On 15 October 2026 the Financial Stability Board finalised twelve sound practices for financial institutions adopting AI. The same day, OSFI endorsed them, calling them a proportionate approach that complements its existing guidelines.
This is not a new rule. Nothing in it is binding on its own. But it is the clearest statement yet of what a Canadian prudential supervisor will expect a board to be able to show about AI, and it lands about six months before OSFI’s model risk guideline, E-23, comes into force.
What the twelve practices cover
The FSB splits them into two groups.
- Organisation-wide governance: board and senior management oversight of how AI fits strategy and risk appetite; clear roles and accountability; AI risks built into the risk framework, with AI use documented; and adapting all of that as the technology changes.
- Managing risk across the AI lifecycle: assessing the materiality and risk of each use case, from the start and over time; choosing the technology; data governance; explainability, or compensating controls where explainability is limited; performance monitoring; human oversight scaled to risk; AI-related cyber and ICT risk; and risk from third-party AI dependencies.
What changes, and what does not
OSFI’s requirements still live in its own guidelines. The statement points to four of them:
- E-23, Model Risk Management. In force for all federally regulated financial institutions on 1 May 2027, it applies to all models, with added clarity on AI and machine learning, including generative AI.
- B-10, Third-Party Risk Management.
- B-13, Technology and Cyber Risk Management.
- E-21, Operational Risk Management and Resilience.
The FSB practices are the board-level frame that ties those together. Read them as a description of the evidence a supervisor will look for, not as a separate checklist.
What a board should be able to show
- An inventory. Every AI use that carries risk, with a materiality rating and a named owner. E-23 asks for the same inventory for models.
- Accountability. Who approved each material use, and who can stop it.
- Human oversight that is real. Where a person can review or overrule an AI output on a material decision, and the record that they did.
- Third-party AI. Due diligence, contract terms, monitoring and an exit plan for the AI built into the vendor products you already use, not only the ones you bought as AI.
- Cyber testing that includes AI. AI systems inside the scope of your security testing and resilience exercises.
- Performance evidence. Monitoring proportionate to risk, and what happens when performance drifts.
If you supply financial institutions
Expect the questions to reach you. Practice twelve and B-10 both push institutions to understand their third-party AI dependencies, which means their suppliers will be asked for evidence of how their AI is governed, tested and overseen. Suppliers who can answer with documents rather than assurances will find procurement easier.
The question your board should ask
“If OSFI asked next week to see our AI inventory, who is accountable for each material use, and the evidence that a person can overrule it, could we produce all three?”
We never assess work we have advised on, and we never sell the fix for anything we assess. If you want an independent view of where your AI governance would stand against these expectations, the first conversation is free.
Checked on 19 October 2026 against the Financial Stability Board’s final report and press release of 15 October 2026, OSFI’s statement of 15 October 2026, and OSFI’s Guideline E-23 (2027) letter.