Rapid advances in frontier artificial intelligence are intensifying cyber, third-party and reputational risks across the financial sector, according to the Office of the Superintendent of Financial Institutions’ semi-annual update to its 2026–2027 Annual Risk Outlook. 

Frontier AI models are shortening the time between the discovery and exploitation of software vulnerabilities. The models can identify and combine weaknesses across interconnected systems, allowing malicious actors to conduct more sophisticated and coordinated attacks while reducing the window for institutions to respond. At the same time, AI may strengthen defensive capabilities by supporting faster vulnerability detection and patching. 

The update also highlights growing third-party concentration risk. A relatively small group of providers dominate the development of frontier AI models and the cloud infrastructure used to deploy them, increasing the potential for correlated disruptions. OSFI warns that institutions will need effective due diligence, ongoing monitoring and strong oversight of critical third-party relationships as AI adoption expands. 

OSFI developing AI “safety code” 

Prior to the update’s release on October 8, OSFI Superintendent Peter Routledge told the Global Risk Institute Summit in Toronto that the regulator is developing a “safety code” intended to strengthen cybersecurity and mitigate AI-related risks in the federal financial sector. While the details remain under development, the code could establish broad, high-level standards to provide a basic level of protection for the financial system while maintaining a “wide perimeter for innovation.” 

The initiative reflects OSFI’s concern that an AI-related problem at one financial institution could spread through counterparties and other connections within the broader financial system. 

OSFI’s risk outlook update notes that innovation should be supported by sound governance and robust risk-management practices. The regulator is continuing to monitor frontier AI developments, assess technology concentration and common dependencies on critical service providers, and build its own capacity to supervise institutional deployments of the technology. 

CCUA webinar resources available to members 

These developments reinforce issues explored in CCUA’s September 10 webinar, Navigating Frontier AI Cyber Risk: What Credit Unions Need to Know (member login required). The session featured Mike Alguire, Head of Information Security at Servus Credit Union; Khaled Rabi, Partner, Cyber at Deloitte; and Ali Varshovi, Partner and Financial Services Cyber Lead at Deloitte. 

The webinar examined how frontier AI is reshaping the cyber threat landscape, including the growing pressure on vulnerability management, governance and oversight, and third-party risk. It also outlined practical steps credit unions can take to strengthen their cyber resilience. 

CCUA will continue to take a proactive role on frontier AI risks through ongoing monitoring, engagement with OSFI and other stakeholders, member education, and advocacy aimed at supporting a regulatory approach that promotes both innovation and resilience across the credit union sector.