What is AI compliance?
By Nick Jang, founder of MINERVA Studio ·
The short answer
AI compliance is making sure the AI an organisation builds, buys and uses meets the rules that apply to it, and being able to prove it when asked. The rules depend on where you operate and what the AI does. Canada has no general AI law, so for a bank or insurer the main rules are sector ones: OSFI’s E-23 (in effect 1 May 2027) for AI models, OSFI’s B-10 for AI from third parties, Quebec’s AMF guidelines, and privacy law. A firm with EU customers may also be caught by the EU AI Act. Compliance work is mostly the same everywhere: know your AI, rate it, test it, approve it, monitor it and keep the records.
Compliance versus governance
AI governance is how an organisation decides which AI to use, for what, under whose authority. AI compliance is the part of that which answers to an outside rule: a law, a regulator’s guideline, a contract, a certification. Governance is broader, but in a regulated firm most of it ends up being tested as compliance.
The rules for a Canadian financial institution
| Rule | What it covers | When |
|---|---|---|
| OSFI Guideline E-23 | Every model, AI and machine learning included: inventory, risk rating, independent validation, approval, monitoring. | From 1 May 2027 |
| OSFI Guideline B-10 | Third-party arrangements, including AI vendors and AI inside software you buy. | In effect |
| OSFI’s AI bulletin | Technology, cyber and resilience practices for generative and agentic AI. | July 2026 |
| OSFI Guideline B-13 | Technology and cyber risk, which covers the systems AI runs on. | In effect |
| AMF AI guideline and model risk guideline | Quebec-regulated institutions: AI use, fair treatment of clients, model risk. | Model risk since June 2025; AI from 1 May 2027 |
| Privacy law and Quebec’s Law 25 | Personal information in AI; notice and explanation of fully automated decisions in Quebec. | In effect |
| Human rights law | No discrimination on protected grounds, whoever or whatever decides. | In effect |
The federal Artificial Intelligence and Data Act died in January 2025, so there’s no general AI statute on top of these. See who regulates AI in Canada.
Outside Canada
The EU AI Act reaches Canadian companies whose AI is used in the EU, and it treats credit scoring and life and health insurance pricing as high-risk; after the 2026 Digital Omnibus, those obligations apply from 2 December 2027. In the United States, banking regulators’ model risk guidance is now SR 26-2, and states and cities have their own rules, such as New York City’s requirement for bias audits of automated hiring tools. The UK’s PRA has SS1/23 for model risk at banks.
Voluntary standards sit alongside: the NIST AI RMF, and ISO/IEC 42001, the one AI management system standard you can be certified against.
What a compliance program contains
- An inventory of every AI system and model, built, bought or embedded in other software, with an owner. See AI use case inventory.
- A map of rules to systems: which obligations apply to which system, and why.
- Risk rating so the strictest work goes to the systems that matter. See model risk tiering.
- Assessments: impact, privacy, bias and vendor assessments before use.
- Independent review and approval by someone other than the builder.
- Controls in operation: monitoring, guardrails, human approval for consequential actions.
- Incidents and findings tracked to closure.
- Policies and training, including an acceptable use policy for staff.
- Evidence: records of who decided what, when, on what basis, kept so an examiner or auditor can check them.
The last item is where programs usually struggle. The work gets done, but the proof lives in email threads, spreadsheets and slide decks, and pulling it together for an examination takes weeks.
The AI compliance officer
Larger firms now have someone, sometimes titled AI compliance officer or AI risk lead, who owns this: keeping the inventory, tracking the rules, running assessments, reporting to senior management and answering examiners. In a bank the role usually sits in the second line, beside model risk management and compliance. For the skills and credentials involved, see AI governance certification and AI risk management jobs.
MINERVA gives that person the record: each model and AI system with the rules it answers to, its rating, tests, findings, approvals and vendors, and an evidence packet an examiner can verify on their own. See AI governance software.
Related questions
What is AI compliance?
Making sure the AI an organisation builds, buys and uses meets the laws, regulations, contracts and standards that apply to it, and keeping the evidence to prove it.
Is there an AI law in Canada?
Not a general one; the Artificial Intelligence and Data Act died in January 2025. AI is regulated through sector rules such as OSFI’s E-23 and B-10, the AMF’s guidelines in Quebec, privacy law and human rights law.
What does an AI compliance officer do?
Owns the organisation’s AI inventory and the map of rules to systems, runs or coordinates assessments, tracks findings, reports to senior management and deals with regulators and auditors on AI.
Is there an AI compliance certification?
Organisations can be certified against ISO/IEC 42001, the AI management system standard. Individuals can take credentials such as the IAPP’s Artificial Intelligence Governance Professional (AIGP).
Does OSFI E-23 apply to AI?
Yes. From 1 May 2027 OSFI’s E-23 applies to every model at a federally regulated financial institution, and its definition expressly includes AI and machine learning methods.
Sources
- OSFI — Guideline E-23, Model Risk Management (2027)
- OSFI — Guideline B-10, Third-Party Risk Management
- European Commission — AI Act
- ISO — ISO/IEC 42001:2023, AI management system
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.