Unadhi · Canada

AI inventory template for credit unions: what to record, and who expects it

Most credit unions already use AI somewhere: a fraud model inside the card processor, a chatbot on the website, a writing assistant in Microsoft 365, a scorecard in the lending system. The first job of any AI governance programme is the same everywhere: write down what you have. This page gives you a free template, a filled example, and the official sources that make an inventory worth doing now.

Which expectations apply to your credit union?

It depends on who supervises you. Check with your own regulator; this is a summary, not legal advice.

You are Main source What it says about AI / models Date
A federal credit union (supervised by OSFI) OSFI Guideline E-23, Model Risk Management (2027) Covers AI/ML and vendor models; expects a model inventory and risk ratings. It is supervisory guidance, applied in proportion to size and risk. See our E-23 inventory page. Takes effect 1 May 2027 (OSFI)
A Quebec deposit institution or financial services cooperative (supervised by the AMF) AMF Ligne directrice sur l'utilisation de l'intelligence artificielle (April 2026) Governance and risk management across the institution, risk-based classification of AI systems, lifecycle expectations, fair treatment of clients; applies on top of the AMF model-risk guideline Takes effect 1 May 2027 (AMF)
An Ontario credit union (supervised by FSRA) FSRA Operational Risk and Resilience Guidance For credit unions using advanced analytics "such as artificial intelligence", FSRA "will assess the extent to which appropriate mechanisms are in place to ensure robust data governance and mitigate the risks of harm and bias in their models" Effective 1 Mar 2024 (FSRA)
A credit union in another province Your provincial regulator We found no AI-specific credit union guidance to cite for other provinces as of 20 Oct 2026; many institutions use E-23 as a benchmark Check with your regulator

Also relevant to every credit union: - Quebec members: if a decision about a person is based exclusively on automated processing, Law 25 (s.12.1 of the private-sector Act) requires you to tell them and, on request, explain the main factors and let them be heard by a staff member who can review it. In force since 22 Sep 2023 (LégisQuébec P-39.1). See our Loi 25 s.12.1 page. - Ontario job postings: employers with 25+ employees must say in publicly advertised postings if AI is used to screen, assess or select applicants, from 1 Jan 2026 (Ontario ESA guide). See our Ontario page. - Federal privacy bill C-36 (not law): Bill C-36 (45th Parliament, 1st session) would enact the Protecting Privacy and Consumer Data Act. Its first-reading text would require organizations to give "a general account of the organization's use of any automated decision system to make predictions, recommendations or decisions about individuals that could have a legal or similarly significant effect on them" (proposed s.62(2)(c)), and, on request, an explanation of such a decision with the type and source of personal information and the reasons or principal factors, plus a chance to make written representations to an employee who can review it (proposed s.63(4)–(6)) (first-reading text). It is a bill, not law: LEGISinfo records it "At second reading in the House of Commons", after introduction and first reading on 15 June 2026, with no second-reading activity yet (last checked 20 Oct 2026). - AIDA is not law. It was Part 3 of Bill C-27, which ended when Parliament was prorogued on 6 Jan 2025 (LEGISinfo C-27). See Is AIDA law in 2026?

An inventory that records the fields below would help you answer all of these with one list.

The template: 14 fields

  1. ID and name (e.g. AI-007, "Card fraud alerts")
  2. Type: rules-based, statistical, machine learning, generative AI, or vendor/embedded AI
  3. Internal or third-party (vendor name and contract owner)
  4. Business owner (a role, not a person's name) and technical owner
  5. Purpose / decision supported
  6. Members affected? Does it make or support a decision about a member or applicant?
  7. Exclusively automated? Yes / no (drives Law 25 s.12.1 for Quebec members)
  8. Personal information used and where it is processed (inside/outside Quebec, outside Canada)
  9. Risk tier and the criteria you used (e.g. materiality × complexity × reliance × member impact)
  10. Validation: last independent review, next due
  11. Monitoring: metrics and thresholds (drift, bias, override rate, complaint count)
  12. Known limitations
  13. Staff trained to use or oversee it (dated record)
  14. Change log and decommission date

Filled example (fictional: for illustration only)

"Prairie Lakes Community Credit Union" is invented. These rows show the format, not anyone's real systems.

ID System Type Vendor? Member decision? Exclusively automated? Risk tier Owner (role) Next review Monitoring
AI-001 Card fraud alerts ML Yes (card processor) Yes: holds a transaction No: member services can release High Fraud operations lead Vendor report due [date] Alert precision, false-positive complaints
AI-002 Small-business loan scorecard Statistical No Yes: credit decision support No: lender signs off High Credit risk manager Validation [date] Population stability, override rate
AI-003 Website chatbot (answers FAQs) Generative AI Yes No n/a Medium Digital channels manager Quarterly Sampled answer review, escalation rate
AI-004 Writing assistant in office suite Generative AI Yes No n/a Low IT manager Annual Acceptable-use policy sign-off; staff trained [date]
AI-005 Résumé screening in applicant system ML Yes (HR software) Yes: job applicants Check: if rejections are automatic, s.12.1 applies to Quebec applicants High HR manager [date] Pass-through rates; disclosure line in Ontario job postings

What the example shows in two minutes: two high-risk vendor models with no in-house validation yet (AI-001, AI-005), one place where an automated rejection may trigger a Quebec notice (AI-005), and a training record that exists for only one tool (AI-004).

Keep it somewhere that lasts

A spreadsheet works on day one. The problems start at month three: versions multiply, nobody knows which copy is current, and the training record lives in someone's inbox.

Free first: the EURO AI Register keeps an AI inventory, risk tier, evidence links and a dated staff-training record in your browser, free for up to 10 AI systems. There is no account and no Unadhi server; you export and import your own file. It was built for EU AI Act records, so it is a light first inventory, not a full model-risk management system, and we say that plainly.

Work with an adviser? Accountants, privacy consultants and IT providers who look after credit unions: Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Price (only if useful)

After the free tier: membership $19/month or $190/year at unadhi.com/register. If you also serve members or clients in the EU, the EU AI Act readiness kit is USD 29: https://mininglife1.gumroad.com/l/eu-ai-act-readiness-kit. We have no paid E-23-specific or Law 25-specific product, and we will not pretend otherwise.

Sources (official first)

Not legal advice. Official sources checked 20 Oct 2026 (IST). If something has changed, tell us and we will fix it the same day.

More Unadhi Canada guides · EURO AI Register (free for up to 10 AI systems) · Paid membership checkout: EURO AI Register on Gumroad