A team, a real task, and evidence your board can read.
Both programs run the same way: a scoping call, a named sponsor, an honest baseline, a cohort, a report with denominators, and a check on what lasted.
Six steps, start to finish.
A scoping call
Thirty minutes. We ask about one recurring task or your current AI oversight, the tool you've approved, your sources and who checks the work. If you aren't ready, we say so and suggest a smaller first step, such as an AI Readiness Diagnostic.
Charter and sponsor
A named sponsor, a cohort, success criteria and protected time, written into a short charter. For the Oversight Core, the minimum cohort is the sponsor, compliance, the information security officer and the vendor manager.
Baseline
Before anything changes, we record where you start. For the Team Pilot, staff log comparable tasks for two weeks. For the Oversight Core, we count what you could evidence at kickoff.
Cohort
Team Pilot: 30 days, six short lessons and four one-hour working sessions. Oversight Core: six weeks, twelve lessons and five 75-minute working sessions, with the board session. A person reviews each learner's work.
The Day-30 or Day-45 report
One page for the sponsor, with counts, denominators and what's still unknown. It ends in a continue, change or stop recommendation. Day 30 for the Team Pilot, Day 45 for the Oversight Core.
The Day-60 or Day-90 check
We come back to see what lasted: a fresh unseen case, whether the workflow or the binder is still in use, and what changed. Day 60 for the Team Pilot, Day 90 for the Oversight Core.
Who brings what.
Your credit union provides
- A sponsor who owns the decision, and a workflow or binder owner
- A cohort, with protected time: about 7 hours per person for the Team Pilot, about 11 hours of formal time for the Oversight Core
- Your procedures, or for the Oversight Core your top three AI vendors' documents. Never member data
- Your approved AI tool, and confirmation from compliance or IT of what may go into it
- A reviewer from your side, and time from your IT administrator for the observed inventory (Oversight Core)
- Baseline records, so the report measures something real
We provide
- Facilitation of every lesson and working session
- Practice cases written from your procedures, or from our templates where none exist
- The Academy platform, with fictional practice and no member data
- Human review of each person's coached work and unseen check, with a second reviewer calibrating a sample
- The Day-30 or Day-45 report, and the follow-up check
- For the Oversight Core, the 90-minute board and executive session
Your policies, contract terms and controls stay your decisions. Completing the course does not authorize a workflow or adopt a policy; those are recorded separately by your credit union.
Flat team pricing, set in a proposal after a scoping call.
Priced per team, not per seat
A per-seat price rewards sending fewer people. Oversight needs the whole cross-functional team, and a pilot needs the whole team that does the task, so we price the cohort.
Founding design-partner terms
The first credit unions in each program join as design partners, on founding terms. What design partners get and give.
A proposal, then a contract and invoice
After the scoping call we send a written proposal with scope, responsibilities, dates and fees. Engagements run on a contract and invoice.
Paid in two halves
50% at kickoff, and 50% when the Day-30 report (Team Pilot) or the Day-45 report (Oversight Core) is delivered.
Three documents, readable before you sign.
Statement of work
Scope, responsibilities on both sides, dates, deliverables, data handling, fees, acceptance and rescheduling. Drafted from the proposal.
Data processing addendum
Our draft, for your counsel to review before the engagement starts.
Read the draftTrust packet
Security overview, data inventory, subprocessors, retention, incident response and questionnaire answers.
Open the trust fileThe before-Colorado cohort
Two Colorado AI laws, SB 26-189 and HB 26-1263, take effect on 1 January 2027. An Oversight Core cohort that starts by 16 November 2026 reaches its Day-45 report before that date.
Whether either law reaches your credit union, especially a federal charter, is a question for your counsel. The Core doesn't answer it. It helps you put the question to counsel properly, with your facts attached.
Source-check date 28 September 2026. Not legal advice. Read the full note.
Objections, and honest answers.
NCUA doesn’t have an AI rule, so why bother?
Correct, and the Oversight Core starts there. Existing rules still bind AI, such as the Part 748 security program Binding rule. NCUA's AI page names five areas examiners evaluate Supervisory guidance. Guidance can't be cited as a violation (12 CFR part 791, subpart D) Binding rule, but an unsafe or unsound practice can be acted on (12 U.S.C. 1786) Statute. The course teaches which is which, so you stop over-building for guidance and under-building for rules.
Our vendors handle AI.
NCUA cannot examine your vendors directly; its temporary authority to do so expired in 2001 Statute. Your vendor file is what gets reviewed, and the Core builds it for your top three AI vendors.
We’re too small.
Your binder is proportionate: a short, honest inventory beats a long unlabelled one. We are also exploring shared sessions for groups of smaller credit unions, where each still builds its own binder in its own systems.
We can’t spare staff time.
The Oversight Core is about 11 hours of formal time over six weeks, and the Team Pilot about 7 hours over 30 days. The applied work is work you would have to do anyway: the task checklist, the AI inventory, the vendor files, the board report.
We already sent people to an AI course.
Good: that is awareness. This is the evidence, and the team to keep it true. The two do different jobs.
We’d rather buy a governance platform.
Platforms help once you know what to govern. The academy is tool-neutral and will make any platform decision better informed.
Will you push a particular AI product?
No. Learner content never requires or promotes a product. Your team works in the tool you have already approved, and you are free to choose any vendor.
Will this get us through our exam?
Nobody can promise that, and we won’t. What you get is organized evidence under existing law, and a team that can explain it.
Is this a certification?
No. Records show completion and demonstrated skills only. The academy issues no professional credential and does not certify your credit union’s compliance.
Do you need our member data?
No. Practice cases are fictional or de-identified, and the platform has no place for member records. Real work stays in your own systems.
Regulatory statements on this page are labelled with their authority type. Not legal advice. The academy does not certify compliance and is not endorsed by NCUA or any regulator.
Start with a scoping call.
We're working with our first design partners.