AI Governance at the Board Level: What Canadian Directors Need to Do in 2026

The governance conversation at most Canadian boards follows a predictable arc: the CEO mentions AI is a priority, an IT or operations presentation covers current deployments, and the board records it in the minutes. What's missing is the accountability framework that regulators, proxy advisers, and courts are increasingly expecting boards to have — and that institutional investors are starting to ask about explicitly.

That gap is closing quickly in 2026. Quebec's Autorité des marchés financiers (AMF) published its final Guideline for the Use of Artificial Intelligence in April 2026, effective May 1, 2027, with specific expectations for board-level oversight. KPMG and INSEAD's Corporate Governance Centre released a global AI Governance Principles for Boards framework in April 2026, including a Canadian edition aimed at directors. The Institute of Corporate Directors added an Effective Board Oversight of AI curriculum to its 2026 programming. Glass Lewis extended its board AI oversight policy — in force since 2025 — which its analysts apply when evaluating governance disclosures for TSX-listed companies.

Statistics Canada reported that 19.2% of Canadian businesses used AI in production or service delivery in the 12 months to Q2 2026, up from 6.1% just two years earlier. The acceleration means that boards that don't have structured AI oversight frameworks are overseeing organizations where AI is already making decisions — or informing them — without governance commensurate to that use.

What Regulators and Proxy Advisers Now Expect

Quebec's AMF Guideline covers authorized insurers, financial services cooperatives, trust companies, and deposit institutions operating in Quebec. Its scope is broader than it sounds: the guidance explicitly reaches any use of AI by covered institutions — not only systems that process client files. The AMF's core board expectations, summarized by Blakes, include:

• Ensuring senior management fosters responsible AI use and keeps pace with AI risks
• Requiring sufficient collective board competence to understand the risks being taken on
• Defining each party's roles and responsibilities at every stage of an AI system's life cycle
• Reviewing whether governance mechanisms for AI risk are functioning via internal audit

A June 2026 commentary by Fasken, AI in the Boardroom: Not Just for Financial Institutions, argues that the AMF framework — particularly its risk-rating approach and seven-stage AI life cycle — provides a useful governance model for boards in all sectors, not just Quebec-regulated financial institutions. This aligns with how most practitioners approach sector-specific guidance in Canada: leading regulators set the floor, and boards in other sectors use the same frameworks voluntarily.

OSFI updated its Guideline E-23 on Model Risk Management in September 2025 to explicitly cover AI and machine-learning systems, effective May 1, 2027. Its July 2026 Bulletin on Generative and Agentic AI adds practical guidance on cybersecurity and operational resilience for federally regulated financial institutions. For boards in this space, the question is no longer whether AI governance is a regulatory expectation — it is, with a defined timeline.

Glass Lewis began applying a board AI oversight assessment to public companies in 2025. Its policy examines whether boards have designated an AI-accountable committee or director, whether AI risk is disclosed in governance documents, and whether there is evidence of ongoing board education on AI. Roughly one-third of TSX 60 companies had incorporated AI oversight language into their board mandates as of 2025.

For mid-market boards, the glass-house pressure is lower than for TSX-listed companies. But mid-market directors face the same liability exposure: Canadian courts examine whether directors took reasonable steps to understand AI's implications for their business. Lawson Lundell notes that directors who delegate AI accountability entirely to IT without board-level attention may be found to have breached their duties where AI-related losses result.

The KPMG-INSEAD Framework

KPMG Canada and INSEAD's Corporate Governance Centre published five core principles for board-level AI governance in April 2026. The framework is designed to apply across industries and jurisdictions. For Canadian mid-market boards, the most actionable are:

Strategic oversight for long-term value creation. Boards should understand how AI is being used to create value and what the organization's AI strategy is relative to competitive and market context. This means more than a periodic IT update — it means the board has considered the organization's AI risk appetite and its strategic ambitions in AI side by side.

Governance structure and accountability. Who owns AI governance in the organization? The KPMG framework asks boards to define accountability — which committee, which executive, which reporting lines bring AI governance to the board level. Without a clear owner, AI risk gets distributed across functions in ways that make accountability difficult to establish after something goes wrong.

Risk oversight and responsible AI. Boards should understand their organization's material AI risks: data privacy, model bias, operational dependency, third-party AI provider risk, and cybersecurity exposure. For many mid-market boards, this is the step they have not taken formally — the AI tools are in use, but the board has not inventoried the risk exposures they create.

