What does OSFI Guideline B-10 say about AI in banking?

What are the key points of OSFI Guideline B-10?

• Six outcomes: clear governance and accountability; risks identified and assessed; risks managed within the risk appetite framework; third-party performance monitored and incidents addressed; a program that can manage a range of relationships on an ongoing basis; and transparent, reliable, secure technology and cyber operations carried out by third parties.
• Principle 1: the FRFI is ultimately accountable for managing risks from all types of third-party arrangements, and retains accountability for outsourced services and for data exchanged with or accessible to third parties.
• Principle 2: establish an enterprise-wide Third-Party Risk Management Framework (TPRMF) spanning the lifecycle from sourcing and due diligence to exit.
• Principles 3 and 4: assess risk and criticality before entering an arrangement and periodically after; perform due diligence proportionate to risk and criticality (Annex 1 lists factors for high-risk and critical arrangements), including out-of-Canada considerations and concentration risk across geography, supplier and subcontractor.
• Principle 5: the FRFI is responsible for identifying, monitoring and managing risk from its third parties' subcontracting, with contract options including notification, right of refusal and audit of subcontractors.
• Principles 6 to 9: written agreements (Annex 2 lists provisions expected for high-risk and critical arrangements), data security and location, information and audit rights for the FRFI and OSFI, and business continuity and disaster-recovery capability including contingency plans for critical arrangements.
• Principles 10 and 11: ongoing monitoring that verifies the third party can meet its obligations, and documented incident identification, escalation, notification and remediation processes.
• The guideline text does not mention AI. OSFI's 2026 bulletin on generative and agentic AI cites 'B-10 outcome expectations 2, 3, and 4' and recommends requiring third parties to notify the FRFI if and how they use AI to deliver services.

What did OSFI Guideline B-10 change for banks?

OSFI describes B-10 as its final revised third-party guideline: it emphasises governance and risk management programs, sets six outcomes, and adds explicit expectations on concentration and subcontracting risk and on third-party technology and cyber operations. For AI, it matters because most Canadian institutions buy rather than build AI: the OSFI-FCAC 2024 report found that most rely on third parties for AI models, and E-23 routes vendor-model governance through B-10.

What does OSFI Guideline B-10 require of banks that use AI vendors?

OSFI Guideline B-10 requires a bank to stay accountable for any activity it hands to a third party, and to run a third-party risk management framework over the full lifecycle of each arrangement. The text never mentions artificial intelligence, so it reaches AI vendors only because an AI model, platform or service supplier is a third party: the bank must assess criticality and risk before contracting, perform proportionate due diligence, assess concentration and subcontractor risk, contract for audit and information rights, data security, business continuity and incident notification, and monitor the provider afterwards. OSFI's E-23 and its 2026 AI bulletins explicitly route AI vendor and third-party model risk through B-10.

B-10 is technology-neutral, and OSFI relies on that neutrality for AI. The OSFI-FCAC 2024 report lists third-party risk management among the existing frameworks that apply to AI, and Guideline E-23 states that models or data sourced from external sources such as third-party vendors are covered 'pursuant to' B-10. OSFI's response letter on E-23 adds that third-party models must receive validation and monitoring commensurate to model risk.

OSFI's July 2026 Technology Risk Bulletin on generative and agentic AI connects B-10 outcome expectations 2, 3 and 4 to AI: map AI dependencies to critical operations, test AI failure scenarios, assess portability and substitutability of AI services, and enforce an obligation on third parties to notify the institution if and how they use AI to deliver services. These are presented as sound practices institutions can consider, consistent with B-10, E-21 and B-13, not as new requirements.

WHAT THIS MEANS IN PRACTICE

• Classify AI model and platform providers by criticality in the third-party inventory and apply Annex 1 due-diligence factors to the high-risk ones.
• Write AI-specific terms into Annex 2 contract provisions: notice of model changes, subcontractor and foundation-model disclosure, audit access, data location and incident notification.
• Assess concentration across AI providers and their sub-processors, and set exit and substitution plans for critical AI services.
• Align vendor-model validation under E-23 with the B-10 due-diligence and monitoring cycle so evidence is collected once.