On December 5, 2024, the Canadian Securities Administrators (CSA) published Staff Notice and Consultation 11-348 Applicability of Canadian Securities Laws and the Use of Artificial Intelligence Systems in Capital Markets (Notice) to clarify how existing securities laws apply to the use of artificial intelligence (AI) systems by participants in capital markets.

The Notice defines an AI system as “a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predications, content, recommendations, or decision that can influence physical or virtual environments”. The CSA note that the use of AI systems can enhance certain processes, provided that an appropriate degree of explainability is available and that a human can monitor and correct errors in a timely manner. The CSA expect market participants that are considering using AI systems in novel ways to consult with its staff well in advance of any planned launch to ensure that tailored terms and conditions can be applied to the system.

Key themes in the use of AI systems in capital markets

The CSA identified several key themes related to the use of AI systems in capital markets:

1. Technology and Securities Regulation: Securities laws are mainly technology-neutral and apply to activities regardless of the technology used.
2. AI Governance and Oversight: Policies and procedures should be tailored to address the unique features and risks of AI systems and to ensure that the AI system is ‘fit for purpose’. The CSA suggest having a "human-in-the-loop" and sufficient AI training for those using AI systems.
3. Explainability: When developing AI systems, the need for advanced capabilities should be balanced with the importance of explainability to support transparency, trust and compliance.
4. Disclosure: Given strong investor interest in AI, robust disclosure is essential to prevent "AI washing", where misleading claims about AI use are made to attract investment.
5. Conflicts of Interest: Market participants must ensure that AI outputs do not make conflicted decisions where the interests of parties differ.

Securities laws and guidance for market participants

The Notice outlines the current requirements under securities laws and guidance that apply to market participants' use of AI systems:

Registrants

The Notice indicates that registrants:

• Are required to disclose their use of AI systems when applying for registration, and will be required to notify the regulators if their adoption of AI systems changes the way they provide registerable services to their clients;
• Must develop governance structures that address the risks in using AI for operational efficiency (e.g., trade surveillance, client onboarding, preparation of reports);
• Have an obligation to maintain a system of controls and supervision to provide reasonable assurance that those acting for them comply with securities laws and maintain records to demonstrate this;
• May outsource support activities to AI systems provided by third parties, but cannot outsource any of their registerable activities. Outsourcing services that are based on or enhanced by AI systems requires those parties to have specialized skills and an understanding of registrant obligations. Registrants are reminded that they are responsible and accountable for all functions they outsource to third parties; and
• That use AI systems must take necessary steps to comply with their requirements to avoid material conflicts of interest, or use controls to mitigate those conflicts sufficiently. These could include alternative testing and monitoring mechanisms such as analyzing the correlation between AI system input and output, algorithms for pattern detection, or oversight of AI systems using software aimed at detecting bias.

Advisers and Dealers

Registered advisers and dealers must meet proficiency standards and ensure human oversight of investment recommendations when AI is involved. They must regularly test AI systems, with testing being proportional to the AI system's role, and be conducted by qualified personnel. Firms should plan for adjustments if any material deficiencies arise during testing. Clear disclosure to clients on AI use and its risks is required, in line with the requirements of securities laws and the duty to act fairly, honestly and in good faith.

Investment Fund Managers (IFMs)

The Notice indicates IFMs:

• May develop or outsource AI systems for fund operations, but must ensure transparency, explainability and freedom from conflicts of interests and biases;
• Using AI to meet a fund's investment objectives must disclose this in their offering documents, clearly stating the fund's objectives, strategies and processes;
• That use AI as part of their material investment strategy should disclose this as an objective and it should be approved by security holders;
• Whose use of AI constitutes a material change to the fund's investment strategy must file a material change report and corresponding press release;
• Should define "AI" in their offering documents, explain its role in the fund, and avoid vague or misleading statements;
• Must also provide risk disclosure in offering documents that align with the fund's objectives and strategies; and
• Should carefully review AI-related disclosures in sales communications (e.g., websites, social media) to ensure accuracy and avoid misleading statements.

Investment funds may track indices as part of their investment objectives and strategies. If the index provider uses AI to generate the index, IFMs should ensure the index methodology allows no material discretion, clearly specifies the rules for determining the index, and that the methodology and constituents are publicly available. The prospectus should detail the index, its composition and the rebalancing/reconstitution frequency. If AI systems raise conflicts of interest, IFMs should seek approval of their independent review committee (if applicable) before using the system and comply with relevant conflicts of interest rules.

