1. Introduction
The rapid advancement and deployment of artificial intelligence (AI), particularly generative AI, have introduced profound transformations across industries, reshaping corporate strategy, operations and decision-making (Gabriel, Reference Gabriel2024; OECD, 2025). As AI systems increasingly influence core business functions – from financial reporting and customer engagement to compliance and risk management – boards of directors are confronted with a new governance frontier (Fenwick et al., Reference Fenwick, Kaal and Vermeulen2019). This frontier is marked by both unprecedented opportunities and complex risks, including algorithmic bias, data privacy breaches, cybersecurity threats and ethical dilemmas.
Despite the growing strategic relevance of AI, governance practices regarding AI remain underdeveloped, especially in Canada. AI governance is still a relatively understudied field from an empirical legal perspective (Abrash et al., Reference Abrash, Probst and Edelman2024; Lafarre & Keijzer, Reference Lafarre and Keijzer2023; Loiselle & Bernasconi, Reference Loiselle and Bernasconi2025), and the role of boards in overseeing AI-related risks and opportunities is emerging as a critical – yet underexplored – dimension of corporate governance (Cowger, Reference Cowger2023; Petrin, Reference Petrin2024; Wilson, Reference Wilson2025). This gap is particularly salient given the evolving expectations of regulators, investors and civil society, as well as the proliferation of soft law instruments such as voluntary codes, international standards and proxy advisor guidelines.
Against this backdrop, this article examines how Canadian-listed companies, particularly those forming the TSX 60 Index, are responding to the governance challenges posed by AI. It begins by situating the discussion within the Canadian Corporate Governance Framework (CGF), exploring both theoretical and legal perspectives. It then presents an empirical study of AI-related governance practices among TSX 60 companies. The analysis reveals a gap between the recognition of AI as a strategic risk and the formal integration of AI governance into corporate architecture.
Building on this empirical foundation, the article surveys emerging best practices in AI governance, drawing from academic literature, professional guidelines, proxy advisor expectations, shareholder proposals and international governance codes. It concludes by assessing the responsiveness of current Canadian governance standards to the unique risks and opportunities introduced by AI. In doing so, it offers recommendations for regulators seeking to modernize governance frameworks in an era defined by technological disruption and ethical complexity.
2. Canadian CGF
2.1. Theoretical perspectives
Corporate governance refers to “the broad array of systems, processes, and procedures that seek to regulate the relationship between managers and shareholders in particular and among all firm stakeholders in general” (Baker & Anderson, Reference Baker and Anderson2010, p.5; Larcker & Tayan, Reference Larcker and Tayan2015, pp.7-9; Shleifer & Vishny, Reference Shleifer and Vishny1997). The goal of governance is to maximize the corporation’s value. From a North American perspective, two competing perspectives coexist to define the goal of corporate governance. On the one hand, shareholder primacy conceives the objective of governance as setting the conditions that allow companies to maximize shareholder value. On the other hand, stakeholder theory advocates centring governance on the interests of all parties that interact within the company – the stakeholders.
2.1.1 Shareholder primacy
Historically, corporate governance in Canada has been shaped by the Anglo-American model of shareholder primacy, underpinned by the nexus-of-contracts theory (Hansmann & Kraakman, Reference Hansmann and Kraakman2001). This theory conceptualizes the corporation as a legal structure facilitating a web of contractual relationships, with shareholders occupying a privileged position as residual claimants (Jensen & Meckling, Reference Jensen and Meckling1976). Their exposure to economic risk is seen as justifying their control rights and the prioritization of shareholder value in corporate decision-making. This model assumes that maximizing shareholder value ultimately enhances social welfare (Jensen, Reference Jensen2002), particularly under conditions of perfect competition, complete information and internalization of externalities. However, such conditions are rarely met in practice (Henderson, Reference Henderson2021; Zingales, Reference Zingales, Zingales, Kasperkevic and Schechter2020, p.128). The shareholder-centric model has been increasingly criticized for enabling corporate conduct that harms stakeholders – ranging from environmental degradation and labour exploitation to consumer manipulation. High-profile incidents such as the 2008 financial crisis, the Rana Plaza collapse and the Volkswagen emissions scandal have amplified concerns about the social costs of shareholder primacy Strine (Reference Strine2025, p.103).
