# OSFI FIFAI II report (AGILE framework): FIFAI II: AI Risks and Opportunities: Adopting an AGILE Framework in Canadian Financial Services

Source: https://www.bankingnewsai.com/ai-regulation/documents/osfi-fifai-report-2026
Last updated: Oct 5, 2026

The second Financial Industry Forum on Artificial Intelligence (FIFAI II) final report, hosted by OSFI and dated 23 March 2026, is the output of four workshops held between May and November 2025 by the Global Risk Institute with OSFI, Finance Canada, FINTRAC, FCAC and the Bank of Canada, involving more than 170 participants. It introduces the AGILE framework (Awareness, Guardrails, Innovation, Learning, Ecosystem Resiliency) and builds on the 2022 EDGE principles (Explainability, Data, Governance, Ethics) from the first forum. It reflects participants' views and is expressly not guidance from OSFI or any other regulator, so it binds no bank, but it shows what Canadian regulators and industry treat as priority AI risks: strategic, security and cyber, financial crime, consumer protection, third-party concentration and financial stability.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [OSFI](https://www.bankingnewsai.com/ai-regulation/osfi) |
| Type | Report |
| Status | Final |
| Published | Mar 23, 2026 |
| Applies to | Canadian financial institutions, including banks, and the public bodies that took part. The report records the views of forum participants, not OSFI policy: it says it 'should not be interpreted as guidance' from the Bank of Canada, Finance Canada, FCAC, FINTRAC, OSFI or any other regulator |
| Official text | https://www.osfi-bsif.gc.ca/en/about-osfi/reports-publications/fifai-ii-ai-risks-opportunities-adopting-agile-framework-canadian-financial-services |

## Key points

- Four workshops between May and November 2025: Security and Cybersecurity (interim report 29 May), Financial Crime (1 October), Financial Stability (29 October) and Financial Well-being and Consumer Protection (13 November), sponsored by the Global Risk Institute with OSFI, Finance Canada, FINTRAC, FCAC and the Bank of Canada.
- More than 170 participants from banks, insurers, asset managers, non-financial corporations, consumer advocates, universities, research institutes, government and regulators.
- The AGILE framework: Awareness (AI oversight, board engagement, expanded monitoring and stress-testing scenarios), Guardrails (controls, data integrity, human oversight for high-impact decisions, third-party oversight), Innovation, Learning, and Ecosystem Resiliency.
- The report builds on FIFAI I (2022), whose EDGE principles remain 'the foundation for responsible adoption'; participants said Canadian institutions have generally aligned with EDGE.
- Risk areas covered include strategic risk, security and cybersecurity threats (deepfakes, synthetic identity fraud), third-party dependence on a small number of AI providers, consumer protection, financial crime and financial stability.
- On regulation, the report states that 'the amount of AI-specific guidance by Canadian financial regulators has been limited' and that perceived uncertainty about compliance obligations may make institutions hesitant to invest.
- It records that Canadian financial-sector regulation spans 14 jurisdictions, creating a matrix of guidelines, rules and legislation.
- The foreword and disclaimer state it is not guidance from OSFI or any other authority; it cites the 2024 OSFI-FCAC report for the finding that data-related risks are a 'top concern'.

## What changed for banks

FIFAI II extends the 2022 first forum, which focused on internal AI risks, to external threats, financial crime, consumer protection and financial stability. For banks it supplies a shared Canadian vocabulary (AGILE) that regulators and industry are likely to use in supervisory conversations, and it is the most recent OSFI-hosted statement of which AI risks participants consider most pressing, published after E-23 was finalised and before OSFI's July 2026 bulletin on generative and agentic AI.

## Use cases it governs

- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)

## What does the FIFAI II report recommend for Canadian banks?

The FIFAI II final report (23 March 2026) recommends, but does not require, that Canadian financial institutions adopt the AGILE framework: raise awareness of AI-driven risk through AI oversight, board engagement and expanded stress-testing scenarios; set guardrails of strong controls, data-integrity standards, human oversight for high-impact decisions and rigorous third-party oversight; invest in innovation and talent; build AI skills at every level; and strengthen ecosystem resiliency through third-party oversight, digital identity security, real-time threat sharing and upgraded incident response. It identifies strategic risk, security and cyber threats, third-party dependence on a small number of AI providers, consumer-protection harms and financial-stability effects as the main risk areas. The report is a record of forum views, not guidance from OSFI or other regulators.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| AGILE — Awareness | [OSFI](https://www.bankingnewsai.com/ai-regulation/osfi) | Stay ahead of AI-driven risks through AI oversight, board engagement, and expanded monitoring and stress-testing scenarios. | Recommended, 23 March 2026 | [OSFI FIFAI II report (AGILE framework)](https://www.bankingnewsai.com/ai-regulation/documents/osfi-fifai-report-2026) |
| AGILE — Guardrails | [OSFI](https://www.bankingnewsai.com/ai-regulation/osfi) | Apply strong controls, data-integrity standards, human oversight for high-impact decisions, transparency and appropriate consumer outcomes, and rigorous third-party oversight. | Recommended, 23 March 2026 | [OSFI FIFAI II report (AGILE framework)](https://www.bankingnewsai.com/ai-regulation/documents/osfi-fifai-report-2026) |
| AGILE — Innovation | [OSFI](https://www.bankingnewsai.com/ai-regulation/osfi) | Treat AI as a driver of competitiveness and consumer financial well-being, supported by investment in talent, modern infrastructure and responsible innovation. | Recommended, 23 March 2026 | [OSFI FIFAI II report (AGILE framework)](https://www.bankingnewsai.com/ai-regulation/documents/osfi-fifai-report-2026) |
| AGILE — Learning | [OSFI](https://www.bankingnewsai.com/ai-regulation/osfi) | Build AI skills at every organisational level through continuous training and collaboration, and support consumer AI literacy. | Recommended, 23 March 2026 | [OSFI FIFAI II report (AGILE framework)](https://www.bankingnewsai.com/ai-regulation/documents/osfi-fifai-report-2026) |
| AGILE — Ecosystem Resiliency | [OSFI](https://www.bankingnewsai.com/ai-regulation/osfi) | Improve third-party oversight, digital identity security, real-time threat sharing and incident-response frameworks, and seek regulatory clarity. | Recommended, 23 March 2026 | [OSFI FIFAI II report (AGILE framework)](https://www.bankingnewsai.com/ai-regulation/documents/osfi-fifai-report-2026) |
| Guideline E-23 — Model Risk Management (2027) | [OSFI](https://www.bankingnewsai.com/ai-regulation/osfi) | The binding-in-supervision OSFI guideline for AI/ML model governance, which the forum report sits alongside. | Effective 1 May 2027 | [OSFI Guideline E-23](https://www.bankingnewsai.com/ai-regulation/documents/osfi-guideline-e-23) |

