Each vertical lands on a different framework stack. The operating model underneath does not change — primary-source regulatory text, one authoritative control mapping, digital compliance officers doing the mechanical work, specialists owning the judgement. Below, six sector cuts, their active obligations, and the playbooks we run inside them.
Every card below opens a sector cut — the frameworks your supervisor and your counterparties will cite this year, the playbooks we deploy, and the pain we see in every diligence conversation.
Schedule I/II banks, D-SIBs and FRFIs operating under an accelerating Canadian supervisory agenda.
Insurers and reinsurers operating under OSFI, AMF and provincial oversight — and under AI-liability underwriting scrutiny.
Investment dealers, asset managers and exchanges under CIRO and OSC supervision, with EU AI Act reach on GPAI.
Fintechs selling AI-enabled services into Canadian banks and insurers, and into EU-regulated buyers.
Provincial credit unions, caisses populaires and cooperative financial institutions under FSRA, AMF, CUDGC and provincial deposit insurance.
Portfolio managers, family offices and IIROC/CIRO-registered advisors deploying AI across suitability, KYC and portfolio construction.
The largest cost in AI governance is not the work itself — it is running separate programmes for overlapping obligations. The same inventory, the same validation pack, the same data-lineage graph answer multiple supervisors. Below, the frameworks that cut across verticals and where they land.
Model risk discipline extends to every FRFI with a material-risk AI or model inventory. The 17-field Appendix A register is the same artifact across sectors.
The third-party AI cascade reaches every regulated buyer and every fintech selling into them. Nth-party discovery is not optional.
ADM transparency, PIAs and cross-border transfer rules attach to anyone processing Quebec personal information — banks, insurers, credit unions, dealers and fintechs alike.
High-risk regime lands August 2, 2026. Canadian and US firms with EU customers, counterparties or data subjects inherit Annex IV and Article 15 obligations.
Govern / Map / Measure / Manage is the profileable overlay US and international regulators reach for when they want a shared vocabulary.
The certifiable AI management system standard is moving into RFP and vendor-diligence language across every vertical.
Banking, insurance, capital markets, fintech, credit unions, wealth management — the firm runs the same operating model across all six. Tell us which cut lands closest and we'll walk you through the portfolio a supervisor would recognise.