These critiques are especially relevant in the context of AI governance. AI systems introduce new layers of complexity and risk that are not easily captured by traditional contractual frameworks. The deployment of AI can generate significant externalities – such as algorithmic bias, privacy violations, cyber-attacks and opaque decision-making – that disproportionately affect non-shareholding stakeholders. Moreover, the informational asymmetries inherent in AI technologies challenge the assumption of rational, well-informed market actors.
In this context, the limitations of shareholder primacy become more pronounced. A governance model focused narrowly on shareholder returns may incentivize the rapid adoption of AI without adequate safeguards, thereby amplifying systemic risks. The nexus-of-contracts theory offers little guidance on how to manage the ethical and distributive dimensions of AI deployment, particularly when affected stakeholders have no contractual relationship with the firm. From this perspective, stakeholder theory, discussed below, offers a more responsive framework for AI governance.
2.1.2 Stakeholder theory
Stakeholder theory, a foundational concept in organizational management and business ethics, offers a robust normative framework for rethinking corporate governance in the context of AI (Friedman & Miles, Reference Friedman and Miles2006). Traditionally advanced as a critique of shareholder primacy, stakeholder theory asserts that corporations must account for the interests of all parties affected by their activities – whether these interactions are voluntary (e.g., employees, suppliers, creditors) or involuntary (e.g., local communities, the environment) (Friedman & Miles, Reference Friedman and Miles2006, pp.4–10; Phillips, Reference Phillips2003, pp.119–154). In its normative form, the theory calls for a redefinition of corporate purpose: from the maximization of shareholder value to the creation of value for the corporation as a whole.
Under this theory, a corporation’s directors and officers must consider the interests of all stakeholders in their decision-making. In its managerial version, the theory is not very innovative since it is generally accepted that any successful company must manage its relationships with all its stakeholders, if only for the benefit of shareholders (Donaldson & Preston, Reference Donaldson and Preston1995, pp.70–71). In its normative version, on the other hand, stakeholder theory implies profound changes in corporate governance, requiring a reformulation of the objective pursued by corporations. Rather than being limited to maximizing profits in the interests of shareholders, the goal is to maximize the corporation’s value as a whole (Charreaux & Desbrières, Reference Charreaux and Desbrières1998). In other words, the notion of shareholder value is incomplete since the corporation’s activities affect its stakeholders.
This reconceptualization is particularly relevant in the governance of AI systems, whose deployment increasingly affects a wide array of stakeholders. AI technologies influence access to employment, credit, healthcare and public services, often through opaque and unaccountable processes. Stakeholder theory provides a principled basis for addressing these challenges by requiring that directors and officers consider not only the financial implications of AI adoption but also its broader societal and ethical consequences. From a governance perspective, this implies the need for formal structures and policies that reflect stakeholder concerns. These may include standards for data governance, algorithmic transparency, fairness and mechanisms for monitoring post-deployment impacts.
Moreover, stakeholder theory supports the inclusion of diverse perspectives in corporate oversight. This may take the form of stakeholder representation on boards or the establishment of advisory committees with expertise in ethics, civil rights or affected communities (Strine, Reference Strine2025, p.107). Such institutional innovations would enhance the legitimacy and responsiveness of corporate decision-making in the face of rapidly evolving AI technologies.
Critics of stakeholder theory, such as Jensen, have raised concerns about its conceptual vagueness and the practical difficulties it poses for directors, particularly in balancing competing interests (Jensen, Reference Jensen2002). Others point out that the theory requires directors to engage in a delicate exercise of distributive justice, which is difficult to reconcile with the reality of the business world (Heath, Reference Heath2006). However, the complexity and societal reach of AI arguably demand precisely the kind of pluralistic and deliberative governance that stakeholder theory envisions. In this light, stakeholder theory is not only a critique of shareholder primacy but also offers a normative foundation for responsible AI governance.
