OSFI, frontier AI, third-party risks, OSFI semi-annual risk outlook 2026, Annual Risk Outlook, cyber risk, AI concentration risk, Domestic Stability Buffer, Peter Routledge, AGILE framework
A small number of providers dominate the development of frontier AI models and the cloud infrastructure behind them. OSFI said that concentration raises the potential for correlated disruptions if a critical provider has an operational failure, cyber incident or service outage. With many technology services concentrated outside Canada, cross-border dependencies will likely increase, the regulator said.
Keeping up is part of the job
OSFI flagged reputational risk for institutions and their third parties that fall behind on emerging technologies. It named cyber security and vulnerability identification as the most important area of innovation, and said governance, controls and testing should evolve at a similar pace as AI use grows. Boards and senior management remain accountable, OSFI said.
This year, OSFI published technology risk bulletins on generative and agentic AI and on frontier AI. It worked with the Canadian Centre for Cyber Security on a June information-sharing session and a September Industry Day, and co-hosted the second Financial Industry Forum for Artificial Intelligence, which produced the AGILE framework.
With Canada’s national security partners, OSFI co-hosted the second annual National Security Threat Forum. Alongside other Financial Stability Board members, it co-authored Sound Practices for Responsible Adoption of Artificial Intelligence, published for public consultation in June.
OSFI said innovation must be accompanied by sound governance and robust risk management practices. Superintendent Peter Routledge said: “In an era of advancing AI capabilities, resilience is a competitive advantage. Financial institutions that harness AI responsibly while managing cyber, technology, and third-party risks will position themselves to thrive in a complex environment.”
