The polite version of a supervisory letter
On July 13, OSFI posted a technology-risk bulletin titled Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational Resilience. The regulator's messaging positions it as "sound practices" grounded in the existing B-13, E-21, and B-10 guidelines, and technically, that framing is correct; no new legal duty came into force that day. Practically, the bulletin reads like the polite Canadian version of a supervisory letter: here are the questions we are going to start asking; here are the answers we would like to hear.
It also arrives with context. Reuters reported the same afternoon that OSFI had privately warned bank and insurer CTOs in April 2026 about Anthropic's Claude Mythos as an active cyber-risk vector; the public bulletin appeared roughly two days after Reuters started asking questions. So the substance had been circulating with supervised institutions for months. This is not the regulator getting ahead of the industry; this is the industry catching up to a set of expectations it has been receiving privately since spring.
What the bulletin actually says
Skip the executive summary; the meat is in the controls. Institutions should:
- Assign each agent a unique non-human identity. Shared service accounts are officially out.
- Apply least privilege and short-lived credentials. Agents get the minimum access they need and only for as long as they need it.
- Use tool allow-lists and API gateways. Enumerate what the agent can call; enforce it at a chokepoint.
- Require human approval for material actions. Agents advise; humans decide, especially on lending, disputes, fraud holds and member communications.
- Log everything and recertify access periodically. If you cannot reconstruct a decision, you cannot defend it.
- Map AI dependencies and test outage scenarios. Manual fallbacks are non-optional.
- Include prompt injection and data leakage in threat testing. Yes, that is now table stakes.
- Require third parties to disclose their use of AI. Vendors who "just use it under the hood" are a governance problem.
- Validate AI-generated code before production. A model that writes plausible-looking Python is not exempt from your SDLC.
The regulator's guiding sentence, echoed across Wealth Professional's coverage, is worth pinning above every whiteboard: treat AI output as an input to a decision, not the decision itself; keep an accountable human on anything material.
What actually changed
Nothing, and everything. Nothing in a Canadian FI's legal duties changed the day this went public; the bulletin is expressly non-binding. What changed is the supervisory floor. B-13 asked for technology and cyber risk management; the bulletin describes what that looks like when the technology writes emails and calls APIs on its own. E-21 asked for operational resilience; the bulletin describes what that looks like when a third-party model goes offline mid-batch. Enterprise-wide model risk management under E-23 already extends to every AI and ML model by May 1, 2027; the bulletin fills in the identity, telemetry and approval mechanics.
Two years ago, Canadian AI guidance was aspirational. This bulletin is operational. The delta is what matters.
The awkward test every FI can run this week
Pick one AI workflow currently in production or approved pilot. It does not matter which one; retention, servicing, fraud triage, portfolio scoring, member comms, anywhere an agent touches a decision. Answer five questions in writing.
- Who owns this agent? Name a business owner, not a team.
- What is its non-human identity, and what tools is it authorized to call? Screenshots or it did not happen.
- What data can it access? At what classification, under what retention, and can you prove it?
- Where does the human approval boundary sit? At what dollar threshold or risk grade does the agent stop advising and require sign-off?
- What is the manual fallback if the underlying model, API or provider is unavailable? Is it documented? Has it been run this year?
If any of those answers make your team pause, you have not been sloppy; you have been building at the pace most Canadian FIs have been building at. The bulletin is the industry's polite invitation to slow down for exactly one quarter and answer the questions on paper.
A frame for the next 90 days
Three durable principles hold up better than any single tool selection in this environment. Policy is the moat, not the model; the specializing signal in any lending decision is the lender's own credit policy and underwriter corrections, not the foundation model beneath it, and that signal should stay with the lender rather than migrate into a vendor's weights. Digital twins beat data pools; privacy-safe, model-derived synthetic data lets institutions pressure-test cohorts, policies, and edge cases without moving raw borrower records around, which lines up neatly with PIPEDA, Quebec's Law 25, and OSFI B-10. Build on existing infrastructure; agents that sit on top of the LOS an institution already runs, without ripping and replacing it, are much easier to inventory, audit, and unplug when a bulletin like this one arrives.
None of the three principles are exclusive to FundMore; all three are lens choices any Canadian lender can adopt this quarter. They just happen to be the lens we build through, which is why the bulletin reads less like a shock and more like the industry writing down what a good afternoon at our office looks like.
Frequently Asked Questions
Is the OSFI bulletin legally binding?
No. It is a non-binding technology-risk bulletin that describes sound practices grounded in existing OSFI Guidelines B-13, E-21, and B-10. The Leveraged Years' regulatory summary is clear on that point. Practically, however, examiners are likely to treat these controls as expectations.
Who does the bulletin apply to?
Federally regulated financial institutions supervised by OSFI, meaning banks, insurers, and pension plans. Provincially regulated credit unions are not directly bound, but Credit Union AI News argues most credit unions should treat the bulletin as a de facto governance baseline, because their auditors and regulators will use similar reference points.
What is a non-human identity, and why does OSFI care?
A non-human identity is a distinct identity credential assigned to an automated system (a service account, agent, or workload) so that its actions are attributable and auditable. Shared credentials break attribution; least-privilege breaks quietly; and a compromised agent using a shared account can quickly become a portfolio-level incident. Unique identities are the foundation of every downstream control the bulletin recommends.
Does this apply to third-party AI vendors?
Yes, transitively. OSFI expects institutions to require third parties to disclose whether and how they use AI in service delivery. The message is that outsourcing an activity does not outsource the governance obligation.
How does this connect to Guideline E-23?
E-23 extends enterprise model-risk management to every AI and ML model at a federally regulated institution by May 1, 2027. This bulletin fills in the identity, permissions, telemetry, incident, and human-oversight mechanics that make E-23 compliance actually implementable. Read the two together, not separately.
What is the fastest first step our team can take?
Pick one live or planned AI workflow. Document owner, non-human identity, approved tools and data, human approval boundary and manual fallback. Run one incident exercise on it. Then repeat for the next workflow. Nine of these done well are more valuable than a fifty-page framework nobody reads.