Managing the AI Risks in the Financial Sector: OSFI’s Bulletin on Generative and Agentic Artificial Intelligence

OSFI has issued new guidance for federally regulated financial institutions on the risks and governance of generative and agentic artificial intelligence. Published on July 13, 2026, OSFI's bulletin, Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational Resilience (the "AI Bulletin"), provides practical guidelines to financial institutions for managing AI-related technology, cybersecurity, operational resilience and third-party risks.

Key Takeaways

• OSFI has issued new guidance on the use of generative and agentic AI by federally regulated financial institutions.
• Existing requirements under OSFI's technology, operational resilience and third-party risk guidelines apply to AI systems and should be reviewed through an AI-risk lens.
• Canadian financial institutions should establish clear accountability, maintain human oversight, and assess whether existing controls adequately address AI-specific risks.
• Particular attention should be paid to data governance, AI-generated outputs, software development practices, AI agent access rights and third-party AI dependencies.
• The Bulletin signals OSFI's continued focus on AI governance and operational resilience as AI adoption accelerates across the financial sector.

Context

If we are to believe recent headlines, AI may lead to cybersecurity catastrophe even before quantum computing cybersecurity risks are fully realized. Last April, Anthropic delayed the release of its new flagship model, Mythos, due to its powerful ability to identify critical cybersecurity vulnerabilities, making a version of it generally available only in July (under the name Fable 5), following an exclusive release to high-vulnerability companies and government institutions to give them opportunity to patch their vulnerabilities. Not to be undone, OpenAI revealed in late July that its own state-of-the-art models, in an apparent excess of zeal, hacked into multiple third parties’ platforms during its attempts to answer questions as part of benchmark testing.

While still far from a Terminator-style Skynet-moment, these new developments have raised genuine concerns well beyond the software and AI industries. Regulators and industry bodies now warn financial institutions of new cybersecurity threats from the advanced cyber and coding skills of frontier AI models. In an unprecedented move, high-ranking officials of the U.S. Treasury Department and the Federal Reserve convened for an urgent meeting with U.S. bank chief executives to discuss the cyber risks posed by Mythos’ claimed ability to find and exploit software vulnerabilities better than any other model to date.

On our side of the border, Mythos-level models were also a hot topic of discussion at the Canadian Financial Sector Resiliency Group meeting held in April. In May 2026, the Canadian Office of the Superintendent of Financial Institutions (“OSFI”) published a cybersecurity guidance (ITSAP.10.050) specifically on “frontier artificial intelligence” (the “Frontier AI Guidance”).

We summarize in this blog post the main recommendations OSFI makes in the AI Bulletin, with reference to relevant recommendations of the Frontier AI Guidance and other OSFI AI-related guidelines.

What OSFI’s AI Bulletin does

The AI Bulletin provides guidance on both generative AI (used for “content creation”) and agentic AI (that uses “autonomous reasoning and execution” to accomplish tasks). As such, it takes a broader approach to AI than the Frontier AI Guidance which focuses only on “frontier artificial intelligence”. Although OSFI does not refer to any specific model by name, such models would almost certainly include Anthropic’s Mythos or OpenAI’s GPT 5.6 (and perhaps even some open weight models, such as Moonshot’s Kimi K3). As OSFI points out, frontier AI models that exhibit the most advanced cybersecurity-breaking capabilities are “becoming more accessible and widely available”, including to both sophisticated and unsophisticated threat actors. Because the “frontier” of AI technology keeps moving forward, however, the concept “frontier” or “advanced” AI models can be misleading from a governance and regulatory perspective. Moreover, despite the fact that last year’s most advanced models have yielded their place at the frontier to more capable descendants, they remain powerful systems that require legal and technical risk mitigation measures. In other words, effective governance of AI risk must not only focus on the most recent releases. Accordingly, Canadian financial institutions should be aware of both the Frontier AI Guidance and the AI Bulletin.

Practitioners familiar with responsible AI governance principles (developed, notably, by the OECD and NIST) will not be surprised by the AI Bulletin’s guidelines. OSFI usefully maps its generative and agentic AI recommendations to principles set out in guidelines Canadian financial institutions already follow: Guidelines B-13 (Technology and Cyber Risk Management), E-21 (Operational Risk Management and Resilience) and B-10 (Third-Party Risk Management). As you will see from our summary below, financial institutions do not need to reinvent the wheel of data, cyber and IT governance to address AI risks. Yet, generative and agentic AI’s unique characteristics require tailored measures.

• Enhance governance and strategic accountability: OSFI highlights two aspects of current AI systems that challenge governance structures: their ability to act autonomously with limited human oversight and the complexity of the AI vendor landscape which increases exposure to third-party risks.
  
  To address this, OSFI recommends that financial institutions integrate consideration of AI risks into existing risk management frameworks. This is sound advice: financial institutions already have functions, processes and policies dedicated to addressing cyber, IT and procurement risks and managing AI risks will be facilitated by leveraging existing structures. OSFI also insists on accountability in the form of clear ownership of the different steps in the AI lifecycle (which range from procurement or development to decommissioning) and implementation of human oversight measures. The Frontier AI Guidance also stresses the importance of accountability: financial institutions should notably “assign clear ownership of AI-related activities” and “set limits on what automated systems can do independently”.
   
  • McCarthy Tétrault Comments: As an example of how the complexity of the AI vendor landscape may increase risk, a software vendor may embed a third-party large language model in its solution, which may be subject to separate terms and conditions. The interaction between a direct vendor’s own contractual terms of use and those imposed by model providers in relation to the embedded models can be complex and leave service recipients with important gaps in contractual protections if they are not carefully reviewed.
     
