AI in action · Regulation
Canada's Bank Regulator Weighs an AI Safety Code for Banks
Canada's banking regulator, OSFI, is considering an AI "safety code" that would set minimum standards for how banks use the technology. Its October 8 risk update named frontier AI as an amplifier of cyber, technology, third-party and reputational risk.
For most of the past three years Canada's Office of the Superintendent of Financial Institutions treated AI as a subject for advisory reports and industry forums rather than rules. That is changing. Speaking at the Global Risk Institute Summit in Toronto, Superintendent Peter Routledge said OSFI is weighing a safety code that would set a minimum level of safety and resilience for how federally regulated banks and insurers use AI, The Logic reported on October 7. The aim, he said, is to stop a weakness at one institution from spreading to others.
The trigger is the newest generation of models. Routledge cited Anthropic's Mythos as an example of a system that could be misused for cyberattacks or other illicit activity, and pointed to autonomous agents working with little human oversight, describing the prospect as "frightening" and a risk at the front of OSFI's mind. The work is early: there is no draft and no approved timeline, though The Logic reported that a consultation could begin as soon as next spring. OSFI also plans to prioritise hiring specialists in AI and digital technology.
A day later OSFI put the reasoning in writing. Its Semi-Annual Risk Outlook, published on October 8 as an update to the annual outlook released in April, is devoted to frontier AI. It argues that the most capable models can find more vulnerabilities and chain several of them together on their own, turning minor weaknesses into serious breaches while shrinking the time between discovery and exploitation. It adds that a handful of providers dominate both frontier models and the cloud infrastructure that runs them, so an outage or cyber incident at one could hit many institutions at once, and that banks may struggle to see how their critical suppliers use AI.
The document also contains a less familiar warning: reputational risk now runs in both directions. An institution that adopts AI carelessly can be damaged, but OSFI says one that falls behind on emerging technology can lose competitiveness and standing too. Routledge summed it up in the release as resilience being a competitive advantage. The outlook lists what OSFI has done so far this year, including technology risk bulletins on generative and agentic AI and on frontier AI, a September industry day with the Canadian Centre for Cyber Security on AI-driven cyber threats, and a second Financial Industry Forum on AI that produced a framework called AGILE.
There is a tension between the two documents. The risk outlook states that existing guidance is sufficient to support responsible innovation, while the superintendent is openly considering standards that would go further. Read together, they suggest OSFI thinks its principles are right but is no longer sure every institution applies them to the same level. If a code does arrive, Canada would join Singapore and Hong Kong among regulators turning AI expectations for banks into something closer to a baseline.
Sources: OSFI — OSFI releases fall risk update focused on frontier AI (Oct 8, 2026); OSFI — Annual Risk Outlook, semi-annual update, fiscal year 2026-2027 (Oct 8, 2026); The Logic — Canada's banking regulator weighs new rules for AI risks (Oct 7, 2026)