Peter Routledge participates in a fireside chat at the 2026 Tech Festival

Check against delivery

Moderator:

How agentic and frontier AI has changed the risk landscape for Canada's financial institutions

Superintendent Peter Routledge:

• A quick word on OSFI's perspective: As Canada's prudential regulator, we aren't assessing whether a technology is good or bad. We're asking whether institutions understand the risks, have appropriate controls, and can remain resilient if those risks materialize.
• Frontier AI increases the speed of risk and is one of our top risks in our Semi-Annual Risk Outlook. Agentic AI adds scale and automation, including systems that can act with limited human oversight.
• We have published Technology Risk Bulletins on frontier AI and generative and agentic AI to highlight emerging risks and sound practices.
• OSFI also endorses the Financial Stability Board’s Sound Practices for Responsible Adoption of AI (Sound Practices), which promote strong governance, oversight and risk management for responsible AI adoption.

Moderator:

As financial institutions increasingly integrate AI into their operations, how does OSFI strike the right balance between building resilience against emerging technology risks and creating an environment where innovation can thrive?

Superintendent Peter Routledge:

• OSFI supports innovation within Canada’s regulated financial system, where new Fintechs can enter and grow under appropriate prudential oversight.
• We are adjusting our risk appetite statement to reflect changes in the risk environment and the trade-offs facing the financial system.
• Institutions that build resilience and accountability into AI adoption will be better positioned to capture its benefits.
• OSFI takes a risk-based, principles-based and proportionate approach to responsible AI adoption. Our existing guidelines set expectations that apply to the adoption and use of AI. Recognizing how quickly the technology is moving, our approach is pragmatic and adaptive, focusing on outcomes rather than prescribing rules for every new development.
• Our Streamlined Approvals Framework gives eligible new entrants (Fintechs), including entities with innovative or emerging banking models, a quicker, clearer and more predictable path to becoming federally regulated financial institutions. It supports early engagement with OSFI and allows institutions to enter and scale under continued prudential oversight. This can support greater competition and responsible innovation.
• And while there is significant investment and excitement around AI, our focus is on the technology's long-term utility and institutions' ability to manage the risks associated with its adoption.

Moderator:

AI concentration risk and reliance on global technology providers

Superintendent Peter Routledge:

• AI can increase concentration risk through reliance on common third-party models, data and technology providers. Institutions should understand these dependencies, how critical they are, and how they could affect resilience.
• When multiple institutions rely on the same critical providers, risks can have broader, system-wide implications.
• Institutions remain accountable for managing these dependencies, including through effective governance and tested contingency plans.

Moderator:

What boards and senior executives should be doing now

Superintendent Peter Routledge:

• The message for boards and senior management: Robust governance, clear accountability, effective cyber hygiene, and disciplined and forward-looking technology risk management, remain the foundation of a resilient institution.
• Boards and senior management should have visibility into the institution’s material uses of AI and understand how they affect its risk profile, operations, and controls.
• Institutions should align their AI strategy with risk appetite, maintain clear accountability and ensure effective oversight.
• Boards need enough understanding to ask the right questions, challenge management and assess whether controls remain appropriate as AI evolves.
• Boards and senior management should view operational resilience as a competitive advantage. Institutions that effectively manage technology, cyber and operational risk will be better positioned to compete as AI and the technology environment evolve.

Moderator:

What OSFI has published on technology risk and how to apply it

Superintendent Peter Routledge:

• Our existing guidance addresses areas relevant to AI, including technology and cyber risk, third-party risk, operational resilience, model risk and corporate governance.
  • Guidelines B-13, B-10 and E-21 set expectations for technology and cyber risk, third-party risk, and operational risk and resilience.
• We have also published Technology Risk Bulletins on frontier AI and generative and agentic AI. They highlight emerging risks and sound practices aligned with our existing guidance.
• Internationally, OSFI collaborated in the development of the FSB’s Sound Practices for Responsible AI Adoption, and issued the OSFI statement on the Financial Stability Board’s publication of Sound Practices for Responsible Adoption of Artificial Intelligence.
• Since 2022, OSFI has worked with the Global Risk Institute through the Financial Industry Forum on Artificial Intelligence, bringing together industry, academia and government to deepen understanding of AI-related opportunities and risks and effective risk management.

Moderator:

OSFI's role in domestic and international approaches to responsible AI

Superintendent Peter Routledge:

• Canada's financial system needs to be both resilient and dynamic. Prudential regulation should create the conditions for institutions to innovate, compete and support economic growth while managing the risks arising from technology and AI transformation.
• In Canada, OSFI has worked with public- and private-sector partners through initiatives such as the Financial Industry Forum on Artificial Intelligence to deepen understanding of AI risks and opportunities. We also collaborate with the Canadian Financial Resilience Group (CFRG) led by the Bank of Canada, which is a public and private sector forum to share and collaborate on incidents and topics such as frontier AI.
• In June, OSFI and the Canadian Centre for Cyber Security co-hosted an industry information-sharing session on frontier AI, where the Cyber Centre provided institutions with tools, services and resources to help them prepare for emerging AI-enabled cyber threats.
• Internationally, OSFI works with the FSB, G7 Cyber Expert Group, Basel Committee and other regulators to share information and leading practices.