Estimated reading time: 12 minutes
Key Takeaways
- AI Governance in Canadian Financial Services – Canada currently lacks a federal AI law; financial services are governed by regulators’ guidelines and privacy laws effective in 2027.
- OSFI E-23 explicitly includes AI in model risk management, impacting all federally regulated financial institutions starting May 1, 2027.
- The AMF has issued a dedicated guideline for AI use, requiring risk classification and lifecycle management for numerous Quebec firms by May 1, 2027.
- Quebec Law 25 mandates transparency around automated decisions and impacts any business using personal information about Quebec residents.
- Firms should prioritize building an AI and model inventory to comply with emerging regulations and guidelines.
Overview of AI Governance in Canadian Financial Services (2026)
OSFI E-23, AMF, CSA and Quebec Law 25
Canada has no federal AI law in force. The proposed Artificial Intelligence and Data Act (AIDA), part of Bill C-27, died on the order paper when Parliament was prorogued in January 2025. Therefore, AI in financial services is instead governed by financial regulators’ guidelines, securities guidance and privacy law, several of which take effect in 2027.
This guide sets out what applies to banks, insurers, wealth managers and dealers as of late 2026, and the evidence firms should keep.
Which rules apply to your firm
| Firm type | Regulator | What applies to AI use |
| Federally regulated financial institution (FRFI): banks, federally regulated insurers, trust and loan companies | OSFI | Guideline E-23 Model Risk Management (from May 1, 2027); B-10 Third-Party Risk; B-13 Technology and Cyber Risk |
| Quebec-authorized insurers, financial services cooperatives, trust companies and deposit institutions | AMF | Guideline for the Use of Artificial Intelligence (from May 1, 2027) |
| Registrants: portfolio managers, investment fund managers, dealers | Provincial securities regulators (CSA) | CSA Staff Notice and Consultation 11-348 |
| Investment dealers and mutual fund dealers | CIRO | Existing rules, outsourcing guidance, 2026 Compliance Report |
| Any business using personal information of Quebec residents | Commission d’accès à l’information | Quebec Law 25, section 12.1 (automated decisions) |
A Quebec-based wealth firm with a dealer arm and a federally regulated parent can sit in four of these rows at once.
OSFI Guideline E-23: model risk management now covers AI
OSFI published the final Guideline E-23 – Model Risk Management on September 11, 2025. It takes effect for all federally regulated financial institutions on May 1, 2027, giving an 18-month transition.
What changed from the 2017 version:
- AI is explicitly a model. The definition of “model” now includes AI and machine learning methods, not only financial and actuarial models.
- Scope widened. E-23 now applies to all FRFIs, including life and P&C insurers, not only deposit-taking institutions.
- Enterprise-wide and proportionate. Expectations scale with an institution’s size, complexity and risk, but every institution needs an enterprise model risk framework and a current model inventory.
- Third-party models count. OSFI did not give a grace period for third-party model risk, so vendor AI (including AI features inside platforms you license) needs to be inventoried and governed.
In practice, E-23 expects a firm to identify every model, rate its risk, validate it, monitor it after deployment and document all of this. A static, one-time compliance exercise will not meet it.
Related OSFI guidelines. E-23 is read alongside Guideline B-13 Technology and Cyber Risk Management (in effect since January 1, 2024) and the updated Guideline B-10 Third-Party Risk Management (in effect since May 1, 2024). An AI tool from a vendor touches all three.
Quebec AMF: a dedicated AI guideline
On April 7, 2026, the Autorité des marchés financiers published the final version of its Guideline for the Use of Artificial Intelligence, the first AI guideline issued by a provincial financial regulator. It takes effect on May 1, 2027.
It applies to authorized insurers, financial services cooperatives, authorized trust companies and other authorized deposit institutions in Quebec. The AMF expects these institutions to:
- Classify AI systems by risk and manage them across their full lifecycle, from justifying the use case to decommissioning
- Define the roles of the board and senior management for AI
- Produce reliable outputs suited to each system’s intended use, and monitor them
- Treat clients fairly where AI is used in client interactions, building on the AMF’s Fair Consumer Practices Guideline
- Apply all of this in proportion to the institution’s size, complexity and risk profile
The guideline supplements the AMF’s model risk management guideline. The AMF has also published a Third-Party Risk Management Guideline, effective April 1, 2027.
