizations of about 10 to 200 people on exactly this order of operations: which tool, which data rules, which department goes first. I don't build credit models or BSA systems, and I'd tell you to be wary of anyone selling those to a small bank as a quick install. What I do is the adoption side. The AI Readiness Assessment is $2,500 flat and gets you a written roadmap in two weeks, including the vendor-review questions and a draft data map for your compliance officer to mark up; the fee is credited in full if we do an install within 90 days. Installs that put the approved tool on your procedures and templates start at $4,500 and take about two weeks. You can see how I work on my AI consulting services page, and a free 30-minute strategy call is the easiest way to find out whether you need any of it.

What I'd do this week

Print the data map above and walk it with your compliance officer and head of lending, changing every row that doesn't fit your bank. Then pick the one vendor you're most likely to use and open its file in your third-party program, starting with stage 1. You'll know within a week whether AI is a 30-day project for you or a 90-day one, and that's worth knowing before anyone buys a seat.

Sources

• Regulation B, adverse action notices and statement of specific reasons: 12 CFR 1002.9(b)(2), eCFR, read October 15, 2026.
• Regulation P, definition of nonpublic personal information: 12 CFR 1016.3(p), eCFR, read October 15, 2026.
• SAR confidentiality for banks: 31 CFR 1020.320(e), eCFR, read October 15, 2026.
• Interagency Guidance on Third-Party Relationships: Risk Management (Federal Reserve, FDIC, OCC), Federal Register, June 9, 2023, read October 15, 2026.
• Wages: O*NET OnLine, Loan Officers (13-2072.00) $36.87/hr, Loan Interviewers and Clerks (43-4131.00) $24.05/hr, New Accounts Clerks (43-4141.00) $22.92/hr, 2025 medians, read October 15, 2026.
• Claude Team pricing: claude.com/pricing, read October 15, 2026 ($20 per Standard seat per month billed annually, $25 monthly, teams of 2 to 150).
• Search demand: DataForSEO, United States, English, read October 15, 2026 ("ai for banks" 1,600 Google searches a month, up 123% year over year; 808 AI-assistant searches in September).
• Assessment and install prices: justinmckelvey.com/assessment and /ai-implementation, as published October 15, 2026. This page is not legal or compliance advice; confirm anything regulatory with your compliance officer and examiner.