What does OSFI-FCAC AI Risk Report (2024) say about AI in banking?

What are the key points of OSFI-FCAC AI Risk Report (2024)?

• Source data is the AI/Quantum questionnaire OSFI and FCAC sent in December 2023; the report also draws on external publications.
• Adoption: approximately 30% of institutions used AI in 2019 and 50% in 2023, with 70% expected to by 2026; 75% of responding institutions plan to invest in AI over the next three years.
• Top AI use cases are operational efficiency, customer engagement, document creation and fraud detection; the top risks respondents cite are data privacy and security, model risk, legal risk and business risk.
• Section 3.1 (data governance) says data-related risks are viewed as a top concern, spanning data privacy, governance and quality; section 3.2 says AI model risk is elevated by complexity and opacity and that gen AI is harder to explain than traditional ML.
• Section 3.4 (third-party risks) says most institutions rely on third-party providers for AI models and systems, flags concentration risk and cloud dependency, and says institutions are responsible for the results of third-party AI systems used to sell or promote their products and services.
• Section 3.5 and section 4 cover operational and cybersecurity risks, including data poisoning, data leakage, evasion attacks and model extraction, and external threats from generative AI such as deepfakes, synthetic identities and AI-written phishing.
• Section 4.4 notes possible credit, market and liquidity effects, including AI-driven herding in trading and AI agents moving deposits; section 5 warns that risk management can lag the pace of AI adoption and that managing AI only inside individual risk frameworks leaves gaps.
• The regulators state that their existing guidance on model risk, third-party risk, cybersecurity and operational resilience is technology-neutral and applies; the practices listed are not meant to serve as guidance.

What did OSFI-FCAC AI Risk Report (2024) change for banks?

It is the regulators' joint statement of AI risk on the evidence of an industry questionnaire, and it preceded the final Guideline E-23 (September 2025), the FIFAI II report (March 2026) and the 2026 technology risk bulletins on frontier and generative AI. For banks it is the clearest statement of what OSFI expects supervisors to ask about, while creating no new obligations.

What does the OSFI-FCAC AI risk report expect of banks?

The OSFI-FCAC Risk Report of 24 September 2024 sets no new obligations, but it tells banks what the two regulators will treat as the main AI risks and which existing guidance applies. It groups internal AI risks into data governance, model risk and explainability, legal, ethical and reputational risk, third-party risk, and operational and cyber risk, and external risks into cyber and fraud threats, business and strategic risk, and credit, market and liquidity effects. It warns that risk management can lag AI adoption, that addressing AI only inside separate risk frameworks leaves gaps, and that institutions remain responsible for the results of third-party AI systems. The regulators say their existing technology-neutral guidance on model risk, third-party risk, cybersecurity and operational resilience applies, and that the practices in the report are 'not meant to serve as guidance'.

The report is an early building block of OSFI's AI position. Its executive summary says OSFI and FCAC are 'monitoring the evolving risk landscape and advocating for responsible AI adoption', cites the 2022 FIFAI EDGE principles (Explainability, Data, Governance, Ethics), and acknowledges Government of Canada AI codes of conduct and directives that apply to the use of AI in finance.

Its value for banks is as a supervisory preview. The 2026 FIFAI II report cites it for the finding that data-related risks are a 'top concern', and the 2026 OSFI technology bulletins on frontier and generative and agentic AI build on its third-party, cyber and operational themes. Consumer-protection consequences sit with FCAC's own legal framework, which the report mentions without restating.

WHAT THIS MEANS IN PRACTICE

• Use the report's risk taxonomy as a checklist when mapping AI use cases to your enterprise risk framework, so AI risk is not owned only by model risk or cyber.
• Document who is accountable for AI used in business lines that were never subject to model governance.
• Assess third-party AI providers for concentration, cloud outage exposure and open-source components, and record what you can and cannot verify about their models.
• Decide how you test for bias given the data dilemma the report describes, and how you disclose AI use to customers.