Uptime Is a Compliance Question: Assessing AI Voice Resilience for Credit Unions

When a member loses a card on a Saturday evening, the phone is usually the first place they turn. If an AI voice agent answers that call, its availability is no longer just an IT matter. It becomes part of how the credit union delivers an important service, and part of what the board has to oversee.

Credit unions should assess AI voice resilience the way they assess any outsourced service: network uptime, what happens when the AI is unavailable, incident notification, testable access and documented continuity. Those map directly to Section 76J of the Credit Union Act 1997 and the Central Bank's operational resilience guidance.

TL;DR

• An AI voice service handling card blocking or payment queries falls within the Central Bank's Cross-Industry Guidance on Operational Resilience.
• DORA doesn't bind Irish credit unions until the transitional exemption ends on 17 January 2028, but contracts signed now will still be running then.
• The key question is what members experience when the AI isn't working. The call path to staff has to survive an AI outage.
• Ask suppliers for evidence, not clauses: SLA performance, incident logs, joint continuity tests and access auditors can exercise.

Why is AI voice resilience a compliance question?

Because the phone line is where members go when something is urgent. A lost card, a payment that hasn't cleared, a loan query from a member who doesn't use the app: each depends on a call being answered.

The Central Bank of Ireland's Cross-Industry Guidance on Operational Resilience applies to all regulated financial service providers, including credit unions. It sets out how firms should prepare for, respond to, recover from and learn from disruption to critical or important business services. The revised guidance, published in July 2025, also requires a documented annual operational resilience self-assessment.

An AI voice agent is also an outsourced part of a member service. Section 76J of the Credit Union Act 1997 governs that outsourcing, and the Credit Union Handbook sets out what the board should expect from the supplier.

Does DORA apply to AI voice services at Irish credit unions?

Not yet. Irish credit unions have a transitional exemption from the Digital Operational Resilience Act until 17 January 2028, so its ICT third-party requirements don't bind them directly today.

That doesn't make DORA irrelevant. The revised Central Bank guidance encourages firms outside DORA's direct scope to adopt equivalent measures, and an AI voice contract signed now will probably still be in force in 2028. Building DORA-style incident classification, testing and exit planning in from the start avoids renegotiating later.

What should a credit union ask an AI voice supplier?

Seven areas cover most of the risk. The table sets out the question for each and what a good answer includes.

The second row matters most. A credit union can tolerate an AI agent that misunderstands a query, because the call can pass to a person. It can't tolerate a design in which an AI outage means nobody answers the phone.

How does DigitalWell's AI Voice Network answer these questions?

The AI Voice Network runs at the network layer rather than inside a separate contact centre application. AI Voice Agents work on the phone system and numbers a credit union already has, so there's no platform migration and no second phone system to keep running.

DigitalWell supports more than 75 credit unions across Ireland, according to its partner Wellington IT, and carries over 100 million minutes of voice traffic on its own network. DigitalWell reports no network downtime in 2025 or 2026 to date, and is ISO 27001 certified across four consecutive years.

Cian Maher at DigitalWell describes the support levels behind that:

"Our resolved within SLA is currently 93%. [A] customer logs a priority one ticket, they expect to get a response within an hour and they expect it to be resolved within four hours." Cian Maher, DigitalWell

DigitalWell's credit union service is built around Central Bank outsourcing obligations. It includes a board-ready documentation pack (data location, security posture, SLA and KPI performance, incident logs), access auditors and the Central Bank can test, joint continuity testing alongside the credit union's BCP, a defined incident process with a running notification clock, and threat indicators shared across DigitalWell's credit union customers.

For members, every call is transcribed, summarised and logged, callers are verified before anything account-specific is discussed, and calls that need a person reach staff already verified.

How should a credit union run an AI voice resilience assessment?

Make it part of the outsourcing review the board already does, not a separate IT exercise.

• Map the member services the AI will touch. List each call type and mark which support an important business service.
• Set impact tolerances. Decide how long each service can be unavailable before members suffer harm. Card blocking needs a tighter tolerance than branch hours.
• Send the supplier the assessment questions. Ask for evidence with every answer.
• Test the fallback before go-live. Simulate the AI being unavailable and confirm member calls still reach staff on the same number.
• Align the incident process. Match the supplier's severity levels and notification times to your own reporting obligations.
• Schedule a joint continuity test. Run it alongside your BCP test so the results can be reported together.
• Record it in the risk register and annual self-assessment. Then note which contract terms will need to meet DORA from 2028.

Frequently Asked Questions

Is an AI voice agent an outsourced service for a credit union?

In most cases, yes. If a third party provides the technology that answers and resolves member calls, treat it as outsourcing under Section 76J of the Credit Union Act 1997.

When does DORA start to apply to Irish credit unions?

The transitional exemption ends on 17 January 2028. Until then, the Central Bank's operational resilience guidance and the Credit Union Act outsourcing provisions apply.

What happens if the AI voice agent can't handle a call?

On DigitalWell's AI Voice Network, the call passes to a member of staff, and the member arrives already verified with a summary of the call so far.

Do members know they're speaking to AI?

They should. DigitalWell's AI Voice Agents tell callers at the start of the call, and callers can ask for a person at any point.

Do we need to replace our phone system to use AI voice agents?

No. DigitalWell's AI Voice Agents run on the network the credit union already uses. Many credit unions start with connectivity or telephony and add AI later.

Key Takeaways

• Once AI answers member calls, its uptime belongs in the risk register and the outsourcing review.
• The Central Bank's operational resilience guidance and Section 76J apply now; DORA applies from 17 January 2028.
• The fallback path to staff during an AI outage is the single most important thing to test.
• Measured uptime, published SLA performance and testable access are the evidence boards should ask for.
• Network-layer AI on the existing phone system adds fewer new failure points than a platform migration.

Want to check how resilient your member phone service is? Ask DigitalWell's credit union team for an AI voice resilience review, or hear the AI Voice Agent demos.