OSFI statement on the Financial Stability Board’s publication of Sound Practices for Responsible Adoption of Artificial Intelligence

Key dates

2026-10-15

OSFI published its statement endorsing the FSB Sound Practices for Responsible Adoption of Artificial Intelligence; the FSB also published the final Sound Practices on this date.

Suggested considerations

• Compliance teams may wish to map the 12 FSB practices against existing controls under OSFI’s Corporate Governance Guideline, Integrity and Security Guideline, Guideline B-10, Guideline B-13, Guideline E-21 and Guideline E-23.
• Firms should consider maintaining an enterprise-wide inventory of AI use cases, including internally developed systems, embedded vendor functionality and generative or agentic AI, with documented owners, intended purposes, materiality assessments and lifecycle status.
• Boards and senior management may wish to review whether the institution’s business strategy, risk appetite and governance framework clearly address AI adoption, accountability, escalation and human oversight.
• Firms should consider assessing AI use cases for operational, technology, cyber, third-party, model, data, privacy, conduct and governance risks, with controls proportionate to the materiality and risk of each use case.
• Compliance and risk functions may wish to review AI development and deployment documentation, validation, monitoring, change management, testing, incident escalation, explainability and retirement processes, including for systems supplied by third parties.
• Institutions should consider evaluating whether existing B-10 outsourcing and third-party risk controls address vendor model changes, data access, subcontracting, concentration risk, resilience, audit rights and exit arrangements for AI-enabled services.
• Internal audit or an equivalent independent assurance function may wish to assess whether AI governance and lifecycle controls operate effectively and whether management reporting to the board is sufficiently complete.
• Firms may wish to monitor subsequent OSFI technology risk bulletins, supervisory communications and future revisions to the FSB practices, since OSFI stated that it will continue monitoring how AI changes the risk environment and institutional operations.

What changed

OSFI formally endorsed the FSB Sound Practices and identified them as complementary to existing OSFI expectations. The FSB practices cover organization-wide AI governance and management across the AI lifecycle, including strategic direction, accountability, risk management, human oversight, data governance, controls, adaptability and coordination. The publication is non-binding guidance rather than a new OSFI rule, capital requirement, reporting obligation or prescribed compliance deadline. Independent commentary has characterized the practices as a global governance framework that firms can implement through existing structures, including board-approved AI strategy and risk appetite, enterprise AI inventories, approval processes, lifecycle documentation and defined responsibilities across

Who is affected

• Canadian federally regulated banks and other deposit-taking institutions supervised by OSFI
• Canadian federally regulated insurance companies and private pension plans supervised by OSFI
• OSFI-regulated financial institutions using artificial intelligence, including generative AI, machine learning or agentic systems
• Technology and other third-party service providers supporting AI systems used by OSFI-regulated institutions

Related regulations

• OSFI Corporate Governance Guideline
• OSFI Integrity and Security Guideline
• OSFI Guideline B-10: Third-Party Risk Management
• OSFI Guideline B-13: Technology and Cyber Risk Management
• OSFI Guideline E-21: Operational Risk Management and Resilience
• OSFI Guideline E-23: Model Risk Management
• FSB Sound Practices for Responsible Adoption of Artificial Intelligence