2.2. Legal perspective
2.2.1 Corporate law: directors’ duties
2.2.1.1. Fiduciary duties
Directors have a fiduciary duty, i.e. a duty to act with loyalty and in good faith in the corporation’s best interest (Canada Business Corporations Act [CBCA], RSC, 1985, c C-44, ss. 102, 122; Civil Code of Québec, CQLR c CCQ-1991, s. 322; Quebec Business Corporations Act, CQLR c S-31.1, ss. 112, 119). In pursuing this objective, they must act with care and skill as a reasonable person would in similar circumstances.
For over a century, the shareholder primacy model has resonated in Canada within the interpretation of directors’ duty of loyalty (Crête & Rousseau, Reference Crête and Rousseau2018, para. 802; McGuinness, Reference McGuinness2017, §14.140). By following Anglo-American case law, Canadian courts considered that the corporation’s interest consisted essentially of shareholders’ interests (Palmer v. Carling O’Keefe Breweries of Canada Ltd., 1989). While it did not exclude consideration of stakeholder interests, this interpretation did limit directors’ discretion. Indeed, directors could only make beneficial decisions for stakeholders if they were in the interests of shareholders.
Since the Supreme Court of Canada’s rulings in Peoples Department Stores Inc. (Peoples, 2004, para. 67) and BCE (BCE, 2008), the shareholder primacy model has been set aside. In these two judgments, the Court offered an interpretation of the best interests of the corporation that emphasizes the status of the corporation as a legal person. From this, it follows, according to the Court, that “the directors’ duty is clear – it is to the corporation” (BCE, 2008, para. 37). Accordingly, “[t]he interests of the corporation are not to be confused with the interests of the creditors or those of any other stakeholders” (Peoples, 2004, para. 43). Thus, directors’ fiduciary duty is always directed to the company, a legal entity distinct from shareholders and stakeholders.
The best interest is a broad and contextual concept. Since it refers to the corporation as a going concern, the concept speaks to the company’s long-term interests as an ongoing concern (BCE, 2008, para. 38). For this reason, the duty of loyalty is “not confined to short-term profit or share value” (BCE, 2008, para. 38). According to the Supreme Court, from an economic perspective, the concept refers to “the maximization of the value of the corporation” (Peoples, 2004, para. 42). In simpler terms, it enjoins directors to act in such a way as to make the company a “better corporation” (Peoples, 2004, para. 41).
The reference to the maximization of corporate value suggests that the Supreme Court sought to account for the diversity of interests brought together in the corporation, thus echoing stakeholder theory. This is clear from the passage where the Court recognizes that “in determining whether they are acting with a view to the best interests of the corporation it may be legitimate, given all the circumstances of a given case, for the board of directors to consider, inter alia, the interests of shareholders, employees, suppliers, creditors, consumers, governments and the environment” (Peoples, 2004, para. 42). Recently, the Parliament amended the CBCA to reflect this perspective by expressly recognizing the power of directors to consider the interests of stakeholders, the environment and the long-term interests of society when acting in the corporation’s best interests (Canada Business Corporations Act, RSC 1985, c C-44, s. 102, 122(1.1)). Where conflicts arise between stakeholders’ interests or between the latter’s interests and those of the corporation, the Supreme Court remarked that “it falls to the directors of the corporation to resolve them in accordance with their fiduciary duty to act in the best interests of the corporation, viewed as a good corporate citizen” (BCE, 2008, para. 81). Eighteen years after BCE, what the expression “good corporate citizen” entails for directors seeking to balance conflicting interests remains elusive. Indeed, after having conducted an empirical analysis of the case law regarding the expression, Lin concluded that the legal significance of “good corporate citizen” is “largely more symbolic than substantive in judicial practices” (Lin, Reference Lin2021, p.569).
Against this backdrop, the rise of AI raises new questions for the scope and application of directors’ fiduciary duties. As they reflect on the best interests of the corporation in their decision-making process, directors will need to consider the economic benefits of adopting AI systems as well as the potential short-, medium- and long-term risks these technologies pose to the corporation’s legal, reputational and operational integrity. Indeed, the contextual nature of the fiduciary duty, as articulated by the Supreme Court in Peoples and BCE, implies that boards may legitimately weigh the perspectives of shareholders, employees, customers and regulators when evaluating AI strategies.
