About

flag of Canada

Canadian Financial Institutions, OSFI, FINTRAC, and Agentic AI

Canadian financial institutions are navigating a regulatory environment that has never been more demanding – and doing it simultaneously with accelerating AI agent deployments across operations, compliance, customer service, and risk management. Three regulatory frameworks define the stakes: OSFI’s AGILE framework, FINTRAC’s enforcement posture, and PIPEDA. Understanding what each requires – and where current AI deployments create exposure – is the starting point for a defensible governance posture. OSFI AGILE: Operational risk at the intersection Read more

business man, clock, time, lazy, lay, rest, relax, people, lifestyle, exhausted, watch, business, routine, work, laying, comfortable, cozy, enjoying, cartoon, alone, male, resting, deadline, clock, time, time, time, time, lazy, lazy, lazy, lazy, lazy, rest, relax, routine

The EU AI Act Deadline and What Regulated Firms Must Show

By the time most organizations finish their planning cycles and stand up a cross-functional governance working group, the EU AI Act’s core enforcement provisions will already be in force (August 2026 deadline!) The question for regulated firms – banks, insurers, payment processors, professional services firms with EU exposure – is not whether to comply. It is what compliance actually requires, and what evidence they need to produce. What Article 99 actually says The EU AI Read more

business, calculation, finance, audit, accounting, calculate, tax, accountant, calculator, invest, businessman, market, contract, audit, audit, accounting, accounting, tax, tax, tax, tax, tax, accountant, accountant, calculator, contract

When the Board Asks “Who Is Accountable for the Agents?”

Boards are asking. Not in a casual, exploratory way – in the way that follows a compliance breach, a regulatory inquiry, or a news story about an AI system doing something it should not have done. The question landing in board meetings now is direct: who in this organization is accountable for our AI agents? Most organizations do not have a clean answer. That is itself a governance failure. Why the accountability question has escalated Read more

identity, mask, psychology, emotions, self, personality, mental health, duality, hidden face, expression, concept, human, inner self, behavior, social mask, authenticity, identity crisis, feelings, symbolic, flat design, modern, minimal, concept art, ai generated

The New Insider Threat Is Non-Human: Governing Agent Identities

The insider threat model was built around people. An employee with legitimate credentials and a reason to misuse them – that is the scenario security teams have managed for decades. The controls are familiar: least-privilege access, behavioral monitoring, periodic access reviews, offboarding checklists. None of those controls were designed for an entity that never sleeps, executes thousands of actions per hour, and has no HR file. AI agents are now the fastest-growing population of credentialed Read more

crowd, door, lead, marketing, minimalism, japanese, cute

Preparing for a Billion Agents: Governance at Machine Scale

There is a number that should concentrate the mind of every CIO, CISO, and chief risk officer: one billion. According to IDC’s February 2026 report *Operationalizing Trust for Agentic AI*, the global population of deployed AI agents is on course to pass one billion by 2029 – roughly a 40-fold increase from today. That is not a gradual evolution. It is a phase transition. The question is not whether your organization will run agents at Read more

family, protection, insurance, security, shield, father, mother, child, safety, guardianship, life insurance, support, defense, parenting, guardian, cartoon, symbolic, graphic, protect, image

“Guardian Agents”: The Governance Category Gartner Just Named

Every meaningful technology market starts the same way: practitioners invent a solution to a real problem, vendors give it a dozen different names, and then an analyst firm publishes a report that hands the category a single, durable label. That moment just arrived for AI agent governance. In its November 2025 Market Guide for AI Governance Platforms (report G00837249), Gartner introduced the term guardian agents to describe a distinct and newly critical capability: a blend Read more

Supply-Chain Trust: SBOMs, Attestations, and the OpenSSF Badge in Plain English

When an organization deploys software to govern its AI agents, a natural question follows: how do you know the governance software itself is trustworthy? How do you know the version you installed is the version the developers built and signed? How do you know it does not contain a vulnerable dependency that an attacker could exploit? How do you know the build process was not tampered with? These questions belong to the domain of software Read more

Local-First and Sovereign-Ready: Why No Hosted Dependency Matters

Ask a financial institution’s chief information security officer whether they are comfortable routing AI agent governance decisions through a cloud service operated by a third party, and the answer will usually be no – or at minimum, a long conversation about data residency, vendor risk, and regulatory compliance. Ask the same question about a defense contractor, a healthcare organization, or a government agency, and the conversation gets longer still. Ethosure and its open-source coding-ethos engine Read more

Code Intelligence Memory: How the System Learns from Past Mistakes (and Saves Tokens)

An AI coding agent that encounters a policy violation for the first time might need several attempts to understand and fix it. An AI coding agent that has seen the same violation three times before should not need to rediscover the solution. More broadly, an organization running AI agents across dozens of sessions should not be paying for agents to repeatedly re-read the same files, re-run the same failed commands, or re-generate the same remediation Read more

data, sorting, classification, report, collection, decision, analysis, support, database, system, technology, business, big data, search, monitoring, separated, relevant, information, computer, cartoon, internet, science, process, service, data, database, database, database, big data, big data, big data, big data, big data

One Source of Truth: How Scattered Rules Compile into a Single Policy Bundle

Governance problems in software organizations often share a root cause: rules defined in one place are enforced differently in another, not enforced at all in a third, and unknown to a fourth. A security policy lives in a Confluence page; the Git hook that supposedly enforces it was written two years ago and has not been updated since; the CI pipeline has a slightly different interpretation; the AI agent has never heard of any of Read more