FIFAI is a Global Risk Institute and OSFI convening, so the report differs in status from OSFI's guidelines. Its own disclaimer says the content reflects individual speakers and participants. The practical value for banks is in the problem statements it records: data strategy and quality, 14 overlapping regulatory jurisdictions, the limited volume of AI-specific guidance from Canadian regulators, synthetic-identity fraud, and growing dependence on a small number of AI providers and opaque AI supply chains.

For supervision, the report should be read with the guidelines that do bind in practice. OSFI's Guideline E-23 covers AI/ML model governance, B-10 covers third-party arrangements including AI vendors, and the 2026 OSFI bulletins on frontier and generative and agentic AI set out sound practices under B-13, E-21 and B-10.

### What this means in practice

- Map your AI programme to the five AGILE headings to see where oversight, controls, skills and third-party resilience are thin.
- Add AI-enabled attack and fraud scenarios, and AI-provider outage scenarios, to stress testing and incident-response exercises.
- Track dependence on single AI providers and opaque AI supply chains as a concentration-risk item for senior management and the board.
- Do not cite FIFAI II as a regulatory requirement; cite E-23, B-10, B-13 and E-21 for obligations.

## FAQ

### Is the FIFAI II report OSFI guidance?

No. The report states that its content reflects the views of individual speakers and participants, that it should not be interpreted as guidance from OSFI, the Bank of Canada, Finance Canada, FCAC, FINTRAC or any other regulator, and that it does not necessarily reflect their current or future views.

### What is the AGILE framework in the FIFAI II report?

AGILE stands for Awareness, Guardrails, Innovation, Learning and Ecosystem Resiliency. It is the report's suggested set of implementation priorities for financial-industry stakeholders, covering AI oversight and board engagement, strong controls and human oversight for high-impact decisions, investment in talent, AI skills, and system-wide defences including third-party oversight and threat sharing.

### How does FIFAI II relate to OSFI's EDGE principles?

EDGE (Explainability, Data, Governance, Ethics) came from the first forum in 2022 and remains, per the report, the foundation for responsible AI adoption. FIFAI II says AI risks have since expanded beyond EDGE's scope, which is why it adds cyber, third-party, consumer-protection, financial-crime and financial-stability discussions and the AGILE framework.

### Does the FIFAI II report apply to banks?

It does not impose requirements on any institution. Banks took part as participants, and Canada's five largest banks are cited as ranking among the top 15 globally for transparency of responsible AI activities in 2025, per Evident Insights. Obligations for banks come from OSFI guidelines such as E-23 and B-10, not from this report.

## Related documents

- [OSFI Guideline E-23](https://www.bankingnewsai.com/ai-regulation/documents/osfi-guideline-e-23) — Guideline E-23 – Model Risk Management (2027) (Sep 11, 2025)
- [OSFI-FCAC AI Risk Report (2024)](https://www.bankingnewsai.com/ai-regulation/documents/osfi-fcac-ai-risk-report-2024) — OSFI-FCAC Risk Report - AI Uses and Risks at Federally Regulated Financial Institutions (Sep 24, 2024)
- [OSFI Guideline B-10](https://www.bankingnewsai.com/ai-regulation/documents/osfi-guideline-b-10) — Third-Party Risk Management Guideline (Apr 24, 2023)
- [SB 947](https://www.bankingnewsai.com/ai-regulation/documents/ca-sb-947-2026) — Employment: Automated Decision Systems (No Robo Bosses Act) (Sep 30, 2026)
- [Bailey: Frontier AI and the Question of Governance (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-bailey-frontier-ai-governance-2026) — Frontier AI and the Question of Governance — Governor Andrew Bailey (Sep 30, 2026)
- [AB 1609](https://www.bankingnewsai.com/ai-regulation/documents/ca-ab-1609-2026) — Customer Service Chatbots (Right to Human Customer Service Act) (Sep 28, 2026)
- [Atkins remarks at Investor Advisory Committee (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/sec-atkins-iac-ai-disclosure-remarks-2026-09) — Remarks at the SEC Investor Advisory Committee Meeting on AI Technologies and the Public Markets Information Ecosystem (Sep 10, 2026)
- [FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fca-frontier-ai-cyber-resilience-2026) — Frontier AI and Cyber Resilience (Sep 2, 2026)

Last reviewed Oct 5, 2026. Cite the official text (https://www.osfi-bsif.gc.ca/en/about-osfi/reports-publications/fifai-ii-ai-risks-opportunities-adopting-agile-framework-canadian-financial-services) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/osfi-fifai-report-2026
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.