Non-Investment Fund Reporting Issuers (Non-IF Issuers)

The Notice provides the following guidance for required disclosure by Non-IF Issuers adopting or developing AI systems:

• Non-IF Issuers should assess the materiality of AI to their operations when preparing continuous disclosure documents and should disclose the use of AI systems in a way that is factual and balanced, avoiding exaggerated or misleading statements;
• Disclosure should provide investors with entity-specific insights into AI's operational, financial and risk impacts and the corporate governance, controls and procedures that are in place to mitigate those risks;
• Disclosure should include how the board and management assess and manage AI-related risks;
• Non-IF Issuers should disclose, where material, AI-related risks, their consequences, preventative measures and any past regulatory, ethical, or legal incidents;
• Non-IF Issuers should consider whether any statement concerning AI is forward-looking information (FLI) and if so, disclosure must not be included without a reasonable basis for doing so and without the material factors or assumptions that are used to develop the FLI being disclosed; and
• Non-IF Issuers should disclose the source and provider of data used by the AI system, and whether the system is developed in-house or by a third party.

Marketplaces and marketplace participants

The Notice indicates marketplaces using AI systems must:

• Develop and maintain internal and technology controls, including information security, cyber resilience and change management;
• Keep records of any system failures, malfunctions, or delays (and determine if any are material); and
• Perform annual system reviews, vulnerability assessments and capacity stress tests.

These requirements apply regardless of whether the AI system is built in-house or outsourced.

Participants must ensure that their AI systems are reliable, secure and support business continuity, with regular testing, output validation and risk mitigation procedures. The Notice highlights that AI systems have significantly impacted automated order systems (AOS), increasing trading efficiency, liquidity forecasting and reducing costs, while also raising regulatory and compliance concerns. Firms using AI-based AOS must follow the same regulations as non-AI AOS to maintain market integrity and protect investors. AI-driven AOS must comply with rules on market manipulation, insider trading and other types of market abuse, and firms must be able to detect and prevent these issues.

Clearing agencies and matching service utilities

Clearing agencies and matching service utilities in Canada must already comply with comprehensive requirements under securities laws covering supervisory controls, risk management, systems design, operational performance and compliance. The Notice further indicates clearing agencies that choose to deploy AI systems must:

• Develop and maintain adequate internal controls, adequate cyber resilience and information technology controls, including controls relating to information systems, information security, change management, problem management, network support and system software support; and
• Keep records of any system failure, malfunction or delay and identify if any failure or malfunction is material.

Likewise, matching service utilities must:

• Conduct system reviews and vulnerability assessments on a reasonably frequent basis and, in any event, at least annually relating to their use of systems;
• Conduct capacity stress tests, review the adequacy of cyber resilience and vulnerability of system and data centres;
• Maintain adequate contingency and business continuing plans; and
• Conduct an annual independent review and promptly notify the security regulatory authority of any material failure.

Trade repositories and derivatives data reporting

Recognized or designated trade repositories must implement internal and technology controls to minimize AI-related operational risks, including security, cyber resilience, processing capacity and change management. AI systems used for reporting must be designed to ensure data accuracy, protect sensitive information and allow regulators access for oversight. Additionally, use of AI systems by repositories should include robust security measures to protect sensitive information from unauthorized access and ensure business, legal and operational risks are appropriately managed.

Designated Rating Organizations (DROs)

DROs must ensure that any use of AI systems in the credit rating process provides an appropriate degree of transparency and explainability in order to comply with applicable securities laws. DROs should exercise caution and diligence when considering using AI systems to automate any aspect of the credit rating process and assess appropriate safeguards for any such use. The Notice also indicates that DROs should publicly disclose any use of AI systems in their credit rating process.

Designated Benchmark Administrators (DBAs)

Similar to the commentary in the Notice applicable to DROs, DBAs must ensure that any use of AI systems in the benchmark determination process provides an appropriate degree of transparency and explainability in order to comply with applicable securities laws. DBAs should exercise caution and diligence when considering using AI systems to automate any aspect of the benchmark determination process and assess appropriate safeguards for any such use. The Notice also indicates that DROs should publicly disclose any use of AI systems in their benchmark determination process.

Consultation process

The CSA have requested stakeholder feedback on the use of AI systems in capital markets through consultation questions available on their members' websites to determine whether any changes need to be made to securities laws within the context of AI systems. The comment period ends on March 31, 2025.

For more information on this topic, please reach out to the authors, Riley Dearden and Kate Stevens.

The authors would like to thank Sélina Audino, Articling Student, for her assistance with this article.