Securities regulators: CSA Staff Notice 11-348 and CIRO
CSA Staff Notice and Consultation 11-348. Published December 5, 2024, the notice explains how existing securities law applies to AI systems used by registrants, issuers, marketplaces and others. It does not create new legal requirements. Its key points for registrants:
- Governance and risk management practices should account for the specific AI system and its risks
- Supervisory controls, policies and procedures should cover AI use
- Firms remain responsible and accountable for outsourced functions, including AI services
- “Black box” AI that cannot be explained sits poorly with a market built on transparency
- Disclosures about AI use must be fair, balanced and not misleading
The CSA’s consultation closed March 31, 2025, and responses will shape any future rules.
CIRO. CIRO’s Compliance Report for 2026, published February 17, 2026, names the use of AI among the operational and compliance issues dealers should prioritize. For AI services provided by third parties, CIRO points dealers to its existing Guidance Note on outsourcing arrangements.
Quebec Law 25: automated decisions
Since September 22, 2023, section 12.1 of Quebec’s private-sector privacy act has required any business that makes a decision about a person based exclusively on automated processing of their personal information to:
- Tell the person, no later than when they are informed of the decision, that it was automated
- On request, explain the personal information used and the main factors and parameters behind the decision
- Let the person have their information corrected and submit observations to someone who can review the decision
The trigger is “exclusively” automated. Keeping a meaningful human review step in client-facing decisions (account opening, suitability flags, underwriting) changes which obligations apply. Law 25 also requires privacy impact assessments before acquiring or developing new information systems, which includes most new AI tools.
The evidence to keep: a checklist
Across OSFI, the AMF, the CSA, CIRO and Law 25, regulators ask for the same core evidence:
- AI and model inventory. Every AI system, model and AI feature in use, including those inside vendor platforms, with an owner for each.
- Risk classification. A documented rating for each system, reviewed when its use changes.
- Board and senior management roles. Who approves AI use and who is accountable.
- Validation and testing. Before deployment and again after vendor updates, model version changes or workflow edits.
- Ongoing monitoring. Output quality, drift and errors, with records of what was found and fixed.
- Vendor and third-party oversight. Due diligence, contract terms and monitoring aligned with B-10 or the AMF third-party guideline.
- Privacy impact assessments. Completed for new AI systems that handle personal information.
- Automated-decision notices. Where any decision is exclusively automated, the Law 25 notice and human review path.
- Accurate disclosures. Client and marketing statements about AI that match what the tools do.
- Training and conduct. Staff trained on approved use; code of ethics updated to cover AI.
How Navirum Orbit helps
The 2027 dates leave Canadian firms roughly six months to move from policy to evidence. Navirum Orbit is a managed service for financial services firms, based in Montréal, that runs AI governance and AI assurance as part of day-to-day operations:

- Builds and maintains your AI inventory across Salesforce, Agentforce and connected advisor and insurance tools
- Re-tests AI behaviour after each release and configuration change
- Keeps the monitoring records, version history and review evidence your risk and compliance teams need
- Supports vendor oversight with documentation for each AI provider
- Works in English and French
Orbit supports your compliance and model risk programs; it does not replace your compliance team or legal counsel.
Frequently Asked Questions
E-23 applies to federally regulated financial institutions: banks, foreign bank branches, federally regulated insurers and trust and loan companies. A standalone portfolio manager or dealer is regulated provincially and through CIRO instead, but a wealth arm inside a bank or insurer falls under E-23 through its parent.
May 1, 2027. The final guideline was published September 11, 2025.
Is AIDA still coming? AIDA died with Bill C-27 in January 2025. There is no federal AI statute in force. Financial firms should plan around the sector guidelines and privacy law instead.
It applies to businesses that collect, hold or use personal information about Quebec residents, wherever the business is based.
Build the AI and model inventory, including AI features inside platforms you already license. E-23, the AMF guideline and Law 25 all depend on it.
This guide is for general information and is not legal advice. Rules and dates change; confirm current requirements with your compliance team or counsel.
Sources
- OSFI: Guideline E-23 – Model Risk Management (2027)
- OSFI: Guideline E-23 letter
- Blakes: OSFI releases final Guideline E-23
- Torys: Understanding B-13
- AMF: Guideline for the Use of Artificial Intelligence
- Blakes: Quebec’s AMF issues guideline on the use of AI
- BLG: AMF publishes its expectations on the use of AI
- Fasken: Insurance and distribution in Quebec
- Osler: Navigating AI systems in capital markets, CSA guidance
- Data Protection Report: CSA guidance on AI in capital markets
- CIRO: Highlights of the 2026 Compliance Report
- BLG: CIRO’s compliance report for 2026
- McCarthy Tétrault: Law 25 automated decisions
Knowledge & Insights
Strategic perspectives on Salesforce FSC compliance, AI governance, agentic workflows, and managed services.






