• Maintain information and decision integrity: OSFI seeks here to address two well-known weaknesses of generative AI: its much-discussed propensity to produce hallucinated or misleading outputs, and the leakage of sensitive or proprietary data through prompts, outputs, logs or third-party providers. Where an AI agent acts autonomously, the risks of such flawed outputs compound with each action taken. To address this, OSFI recommends a combination of good data governance, human accountability and monitoring across the AI lifecycle: classifying data and tracking its provenance, restricting inputs to trusted and approved data sources, prohibiting the use of sensitive data in public or unapproved AI tools, treating AI outputs as inputs to decision-making rather than definitive outcomes, and preserving human oversight for material decisions. Similarly, the Frontier AI Guidance recommends to “maintain involvement for higher-impact decisions”.
   
  • McCarthy Tétrault Comments: The risk of data leakage is greater with non-business grade AI systems. Popular consumer models are usually subject to less favorable terms and conditions, may allow training with user input unless a positive opt-out action is taken and may offer lower cybersecurity protections and guarantees. Without representing a guaranteed protection against AI risks, selecting AI vendors able to show strong AI, data and security governance (which should be contractually reflected) is an important risk mitigation measure.
     
• Controlled software development and changes: OSFI notes that generative tools can accelerate software development but, in doing so, may inadvertently produce insecure code, and that agentic systems can compound this by autonomously deploying defective code into production, in both cases creating unpredictability. To address this, OSFI recommends holding AI to the secure software development and change management controls institutions already maintain: validating AI-generated code for vulnerabilities before deployment, enforcing approval checkpoints for high-risk actions by AI agents, treating models, data, tools and agents as controlled technology assets, and testing AI models under normal and stressed conditions, including edge cases.
   
  • McCarthy Tétrault Comments: The use of AI in software development undoubtedly brings productivity gains, but we are only starting to discover the risks of generalized vibe-coding. As an example, generative AI coding assistants may reproduce known vulnerabilities from the code in their training sets and the amount of code generated may make human review spotty at best. Organizations should consider developing clear policies on the use of AI to support software development, including a clear classification of project types and the level of AI use allowed for each.
    
    In addition to cybersecurity issues, the use of AI-generated code also raises intellectual property issues since organizations may not be able to benefit from copyright or other IP protections where human input in the content is insufficient (we have limited guidance on the matter in Canada, but certain U.S. cases point in this direction).
     
• Control AI agent autonomy and access: AI systems and agents require access to data, tools and systems to reach their full potential, but OSFI warns this access can increase the risk of unauthorized actions. Its particular concerns are over-privileged access, shared or inherited credentials that undermine accountability, and the weak traceability of activities that agents initiate and carry out automatically. To address this, OSFI recommends to extend identity and access management principles to AI agents (including by assigning them unique identities, enforcing least-privilege and scoped permissions and logging and reviewing agent activities).
   
  • McCarthy Tétrault Comments: Certain recommendations of the Frontier AI Guidance are also relevant for all AI agents, in particular as regards the implementation of zero-trust architectures. Managing access becomes especially important where agents interact with critical assets (horror stories abound online of AI agents deleting by mistake entire codebases or file systems, which organizations can mitigate with policies on the deployment of agents as well as sensible access management and back-up practices).
     
• Embedding AI into cybersecurity operations: Thus far, we have discussed advanced AI systems as a potential security threat but, interestingly, OSFI also reminds organizations of AI’s potential role as a component of the cybersecurity toolkit. Financial institutions can turn AI capabilities to their advantage, detecting, preventing and responding to threats faster than traditional methods allow. Organizations should use AI (including advanced frontier models) to prioritize risks and accelerate patching, enhancing behavioural anomaly detection and prompt and output monitoring, and feeding AI telemetry into existing security operations tooling.
   
  • McCarthy Tétrault Comments: The OpenAI incident mentioned above showed the usefulness of AI systems as part of cyber defense as Hugging Face, one of the companies affected, indicated that it had used an advanced AI model as part of its breach response. Of course, organizations cannot solely rely on AI defense and even the most advanced models do not replace a clear and rehearsed incident-response strategy led by an experienced team, business continuity planning and other traditional organizational and technical cybersecurity measures.
     
• Increase resilience and manage third-party risk: OSFI’s final recommendations in the AI Bulletin focus on operational resilience, warning that failures in AI-based systems can disrupt critical operations or create correlated impacts across institutions, and that reliance on AI vendors concentrates both AI-specific and broader third-party risk (a concern compounded where the third parties are themselves using AI to deliver services). OSFI recommends mapping AI responsibilities and dependencies to critical operations, testing failure and outage scenarios with manual fallbacks, assessing the portability and substitutability of AI services, reporting material concentration risk to senior management and boards, and strengthening third-party risk programs, including an obligation on vendors to disclose whether and how they use AI.
   
  • McCarthy Tétrault Comments: This recommendation again stresses the importance of good vendor management. A useful tool of AI governance in that regard is to maintain a centralized list of AI systems used by an organization, indicating both the ones developed internally and those provided by third parties.

Takeaways

For federally regulated financial institutions, the new AI Bulletin is best read as an AI-tinted lens on existing OSFI guidelines that financial institutions should apply to their AI activities. It is also a reminder that, even in the absence of AI-specific laws in Canada, regulatory bodies are taking an active role in providing guidance on the use and development of AI in their respective industries.

Financial institutions (and organizations more broadly) should review whether their existing governance, data management, cybersecurity, software development, identity and access management, and third-party risk frameworks appropriately address AI-specific risks.