The Office of the Superintendent of Financial Institutions (OSFI) has warned that advances in frontier artificial intelligence (AI) are intensifying cyber, technology, third-party and reputational risks facing Canadian financial institutions.
In its 2026 Semi-Annual Risk Outlook, released October 8, OSFI said rapid technological developments have increased risks already identified in its 2026-2027 Annual Risk Outlook published in April. The regulator also highlighted geopolitical uncertainty, economic pressures and ongoing trade tensions between Canada and the United States.
OSFI identified frontier AI models as the most advanced systems currently available. It warned that these technologies can accelerate cyberattacks, allowing malicious actors to identify and exploit vulnerabilities across interconnected systems faster and more sophisticatedly.
The regulator said AI-enabled attacks can combine multiple vulnerabilities into significant security incidents, reducing the time institutions have to detect and respond to threats. However, AI can also strengthen vulnerability detection and defensive capabilities.
OSFI also raised concerns about third-party concentration risks. A small number of providers dominate frontier AI development and supporting cloud infrastructure, creating potential operational disruptions when critical providers experience outages or cyber incidents.
The regulator noted that reliance on technology services located outside Canada could expose institutions to geopolitical restrictions and cross-border dependencies. It emphasized the importance of due diligence, continuous monitoring and oversight of critical third-party relationships.
On reputational risks, OSFI said institutions must keep pace with technological developments while ensuring governance, controls and testing advance alongside AI adoption. Boards and senior management remain accountable for managing these risks.
“In an era of advancing AI capabilities, resilience is a competitive advantage. Financial institutions that harness AI responsibly while managing cyber, technology, and third-party risks will position themselves to thrive in a complex environment,” Superintendent of Financial Institutions Peter Routledge said in a statement.
OSFI said Canada's financial system remains resilient, supported by strong capital, liquidity, governance and risk management practices.
The regulator has issued technology risk bulletins addressing generative, agentic and frontier AI. It has also collaborated with the Canadian Centre for Cyber Security, national security agencies and international regulators on emerging threats and responsible AI adoption.
OSFI said it will continue assessing technology concentration, critical service-provider dependencies and emerging cyber threats while strengthening its supervisory capabilities.
The regulator emphasized that innovation must be accompanied by sound governance and robust risk management to maintain financial sector resilience.