Treat AI vendors like any other third party: conduct due diligence, as NCUA's AI resource page expects, and document testing and oversight. Choose agents grounded in your own policies, with pre-execution checks designed to block actions outside policy and an evidence trail examiners can replay on demand.
