Ontario Securities Commission Finds AI Adoption Outpacing Governance Questions at Some Firms

Key Takeaways

• Early AI Adoption: Most Ontario-registered securities firms remain in the early stages of AI adoption, although some reported more advanced applications in specific areas.
• Governance and Accountability: The OSC expects registered firms to maintain risk-based oversight of AI systems and remain accountable for their use and outputs.
• Compliance Examination: The regulator reviewed AI governance, employee training, risk assessments, internal controls, third-party oversight and client disclosure.
• Industry Survey: The initiative included a November 2025 survey of 787 registered firms in Ontario, with an 86% response rate.
• Existing Legal Obligations: Staff Notice 33-763 reinforces current securities law requirements without introducing new rules or modifying existing ones.

Deep Dive

The Ontario Securities Commission surveyed 787 registered firms last November to examine how artificial intelligence was being used across the province's securities industry. With 86% responding, the regulator found that most firms were still in the early stages of adoption, although some had begun using the technology more extensively in particular areas.

The Ontario Securities Commission expects firms to apply oversight appropriate to the nature, scale and complexity of each AI application. Its central message is that adopting the technology does not diminish a firm's regulatory responsibilities. Registered firms remain accountable for their use of AI and the outputs it produces, including when outside providers supply the systems.

“Artificial intelligence is rapidly reshaping our capital markets, from enhancing client service to improving efficiencies,” said Matthew Onyeaju, senior vice president of the OSC's Registration, Inspections and Examinations Division. “Effective governance and thoughtful oversight are essential to realizing its benefits responsibly and in the public interest.”

The examination considered several aspects of AI governance, including employee training, risk assessments, internal controls, third-party service provider oversight and client disclosure. These areas reflect the compliance responsibilities firms must address as AI becomes part of their business activities.

The regulator has not prescribed a uniform approach to AI oversight. Instead, it expects firms to consider the risks associated with individual applications and establish controls proportionate to those risks. The distinction matters in an industry where firms are adopting AI at different rates and for different purposes.

Third-party oversight is part of that responsibility. Firms that obtain AI capabilities from external providers remain accountable for how those systems are used and for their outputs. Reliance on a technology vendor does not relieve a registered firm of its obligations under securities law.

The OSC also examined employee training and client disclosure, recognizing that the use of AI raises questions extending beyond the technical operation of the systems themselves. Firms must consider how their existing compliance arrangements apply to the technology they introduce.

The regulator's findings do not suggest that every registered firm has reached the same level of AI adoption. Most remain at an early stage, while some reported more advanced use in specific areas. That variation is one reason the OSC has emphasized oversight proportionate to the risks of each use case rather than a single approach for the industry.

The notice does not establish new regulatory requirements. It reinforces existing guidance and explains how current securities law obligations apply to AI systems, without creating new rules or amending those already in force.

The examination was informed by Canadian Securities Administrators Staff Notice and Consultation 11-348, Applicability of Canadian Securities Laws and the Use of Artificial Intelligence Systems in Capital Markets, which addressed the application of existing securities legislation to AI.

For compliance departments, the practical consequence is that AI must be considered within the governance and supervisory arrangements already required of registered firms. The technology may change how certain activities are performed, but the responsibility for supervising those activities remains with the firm.

The OSC's examination comes while much of Ontario's registered securities industry is still developing its use of AI. Firms have time to determine how the technology fits into their operations, but the regulator's expectations for accountability are already in place.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey