Back to Risk Catalogue
AI Governance Framework Icon

Canada AI & Financial-Sector Regulatory References

Canadian regulatory framework for AI in capital markets and financial services, spanning securities, prudential, privacy and human rights obligations.

CSA Staff Notice and Consultation 11-348: AI Systems in Capital Markets (2024-12-05)

View

Risks

RI-16Bias and Discrimination RI-17Lack of Explainability RI-18Model Overreach / Expanded Use RI-19Data Quality and Drift RI-01Information Leaked To Hosted Model RI-20Reputational Risk RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

CIRO Annual Compliance Report 2026 (2026-02-17)

View

Risks

RI-18Model Overreach / Expanded Use RI-19Data Quality and Drift RI-20Reputational Risk RI-22Regulatory Compliance and Oversight

NI 31-103 s. 11.1: Compliance System

View

Risks

RI-18Model Overreach / Expanded Use RI-01Information Leaked To Hosted Model RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

NI 31-103 s. 11.5: General Records

View

Risks

RI-19Data Quality and Drift RI-01Information Leaked To Hosted Model RI-02Information Leaked to Vector Store

NI 31-103 s. 13.2: Know Your Client (KYC)

View

Risks

RI-22Regulatory Compliance and Oversight

NI 31-103 s. 13.2.1: Know Your Product (KYP)

View

Risks

RI-17Lack of Explainability RI-22Regulatory Compliance and Oversight

NI 31-103 s. 13.3: Suitability Determination

View

Risks

RI-17Lack of Explainability RI-22Regulatory Compliance and Oversight

NI 31-103 s. 13.4: Identifying and Addressing Material Conflicts of Interest

View

Risks

RI-20Reputational Risk RI-22Regulatory Compliance and Oversight

NI 31-103 s. 14.2: Relationship Disclosure Information

View

Risks

RI-17Lack of Explainability

Companion Policy 31-103CP to NI 31-103

View

Risks

RI-18Model Overreach / Expanded Use RI-19Data Quality and Drift RI-01Information Leaked To Hosted Model RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

Joint CSA/CIRO Staff Notice 31-363: CFR Conflicts of Interest Review

View

Risks

RI-20Reputational Risk RI-22Regulatory Compliance and Oversight

Joint CSA/CIRO Staff Notice 31-368: CFR KYC/KYP/Suitability Review

View

Risks

RI-17Lack of Explainability RI-22Regulatory Compliance and Oversight

NI 33-109 Form 33-109F5: Change of Registration Information

View

Risks

RI-18Model Overreach / Expanded Use RI-22Regulatory Compliance and Oversight

CSA Staff Notice 11-326: Cyber Security (2013-09-26)

View

Risks

RI-01Information Leaked To Hosted Model RI-02Information Leaked to Vector Store

CSA Staff Notice 11-332: Cyber Security (2016-09-27)

View

Risks

RI-01Information Leaked To Hosted Model RI-02Information Leaked to Vector Store

CSA Staff Notice 33-321: Cyber Security and Social Media (2017-10-19)

View

Risks

RI-01Information Leaked To Hosted Model RI-02Information Leaked to Vector Store

CIRO IDPC Rules 3100–3600: Business Conduct

View

Risks

RI-22Regulatory Compliance and Oversight

CIRO IDPC Rule 3800: Recordkeeping and Client Reporting

View

Risks

RI-19Data Quality and Drift RI-01Information Leaked To Hosted Model RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

CIRO IDPC Rule 3900: Supervision

View

Risks

RI-17Lack of Explainability RI-22Regulatory Compliance and Oversight

CIRO Rule Consolidation: Phase 4 (2024-10-17)

View

Risks

RI-17Lack of Explainability RI-18Model Overreach / Expanded Use RI-22Regulatory Compliance and Oversight

NI 81-102: Investment Funds

View

Risks

RI-17Lack of Explainability RI-18Model Overreach / Expanded Use RI-20Reputational Risk RI-22Regulatory Compliance and Oversight

NI 81-106: Investment Fund Continuous Disclosure

View

Risks

RI-18Model Overreach / Expanded Use RI-22Regulatory Compliance and Oversight

NI 81-107: Independent Review Committee for Investment Funds

View

Risks

RI-16Bias and Discrimination RI-20Reputational Risk RI-22Regulatory Compliance and Oversight

CSA Staff Notice 31-342: Guidance for Portfolio Managers Regarding Online Advice (2015-09-24)

View

Risks

RI-17Lack of Explainability RI-18Model Overreach / Expanded Use RI-22Regulatory Compliance and Oversight

CIRO Guidance Note GN-2300-21-003: Outsourcing Arrangements (2021-12-31)

View

Risks

RI-18Model Overreach / Expanded Use RI-19Data Quality and Drift RI-01Information Leaked To Hosted Model RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

OSFI Guideline E-23: Model Risk Management (2027)

View

Risks

RI-17Lack of Explainability RI-20Reputational Risk RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

OSFI E-23 (2027) Principle 3.2: Data Suitability

View

Risks

RI-16Bias and Discrimination RI-19Data Quality and Drift

OSFI E-23 (2027) Principle 3.6: Monitoring and Decommissioning Standards

View

Risks

RI-18Model Overreach / Expanded Use RI-19Data Quality and Drift

OSFI B-13 Domain 2: Technology Operations and Resilience

View

Risks

RI-19Data Quality and Drift

OSFI B-13 Domain 3: Cyber Security

View

Risks

RI-01Information Leaked To Hosted Model RI-02Information Leaked to Vector Store

IOSCO Final Report FR/02/2026: Supervisory Toolkit for AI Use in Capital Markets (2026-05-25)

View

Risks

RI-16Bias and Discrimination RI-17Lack of Explainability RI-19Data Quality and Drift RI-01Information Leaked To Hosted Model RI-20Reputational Risk RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

OSFI Guideline B-10: Third-Party Risk Management

View

Risks

RI-18Model Overreach / Expanded Use RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

AMF Guideline for the Use of Artificial Intelligence (finalized 2026-03-30, effective 2027-05-01)

View

Risks

RI-16Bias and Discrimination RI-17Lack of Explainability RI-19Data Quality and Drift RI-22Regulatory Compliance and Oversight

PIPEDA: Personal Information Protection and Electronic Documents Act

View

Risks

RI-01Information Leaked To Hosted Model RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

PIPEDA Schedule 1: Fair Information Principles

View

Risks

RI-19Data Quality and Drift

Quebec Act respecting the protection of personal information in the private sector (CQLR c P-39.1) s. 12.1: Automated Decision-Making Transparency

View

Risks

RI-17Lack of Explainability RI-01Information Leaked To Hosted Model RI-22Regulatory Compliance and Oversight

Quebec Act respecting the protection of personal information in the private sector (CQLR c P-39.1) ss. 3.3 and 17: Privacy Impact Assessments and Cross-Border Transfers

View

Risks

RI-01Information Leaked To Hosted Model RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store

Canadian Human Rights Act (RSC 1985, c H-6) ss. 3 and 5: Prohibited Grounds and Discriminatory Services

View

Risks

RI-16Bias and Discrimination

Ontario Human Rights Code (RSO 1990, c H.19) s. 1: Equal Treatment in Services

View

Risks

RI-16Bias and Discrimination