A plain-language guide By Nick Jang, founder · updated 28 October 2026
OSFI’s AI bulletin, explained.
In July 2026 OSFI published sound practices for generative and agentic AI across technology, cyber security and operational resilience. Here are its six areas in plain words, what they mean for AI agents and AI vendors, and how they sit beside E‑23. Read the bulletin on OSFI’s site.
01 At a glance
- Its title
- Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational Resilience.
- What it is
- A technology risk bulletin from OSFI setting out sound practices. It is not a guideline; OSFI presents it as building on existing expectations.
- Published
- July 2026.
- Builds on
- Guideline B‑13 (technology and cyber risk), E‑21 (operational risk and resilience) and B‑10 (third-party risk).
- Why now
- Generative AI produces content and agentic AI acts on its own; OSFI's view is that both can speed up and scale technology, cyber and operational risk.
02 The six areas of sound practice
The headings are OSFI’s own; the practices beside them are in our words.
| OSFI's heading | What it suggests |
|---|---|
| Enhance governance and strategic accountability | Senior management understands AI well enough not to lean on vendors' assessments; AI strategy tied to risk appetite with escalation triggers; AI risks in enterprise risk management; owners across the AI lifecycle; limits on autonomy; human oversight alongside the controls. |
| Maintain information and decision integrity | Data classified and its origin tracked; inputs limited to trusted sources and sensitive data kept out of unapproved tools; AI output treated as one input to a decision; people accountable for high-impact decisions, with a record of how AI informed them; prompts and outputs monitored. |
| Controlled software development and changes | Models trained on trusted data; AI-written code checked for security flaws before release; agent activity monitored; approval for high-risk actions; AI components managed as controlled assets under change management and tested under normal and stressed conditions. |
| Control AI agent autonomy and access | Each agent its own non-human identity; least privilege, scoped permissions and short-lived credentials, never shared or inherited ones; tools restricted to an allow-list; approval for high-impact actions; agent activity logged and reviewed; access recertified. |
| Embed AI into cyber security operations | AI misuse such as prompt injection in threat modelling and testing; AI used to prioritize vulnerabilities and patch faster; anomaly detection, prompt monitoring and output filtering; AI activity fed into security tools; incident playbooks for AI. |
| Increase resilience and manage third-party risk | AI dependencies mapped to critical operations; outages tested with manual fallbacks; replaceability of AI services assessed and material concentration reported to the board; third-party risk management extended to vendors' AI, with vendors disclosing their use of it; AI disruption in continuity and recovery testing. |
03 A ten-point checklist
- An inventory of AI systems and agents, each with an owner
- A unique identity for every agent, and no shared credentials
- A written, least-privilege policy for what each agent may do
- An approval step for high-impact agent actions, by a person
- Logs of agent activity that someone reviews
- A record showing how AI informed each high-impact decision
- Prompt injection in threat models and tests
- Incident playbooks that cover AI
- AI dependencies mapped to critical operations, with manual fallbacks
- Vendors asked to disclose their AI use, in the contract
04 Where MINERVA fits
MINERVA keeps AI systems, agents, models and vendors on one record with their owners; gives each agent an identity bound to one decided policy, checked before every tool call; holds high-impact calls for a person who is not the agent’s developer; keeps every decision hash-chained and time-stamped; and shows which models and agents depend on each AI supplier. It does not make an institution compliant. See the agentic AI governance platform and AI vendor risk software.
05 Questions people ask
What is OSFI's bulletin on generative and agentic AI?
A technology risk bulletin OSFI published in July 2026, titled Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational Resilience. It sets out sound practices in six areas: governance and accountability, information and decision integrity, software development and change, AI agent autonomy and access, cyber security operations, and resilience and third-party risk.
Is the bulletin a new requirement?
It is not a guideline. OSFI presents its practices as sound practices that build on the expectations already in Guidelines B-13, E-21 and B-10. Institutions should read the bulletin itself and take advice on how it applies to them.
What does the bulletin say about AI agents?
Give each agent its own non-human identity; apply least privilege, scoped permissions and short-lived credentials rather than shared or inherited ones; restrict the tools an agent can use; require approval for high-impact actions; log and review agent activity; recertify access; and set limits on autonomy with human oversight.
What does it say about AI vendors?
Extend third-party risk management to vendors' use of AI and require vendors to disclose it; map AI dependencies, including external ones, to critical operations; test outages with manual fallbacks; assess how replaceable an AI service is; and report material concentration risk to senior management and the board.
How does it relate to Guideline E-23?
E-23 is OSFI's model risk management guideline, in effect from 1 May 2027, and it covers AI and machine-learning models. The bulletin looks at the same AI through technology, cyber and operational resilience. An AI agent built on a model sits under both: E-23 for the model's risk, and the bulletin's practices for the agent's access, identity and resilience.
Where should an institution start?
With an inventory of its AI systems and agents and their owners, then identities and least-privilege policies for agents, an approval step for high-impact actions, logs someone reviews, and the vendors' disclosure of their AI use.
Read more: OSFI B‑13, explained · Agentic AI governance · Third-party AI procurement · AI vendor risk under B‑10 · OSFI E‑23. A plain-language summary, not legal advice; the bulletin on OSFI’s site is the source.