2.2.1.2 Duty of care
Under Canadian corporate law, directors have a duty to exercise the care that a reasonably prudent person would exercise in comparable circumstances. The expression “comparable circumstances” does not introduce a subjective dimension into the analysis of directors’ conduct that would make it possible to assess their personal characteristics and motivations. It only allows consideration of elements of the factual context in which directors operate, including their status, the size, type and financial situation of the corporation, as well as the transactional or operational setting.
As part of directors’ duty of care, case law has recognized the existence of a duty to monitor the business and affairs of the corporation, including its officers. In this respect, courts have ruled that directors were allowed to trust the officers to whom they delegate the management of the day-to-day activities of the corporation, recognizing that “[t]he business of life could not go on if people could not trust those who are put into a position of trust for the express purpose of attending to details of management” (Dovey v. Cory, 1901). Thus, in the absence of any reason to doubt the integrity of management, directors are justified in placing their trust in management (Blair v. Consolidated Enfield Corp., 1995; Wightman v. Widdrington (Succession de), 2013, para. 406).
Canadian courts have also recognized that the monitoring duty included an “institutional” duty of oversight that speaks to information and internal control mechanisms designed to enable directors to obtain information on the activities of the corporation and its executives. Although it is not as developed as the U.S. Caremark duties (Padley v. SSR Mining Inc., 2025), the institutional duty of oversight developed by Canadian courts shares similar requirements (Re Cartaway Resources Corp, 2000; Re Standard Trustco Ltd., 1992; Varrocci v. Tsovikian, 2010; Re YBM Magnex International Inc., 2003). Thus, directors must remain apprised of the company’s affairs and refrain from placing blind trust in its officers and employees. To this end, they must ensure that adequate information and internal control mechanisms are in place. In particular, corporate oversight mechanisms should aim to provide them with reasonable assurance as to the effectiveness of management, the integrity of financial reporting and the compliance of activities with regulations.
In the context of AI, these principles take on heightened significance. The deployment of AI systems across core corporate functions – whether in financial reporting, customer relations, operational logistics or compliance – introduces novel risks of error, bias, opacity and regulatory breaches that directors cannot ignore (Deloitte, 2025, p.2). The duty of care requires that boards not only inquire into the adoption and use of such systems, but also ensure that adequate governance structures exist to assess their reliability, explainability and alignment with the corporation’s risk appetite and regulatory obligations (Kourabas & Tsang, Reference Kourabas and Tsang2025, pp.28-29). Directors cannot discharge their obligations by simply deferring to technical experts; rather, they must demand clear reporting lines and monitoring mechanisms capable of surfacing AI-related risks in a timely manner. In this respect, the duty of oversight extends to the design and implementation of internal controls specifically tailored to AI, including protocols for auditing algorithmic outputs, managing data integrity and ensuring compliance with emerging legal frameworks (Ge, Reference Ge2024, p.130; NACD, 2023, p.13).
Furthermore, given the accessibility and evolving capacities of AI tools, the duty of care standard may be altered (Helleringer & Möslein, Reference Helleringer and Möslein2025). Indeed, AI allows directors to make informed decisions, as it can process large amounts of data quickly, provide summaries and key insights, and even challenge directors when making strategic decisions (Paredes, Reference Paredes2025, p. 7). When courts inquire into what a reasonable director would do in comparable circumstances, they might consider whether the board used all available tools in order to make an informed decision. In other words, given that the duty of care is not static, boards should remain mindful of the ways AI can make the board more efficient.
