OSFI makes frontier AI focus of fall risk update

Canada’s financial regulator has made frontier artificial intelligence the centrepiece of its fall risk update, warning that the technology can amplify cyber, technology, third-party and reputational risks at banks and other federally regulated institutions.

The Office of the Superintendent of Financial Institutions (OSFI) released its 2026 Semi-Annual Risk Outlook on Oct. 8. It updates the 2026-2027 Annual Risk Outlook, and OSFI said the main risks identified there still apply.

“In an era of advancing AI capabilities, resilience is a competitive advantage,” Superintendent Peter Routledge said in the release.

OSFI said geopolitical uncertainty, economic change and fast technological progress have raised risk in Canada’s financial system. It also said the system remains resilient, supported by strong capital, liquidity, governance and risk management.

According to Wealth Professional, which reported on the update Oct. 9, OSFI said the pace of change in AI capabilities is without precedent since its April outlook. The regulator said frontier AI is shortening the time between the discovery of a vulnerability and its exploitation, leaving institutions less time to respond.

OSFI also said AI, including autonomous capabilities, is making cyberattacks faster and more sophisticated, and that skills once requiring deep expertise are now available to a wider range of threat actors, Wealth Professional reported.

A second concern is concentration. The trade publication reported that OSFI said a small number of providers dominate frontier model development and the cloud infrastructure used to deploy it, which raises the risk that one provider’s failure, cyber incident or outage could disrupt many institutions at once. Many technology services are supplied from outside Canada, and OSFI expects those cross-border dependencies to grow as institutions adopt frontier AI.

The regulator added reputational risk to its AI threat inventory. Wealth Professional reported that OSFI linked it to slow adoption of emerging technology, and to the need for governance, controls and testing to keep pace. OSFI’s release said boards and senior management remain accountable for managing these risks, and that responsible adoption can help institutions adapt and grow.

The update does not announce new rules. OSFI said it will monitor AI-amplified risks, strengthen its ability to assess frontier AI, technology concentration and critical third-party dependencies, and work with industry, national security partners and international regulators. It said it will update its risk assessment when developments warrant. The release did not mention an open consultation.

OSFI has issued two technology risk bulletins this year, one on generative and agentic AI and one on frontier AI. It also pointed to a report on an AGILE framework for AI in Canadian financial services, which Wealth Professional said has five components: awareness, guardrails, innovation, learning and ecosystem resiliency. The regulator said it co-hosted a September industry day with the Canadian Centre for Cyber Security.

The update lands as Ottawa builds its own AI governance structure. Prime Minister Mark Carney named 13 people to a new national AI council this month, as reported by Canada News Media. OSFI’s focus on provider concentration and cross-border dependencies speaks to a question that council and Canadian businesses outside finance also face: how much of their AI capability depends on a handful of foreign suppliers.

The four risks OSFI highlighted in April remain in focus, Wealth Professional reported: real estate secured lending, non-bank financial institution risks, funding and liquidity risks, and other risks. The reports read did not say which institutions OSFI considers most exposed to AI-related disruption.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.

Sources: OSFI news release (Oct. 8, 2026); Wealth Professional (Oct. 9, 2026).