Explainer · OSFI and AI

OSFI’s AI safety code. What we know so far.

By Sam Talasila · Last checked on October 17, 2026. OSFI hasn’t published the code. Everything about it below comes from press reports.

OSFI is considering an AI “safety code” for financial institutions, according to The Logic and The Globe and Mail. Superintendent Peter Routledge raised it at the Global Risk Institute Summit on October 7, 2026. The Logic reports there is no draft and no approved timeline, and a consultation could come as early as spring. OSFI hasn’t published anything on it yet.

What has been reported?

The Logic reports that OSFI is considering a safety code that would set a “minimum level of safety or resilience” across the financial system. It says the work is at an early stage, with no draft and no formally approved timeline. The Globe and Mail reports that Routledge has asked his team to work on a code to improve cybersecurity and reduce risk. It describes possible broad, high-level standards and says the details are still being worked out. Its headline says OSFI will “implement” tighter guardrails, which is firmer than The Logic’s “considering.”

Why now?

Both reports link the code to frontier AI models and autonomous AI agents. On October 8, the day after the summit, OSFI’s fall risk update said frontier AI “can amplify cyber, technology, third-party, and reputational risks.” It asked institutions to strengthen governance, controls and testing, and said boards and senior management stay accountable. The update doesn’t mention the code.

Who would it apply to?

That hasn’t been reported in detail. The coverage talks about banks and financial institutions generally. Nobody has said yet whether trust and loan companies are in scope, or whether the code will scale with size the way E-23 does.

What has OSFI already published on AI?

Guideline E-23, taking effect May 1, 2027. It defines a model to include AI and machine-learning methods, so AI tools need a risk rating and an owner. Those with non-negligible risk also go in the inventory and get independent review.
Two technology risk bulletins from April and July 2026, on frontier AI and on generative and agentic AI. They set out sound practices that complement OSFI’s existing guidelines B-10, B-13 and E-21.
The fall risk update of October 8, 2026, which focuses on frontier AI.

What should a smaller lender do now?

You can start before the code arrives. E-23 already asks for the groundwork.

List every AI tool in use, including vendor features and the assistants staff use.
Give each one an owner and an E-23 risk rating.
Ask your main vendors whether and how they use AI to deliver their services. OSFI’s agentic AI bulletin suggests requiring them to tell you.
Limit what AI agents can access and do. The same bulletin suggests least-privilege access and approval steps for high-impact actions.
Read the consultation when it comes out, and check it against your inventory.

When will we know more?

The Logic reports a consultation could come as early as spring 2027. I’ll update this page when OSFI publishes a draft or a statement.

Where I can help

I build the first inventory for one area of your business, with risk ratings, owners and first-line documentation your model-risk team can use. Fixed fee from CAD 10,000. This is first-line work. It isn’t validation, assurance or a readiness opinion.

See E-23 evidence work Book a 30-minute fit call

Sources

This page reports what has been published as of the date above. It isn’t legal or regulatory advice.