2.3. Best practices
2.3.1. Recommendations from the Canadian Securities Administrators
In Canada, the Canadian Securities Administrators (CSA) developed a CGF in 2005 that has been adopted by provincial securities regulators and that is based on the comply-or-explain approach (Salterio et al., Reference Salterio, Conrod and Schmidt2013). Specifically, National Policy 58-201 (NP 58-201) provides guidelines that reflect good governance practices applicable to reporting issuers, i.e., listed companies (Policy Statement 58-201 to Corporate Governance Guidelines, 2005). Reporting issuers are not required to adopt the listed governance practices. Instead, as mandated by Rule 58-101, they must disclose their governance practices in the proxy statement sent for annual shareholder meetings, explaining any discrepancies with the recommendations set out in the guidelines (Regulation 58-101 respecting Disclosure of Corporate Governance Practices, RLRQ c V-1.1, art. 2.1, Form 58-101F1). This disclosure is subject to monitoring by regulators who periodically review its quality.
The choice in favour of a comply-or-explain approach for dealing with governance practices can be traced back to 1992, with the Cadbury Report (Committee on the Financial Aspects of Corporate Governance, 1992) embracing it, followed by the Dey Report in Canada (Toronto Stock Exchange Committee on Corporate Governance in Canada, 1994). Subsequently, as Canadian securities regulators claimed jurisdiction over governance practices, they also espoused that approach in order to “be sensitive to the realities of the greater numbers of small companies and controlled companies in the Canadian corporate landscape.”
While the CSA have remarked in NP 58-201 that they “recognize that corporate governance is evolving” and that they “take into account the impact of corporate governance developments in the U.S. and around the world,” the core set of best practices adopted in 2005 has not been revised, save with respect to gender diversity. Thus, neither environmental and social issues (the “E” and “S” of ESG), nor issues pertaining to AI have hitherto been addressed by the instrument.
2.3.2. Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems
In 2023, Innovation, Science and Economic Development Canada published the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems (Innovation, Science and Economic Development Canada, 2023) (hereafter the “Voluntary Code”) in response to the rapid rise of generative AI. The initiative was framed as an interim governance measure pending the adoption of the Artificial Intelligence and Data Act, introduced as part of Bill C-27, which has died on the Order Paper in Winter 2025.
The Code was developed in collaboration with industry, civil society and academia to encourage best practices for the safe, ethical and responsible development of advanced generative AI systems. It is inspired by and aligns with international frameworks such as the G7 Hiroshima Process International Guiding Principles and the OECD AI Principles. While non-binding, the Voluntary Code signals regulatory expectations and provides a governance blueprint that firms may adopt in anticipation of future legal requirements.
The Voluntary Code outlines seven commitments to guide responsible AI practices:
1. Accountability – Organizations understand their role with regard to the systems they develop or manage, put in place appropriate risk management systems and share information with other organizations as needed to avoid gaps.
2. Safety – Systems are subject to risk assessments, and the mitigations needed to ensure safe operation are put in place prior to deployment.
3. Fairness and Equity – Potential impacts regarding fairness and equity are assessed and addressed at different phases of development and deployment of the systems.
4. Transparency – Sufficient information is published to allow consumers to make informed decisions and experts to evaluate whether risks have been adequately addressed.
5. Human Oversight and Monitoring – System use is monitored after deployment, and updates are implemented as needed to address any risks that materialize.
6. Validity and Robustness – Systems operate as intended, are secure against cyber attacks, and their behavior in response to the range of tasks or situations to which they are likely to be exposed is understood.
For boards of directors and senior management, the Voluntary Code may serve as a benchmark for emerging expectations in AI oversight. As it is voluntary, the Code complements – but does not substitute – other legal and soft law instruments.
2.3.3. CSA Staff Notice and Consultation 11-348 and sectoral regulatory instruments
Alongside NP 58-201, two categories of domestic regulatory instruments are directly relevant to the governance of AI by listed companies and deserve prominent treatment within the legal framework.