Keeping pace with AI's impact on governance itself. The fifth principle asks boards to consider how AI may change their own oversight practices — including how management-to-board reporting might use AI, and how to maintain the board's independence and judgment when AI tools generate the analyses the board receives.

Practical AI Governance for Mid-Market Boards

Publicly listed companies face the most visible pressure on AI governance — Glass Lewis assessments and investor expectations create accountability that shows up in proxy votes. But mid-market boards are not exempt from the underlying obligation.

The practical starting point for most mid-market boards is a structured conversation — before the next budget cycle closes — that answers four questions:

What AI systems is the organization running? An AI inventory is the prerequisite for any governance discussion. If the board doesn't know what AI is deployed — including AI features embedded in SaaS platforms, automated decision tools in HR or credit, and copilot tools in productivity software — it can't assess the exposure. Hub International's guide for Canadian directors recommends starting with this inventory as the first governance step.

What decisions is AI influencing? The governance obligation is highest where AI outputs affect individuals: credit approvals, HR screening, pricing decisions, claims processing. These are the systems that create liability exposure under PIPEDA, Quebec Law 25, and the automated decision provisions expected in Bill C-36.

Who owns AI accountability in the organization? For mid-market companies, AI governance often exists implicitly — the CFO knows about one system, IT knows about another, operations built a third. Designating a clear owner — an existing executive with AI accountability added to their role — creates the reporting pathway the board needs.

Is our insurance coverage current for AI-related losses? Hub International's guide notes that directors' and officers' insurance and cyber liability policies may not fully cover AI-related losses. Reviewing policy coverage alongside AI governance is part of the risk management picture that boards should address in 2026.

The Timing Argument

BLG called 2026 a turning point for AI in Canada. What makes it a turning point for boards specifically is the combination of fast-accelerating AI deployment, maturing regulatory expectations, and the beginning of legal scrutiny. The AMF Guideline's May 2027 effective date means Quebec-regulated financial institutions have months, not years, to build governance frameworks. For mid-market boards in other sectors, the guidance is directional rather than binding — but the direction is clear.

Torys' AI and Board Strategy report recommends keeping AI on the agenda of the full board or a designated committee rather than delegating it exclusively to IT. That recommendation reflects what regulators and courts now expect: the board should have informed oversight, not just downstream visibility after something goes wrong.

The organizations whose boards treat Q4 2026 as the starting point for structured AI governance will enter 2027 ahead of the regulatory curve, with accountability structures that hold up to scrutiny. Those that wait will be building governance frameworks under pressure, against an AMF compliance deadline that applies broadly and an emerging legal standard that will not stop at financial institutions.

Sources

• Statistics Canada. *Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026.* statcan.gc.ca (June 2026)
• AMF Québec. *Guideline for the Use of Artificial Intelligence.* lautorite.qc.ca (April 2026)
• Blakes. *Quebec's AMF Issues Guideline on the Use of AI for Financial Institutions.* blakes.com (2026)
• Fasken. *AI in the Boardroom — Not Just for Financial Institutions.* fasken.com (June 2026)
• KPMG Canada & INSEAD. *AI Governance Principles for Boards.* assets.kpmg.com (May 2026)
• Torys LLP. *OSFI Updates and Expands Scope of Guideline E-23.* torys.com (October 2025)
• McCarthy Tétrault. *Managing the AI Risks in the Financial Sector: OSFI's Bulletin on Generative and Agentic Artificial Intelligence.* mccarthy.ca (July 2026)
• Hub International. *Canadian AI Corporate Governance Guide for Directors and Officers.* hubinternational.com (March 2026)
• Lawson Lundell. *Can a Board of Directors Breach Their Duties by Ignoring AI?* lawsonlundell.com (2026)
• Torys LLP. *AI and Board Strategy.* torys.com (December 2025)
• BLG. *A Turning Point for AI in Canada in 2026.* blg.com (March 2026)

Cloud Forces' AI Advisory service works with Canadian mid-market organizations to build AI governance frameworks suited to their regulatory environment and board structure. We start with an AI Readiness Assessment that maps your current AI deployments, decision systems, and governance gaps, and we deliver a governance report and board-ready summary that your directors can act on. As an AWS Consulting Partner since 2019 and Microsoft Solutions Partner since 2022, our team brings the infrastructure depth to assess AI security alongside the advisory expertise to give your board the accountability structure it needs. Book a consultation to discuss where your organization stands.