## The Regulatory Trajectory: Where This Is Heading ### 7.1 The Governance Timeline Pattern Canadian financial services regulation follows a documented pattern. New technologies emerge, regulators observe, existing rules are clarified, and eventually specific guidance follows.

Northern Catalyst analysis. Based on documented regulatory patterns. Not attributed to any regulator.

Online trading: Innovation to mature regulatory framework, 7-8 years
Robo-advisors: Innovation to mature framework, 2-4 years
AI in financial services: CSA Staff Notice 11-348 (December 2024) marks the first formal guidance. Based on previous cycles, a mature framework could emerge within 3-5 years (2027-2029).

The pattern is consistent: each successive technology cycle has produced regulation faster than the previous one.

### 7.2 What Is Coming in 2026-2027 Specific regulatory developments to watch: - **CSA follow-up to 11-348 consultation** (expected 2026, not yet published) - **OSFI E-23 effective May 2027** (institutions building model risk management frameworks now) - **Quebec AMF AI guideline finalisation** (draft published July 2025, consultation closed November 2025, final expected 2026) - **New federal privacy legislation** (expected early 2026, not yet tabled) - **FIFAI II final report** (expected March 2026, co-sponsored by OSFI, Department of Finance, Bank of Canada, FCAC) - **FP Canada fintech vendor code of standards** (expected early 2026, targets vendors not individual advisors) ### 7.3 International Patterns as Preview Five patterns have converged across the EU, UK, and Australian regulatory approaches to AI in financial services. Each signals what is likely coming for Canadian advisors: 1. **Accountability is personal.** Whether through the UK's Senior Managers regime, ASIC's directors' duties, or the EU's deployer obligations, individual accountability for AI-related decisions is becoming universal. 2. **Black-box AI is increasingly unacceptable.** ASIC flagged unexplainable credit-scoring models as a governance risk. The EU AI Act establishes a right to explanation. The CSA requires the "highest degree of explainability that is feasible." The direction is consistent. 3. **Vendor oversight is a regulatory obligation.** Every jurisdiction holds the regulated entity, not the technology vendor, responsible for AI outcomes. 4. **Consumer protection frames everything.** Client Focused Reforms in Canada serve the same function as the FCA's Consumer Duty and ASIC's best-interests obligations. AI tools that produce unfair outcomes attract regulatory action regardless of the underlying technology. 5. **Governance must keep pace with adoption.** ASIC reviewed 624 AI use cases across 23 licensees and found that firms are adopting AI faster than they are updating governance frameworks. That finding applies directly to Canadian advisors. ### 7.4 Why Acting Carefully Now Matters

The regulatory direction is toward more requirements, not fewer. Advisors who evaluate AI tools properly now, using a framework grounded in current Canadian requirements, are better positioned than those who wait for rules that will only add obligations. Careful evaluation is professional judgment, not delay.

Waiting for AI-specific regulation is itself a decision. Shadow AI liability continues while you wait. Competitors who evaluate properly position themselves ahead. The trajectory is clear, and every jurisdiction is moving in the same direction: more accountability, more transparency, more governance. Acting carefully now is not the same as acting recklessly now. It means evaluating tools against the framework in Chapter 6, understanding where your data goes, and demonstrating to your compliance team that you take these obligations seriously.