Need incident response?

Home › Legal Alerts

15.10.2026Priority 3: MediumCanadaInternational

OSFI endorses the FSB's sound practices for responsible AI adoption

Artificial Intelligence

What changed

OSFI endorsed the Financial Stability Board's 12 Sound Practices for Responsible Adoption of Artificial Intelligence, which cover organization wide AI governance across the AI lifecycle. The practices call for clear accountability, effective human oversight, sound data governance and controls proportionate to the risk of each use case. OSFI introduces no new requirements. It states instead that the practices complement six existing guidelines: Corporate Governance, Integrity and Security, B-10, B-13, E-21 and E-23.

Source: View the official source

Why it matters

Federally regulated financial institutions are expected to manage AI risk under their existing OSFI guidelines.
Accountability, human oversight, data governance and proportionate controls are the core expectations.
AI use cases connect directly to third party, technology, operational and model risk obligations.

Our comment

The statement confirms that federally regulated financial institutions are expected to manage AI risk through their current frameworks now, rather than wait for AI specific rules. For insurers and other FRFIs, the practical question is how AI use cases map onto existing third party, technology, model and operational risk obligations.

Questions about this alert?

Sara Derbel

Paralegal

Our team can explain what this development means for your organization.

Related services

Regulatory Intelligence
Regulatory intelligence and legislative monitoring for AI, privacy and cybersecurity across Canada, the US, EU, UK and Australia, filtered, prioritized and reviewed by legal experts.
View service
vCAIO Packages
Virtual Chief AI Officer (vCAIO) support: AI governance, AI gap assessments, AI risk and impact assessments and responsible AI adoption aligned with emerging regulation.
View service
Tech RFP Management
Technology RFP management and procurement support: RFI, RFP and RFQ structuring, vendor due diligence, third-party risk and negotiation of SaaS, cloud and AI contracts.
View service
The Vox
Our regulatory intelligence magazine, with the latest issues and Legal Alerts.
Read The Vox

Related expertise

Artificial Intelligence
AI law and AI governance advice in Canada: responsible AI policies, data use, accountability and AI contracts for companies that build or deploy AI.
View expertise
Governance, Risk & Compliance (GRC)
GRC services including third-party risk management, legislative gap assessments, compliance programs and policies aligned with Canadian regulations.
View expertise

Similar alerts

23.10.2026ConsultationCanada
Privacy Commissioner of Canada comments on AI transparency consultation
The Office of the Privacy Commissioner of Canada released its comments on Innovation, Science and Economic Development Canada's consultation on AI transparency, which ran from July 23 to September 23, 2026. The OPC agrees that transparency issues arise in all five areas ISED identified: AI generated content, AI interaction, information about AI systems, AI incidents and AI agents. It argues that information about a system must be understandable at the point where it affects an individual's decision. The OPC anchors its position in its existing consent guidelines and names developers and deployers of generative AI as bearing transparency responsibilities.
- Privacy
- Artificial Intelligence
Read the alert
22.10.2026LegislationEuropean Union
EU Council adopts its negotiating mandate on the Digital Omnibus
The Council of the EU agreed its negotiating mandate on the Digital Omnibus Regulation, which amends the GDPR, the ePrivacy Directive, the EUDPR and the Data Act. The mandate keeps the current definition of personal data but states that pseudonymised data is not personal data for a recipient without reasonable means to reidentify the individual. It allows processing for AI development to rely on legitimate interest, subject to a right to object and added safeguards for children. It would also limit breach notification to the supervisory authority to breaches likely to result in high risk, and add exemptions to cookie consent for security updates, audience measurement and requested functionality. This is a Council position only. Trilogue begins once Parliament adopts its own position.
- Privacy
- Artificial Intelligence
Read the alert
16.10.2026Legal precedentQuebecCanada
Court of Québec upholds CAI order against Clearview AI
The Court of Québec dismissed Clearview AI’s appeal of the 2021 order issued by the Commission d’accès à l’information (CAI). The order requires the company to stop collecting images of Quebecers and to destroy their images and biometric identifiers. The Court found a real and substantial connection with Quebec even though Clearview has had no office, staff or clients there since 2020. It also held that information collected in breach of the law cannot rest on a serious and legitimate interest.
- Privacy
- Artificial Intelligence
Read the alert