A CFO’s AI Business-Case Framework for Credit Unions

Credit-union finance leaders should require seven things before treating an AI proposal as an investment case: a measurable baseline, a bounded use case, full lifecycle cost, independently owned benefit assumptions, risk-adjusted scenarios, a stage-gated pilot and a benefits ledger that continues after launch.

AI proposals often arrive with a percentage improvement, a per-seat price and a promise that employees will save time. Those inputs are not enough for a capital or operating decision. The relevant question is whether a specific member or employee workflow will deliver a measurable outcome after integration, controls, exceptions, training and vendor change are included.

The NCUA’s current AI resource says credit unions should understand how an AI product functions, the risks it introduces, how it fits the business model and the vendor’s safeguards, reliability and controls. An older but still active NCUA due-diligence letter is unusually direct about the financial case: project revenue, expenses and net income under different economic conditions, scrutinize vendor assumptions, then compare actual results with projections.

That creates a useful role for the CFO. Finance does not need to validate the model alone or own every control. It should make the economics testable and prevent attractive vendor metrics from becoming the credit union’s forecast without independent evidence.

1. Baseline the work before pricing the tool

Choose one workflow and measure its current state over a representative period. Count volume, employee minutes, queue time, rework, error correction, escalation, complaints, vendor charges and any losses or missed revenue the proposed tool is expected to affect. Separate normal work from exceptions.

A contact-center summarization pilot should measure documentation time, corrections, downstream follow-up and the employee capacity that can realistically be redeployed. The same discipline applies to document automation, fraud review, collections or lending.

Gate: no forecast is approved until an operating owner and finance agree on the baseline, data source, measurement window and unit of work.

2. Define the smallest investable use case

Replace broad labels such as “AI for member service” with one bounded action. State what the system may read, produce or recommend; who reviews it; which members or transactions are in scope; and which conditions force a human handoff.

This prevents unrelated benefits from being bundled into one case. It also lets the credit union connect spending to a real decision. A tool that drafts a response, an agent that executes a transaction and a model that prioritizes a queue have different control costs and different ways of creating value.

The scope can be ranked against other automation opportunities using the workflow, volume, risk and readiness approach in our back-office AI prioritization guide. The business case should fund the next evidence step, not assume an enterprise rollout.

3. Build the full lifecycle cost

Add costs that sit outside the vendor quote: integration, data preparation, security and legal review, testing, model or output validation, employee training, workflow redesign, accessibility, monitoring, audit evidence, exception handling, incident response and contract exit. Include internal labor even when no new employee is hired; that capacity still has an opportunity cost.

Model costs by phase—evaluation, pilot, initial production and steady state—and identify what recurs after vendor changes. The interagency community-bank guide to third-party risk is not NCUA guidance, but its lifecycle is useful: due diligence, contracting, monitoring and termination all require resources.

Gate: the case shows a total cost range and an exit cost, not only subscription and implementation fees.

4. Separate capacity, cash and member outcomes

Put each claimed benefit in one of three buckets:

• Cash impact: an expense avoided, loss reduced or revenue realized in the financial plan.
• Capacity released: employee time available for a named activity, without automatically treating it as headcount savings.
• Member or control outcome: shorter resolution time, fewer repeat contacts, more consistent review, lower error or stronger evidence.

Do not add all three if they describe the same improvement. Five minutes saved per case is not simultaneously labor savings, higher revenue and better member service unless the operating plan explains how each effect occurs and prevents double counting. Assign every benefit to an executive who can cause the redeployment or outcome—not to the vendor.

5. Risk-adjust the forecast

Use floor, base and upside cases. Vary adoption, eligible volume, accuracy, exception rate, employee override, integration delay and vendor cost. Add an explicit reserve for remediation or parallel operation when the tool touches regulated decisions, member communications, sensitive data or critical processes.

The NIST AI Risk Management Framework emphasizes governing, mapping, measuring and managing risk throughout the AI lifecycle. Finance can make that concrete by connecting risk events to cash, capacity and timing assumptions. If one increase in exception volume erases the projected benefit, the proposal needs a smaller scope or stronger control design.

Gate: the floor case is affordable, the base case does not depend on unverified vendor performance and management can identify the assumptions most likely to change the decision.

6. Fund evidence in stages

Approve a capped pilot with predetermined pass, pause and stop thresholds. Use a representative sample, compare it with the baseline and preserve a control group or matched period where practical. Measure quality and exception work as well as speed.

A pilot should produce an evidence packet: version tested, eligible population, results by scenario, employee overrides, complaints or errors, control failures, total internal effort and revised costs. For regulated or member-impacting workflows, add compliance, risk and independent validation evidence. Our AI vendor due-diligence checklist covers the contract and control questions that belong beside the financial test.

Gate: the next funding release depends on measured thresholds, not completion of the vendor implementation plan.

7. Keep a benefits ledger after launch

The approved case becomes the production scorecard. For each benefit, record the baseline, target, actual result, data owner, operating owner, review date and corrective action. Track costs and risk indicators on the same page so leaders do not celebrate faster processing while rework, complaints or monitoring effort rises elsewhere.

Review early enough to change the rollout. A practical cadence is weekly during a limited pilot, monthly during initial production and quarterly after the workflow stabilizes. Material model, data, price or workflow changes should reopen the case. Benefits that cannot be evidenced should be removed from the forecast; new benefits can be added only with a defined measure and owner.

The one-page decision packet

Before the executive team or board approves broader deployment, finance should be able to present one page containing:

• the bounded use case, member population and accountable executive;
• the baseline volume, cost, quality and service measures;
• pilot, production and steady-state total cost;
• cash, capacity and member/control benefits without double counting;
• floor, base and upside cases with the decisive assumptions;
• pilot thresholds, control evidence and stop conditions;
• the benefits ledger owner and review cadence; and
• the next funding decision and the evidence required to earn it.

This framework does not require every AI use case to produce a short-term return. Some investments are defensive, compliance-driven or necessary to preserve service capacity. The discipline is the same: name the outcome, count the full cost, expose the uncertainty and decide in stages. That gives the credit union a stronger answer than “the vendor says it saves 30 percent”—and a way to stop paying when the evidence does not arrive.