Months before Andrew Bailey wrote to the G20 about frontier AI's threat to global financial stability, Canada's own prudential regulator was already sending the same warning to the country's biggest financial institutions.
On April 29, 2026, the Office of the Superintendent of Financial Institutions (OSFI) emailed chief technology officers, chief information security officers and chief risk officers across federally regulated financial institutions, cautioning that advanced AI models "significantly compress the timeframe for effective risk mitigation."
OSFI specifically flagged frontier models capable of identifying software vulnerabilities as a factor that could dramatically shorten the gap between a flaw being discovered and it being exploited.
Four months later, that warning landed on a global stage. Bailey, who serves as Bank of England governor as well as chair of the international Financial Stability Board (FSB), has written to G20 finance ministers and central bank governors today, naming frontier AI's impact on cyber risk as the most immediate threat facing the global financial system.
Read next: Top Cyber Insurance Companies in Canada
This isn't really a coincidence of timing. It looks more like prudential regulators worldwide arriving at the same conclusion independently. Bailey's letter argues that frontier AI models are gaining autonomy fast enough to change the speed, scale and economics of a cyber attack, undermining confidence in a financial system that depends heavily on a small number of shared cloud and technology providers. That's the same concentration-risk logic OSFI raised with Canadian institutions in April, and one that continues to run through its ongoing supervisory work. OSFI's 2026 Technology Risk Bulletin on generative and agentic AI names third-party concentration risk, alongside hallucination and autonomous code deployment, as a primary threat under its existing B-13 technology and cyber risk guideline.
Both regulators are writing against the backdrop of a real event. In July, OpenAI disclosed that two of its own AI models escaped a sealed testing environment during an internal evaluation and, with no human directing them, found their way onto the open internet and exploited a security flaw to breach systems belonging to Hugging Face, all in pursuit of the answers to a cybersecurity benchmark they were being scored on. OpenAI called it an unprecedented cyber incident.
Neal Jardine, chief cyber intelligence and claims officer at BOXX Insurance, has told Insurance Business that AI is already changing how criminals exploit stolen data, automatically scanning breach dumps and matching credentials at a scale that wasn't previously feasible. He has also warned that a "race to the bottom" on coverage and controls could follow if insurers compete on price rather than resilience as the market softens.
For Canadian brokers and underwriters, the alignment between OSFI and the FSB is worth taking note of. A supervisory approach built around third-party concentration risk and compressed vulnerability windows is unlikely to stay confined to OSFI-regulated banks and insurers. Expect the same logic to work its way into how cyber policies are worded, how contingent business interruption responds to a shared AI vendor's failure, and how aggregation is modelled across a book that increasingly depends on the same handful of AI providers.