First, in December 2024, the CSA published CSA Staff Notice and Consultation 11-348 on the applicability of Canadian securities laws and the use of AI systems in capital markets (CSA Staff Notice 11-348, 2024). This instrument signals that Canadian securities regulators have begun to grapple seriously with the intersection of AI and listed-company governance obligations. The Notice does not create new binding rules, but it articulates staff’s interpretation of how existing disclosure obligations and governance expectations under securities law apply when companies develop or deploy AI systems. Most significantly for present purposes, CSA Staff recommended that issuers establish clear governance practices, including accountability structures, risk management protocols and board-level oversight mechanisms, with respect to AI systems used in their business. The Notice also raises a series of consultation questions regarding whether existing rules suffice or whether new or amended rules should be introduced, including whether to adopt specific governance standards developed by international organizations and standard setters. Given the direct relevance of CSA Staff Notice 11-348 to the duties of directors and the disclosure obligations of listed companies, it will be further discussed in Part IV.B in connection with the normative recommendations.
Second, sectoral financial regulators have also issued instruments with direct implications for AI governance. The Office of the Superintendent of Financial Institutions (OSFI) is particularly relevant for federally regulated financial institutions, which represent a significant portion of the TSX 60. OSFI’s Guideline E-23 on Model Risk Management, first issued in 2017 and updated in subsequent years, establishes expectations for the development, validation, and governance of models used in financial decision-making, a category that encompasses many AI and machine-learning systems (Office of the Superintendent of Financial Institutions, 2025). More broadly, OSFI has signalled its expectation that boards of directors play an active role in overseeing model risk, including through appropriate expertise at the board and committee levels. These sectoral instruments complement the securities regulatory framework and together define a layered normative environment within which TSX 60-listed companies must navigate their AI governance obligations.
3. Development and use of AI: a look at TSX 60-listed companies’ governance and practices
3.1. Background on the risks associated with the development and use of AI
The potential risks associated with AI have been a subject of much discussion and documentation over the years, particularly since the release of ChatGPT-4 in 2023 and the emergence of advanced generative AI systems. The democratization effect of this technology became a real phenomenon, which had consequences for businesses, governments and people more broadly, making them more aware than ever of the advantages and risks of generative AI – as well as advanced forms of AI (machine learning and deep learning).
Different frameworks exist for presenting AI risks, which are useful for organizing business practices as well as AI research and policy strategies in a manoeuvrable and systematic way. As a first example, risks can be presented on a temporal continuum, with short-, medium- and long-term risks. The short-term risks include, among others, immediate and well-recognized impacts on human rights (privacy, equality and non-discrimination, freedom of expression, security, intellectual property, etc.). The medium-term risks include, among others, impacts on the future of work (job losses and workforce transformation), the environment (energy and water consumption), the future of democracies (e.g. accelerated disinformation campaigns) and the protection of key institutions like banking systems (e.g. AI-enabled hacking and fraud). While impacts in such a category have already started, they will be more transformative in the medium term. The longer-term impacts notably come with increasingly sophisticated forms of agentic AI, which are systems that can “autonomously act, plan, and delegate to achieve goals with little to no human oversight” (Bengio et al., Reference Bengio2025, p.13), a quest that various tech companies are openly pursuing. Such a form of AI can create a greater risk of losing control of and accountability for the technology in the upcoming years. The continuum framework is not without its limitations; the frontiers between short-, medium- and long-term often become blurred and overlap when considering the rapid pace of worldwide AI development.
As a second example, AI risks can be conceptualized using an impact-gradient framework, ranging from low to high risks, which is called a risk-based approach. This approach is embedded in the AI Act adopted by the European Union in 2024 (AI Act, 2024) and the now-dead Bill C-27. It is designed to categorize AI risks according to their potential impact on people’s health, safety and fundamental rights, such as their capacity to access essential services or to avoid being subject to inappropriate manipulation, surveillance or exploitation. It can also cover consideration of broader social impacts, for instance on democracy and the environment. The approach, quite explicit in the AI Act, then adapts the associated prevention and oversight requirements for AI providers, users and deployers in a proportionate manner (more risks, more requirements to prevent, document and mitigate).
As a last example, risks can be classified based on the following three categories: malicious use risks, risks from malfunctions and systemic risks. This is the classification chosen in the International AI Safety Report, published in January 2025 (Bengio et al., Reference Bengio2025, p.13). Malicious use risks refer to the use of AI by actors to purposefully harm individuals, organizations or society. They cover producing fake content to harm individuals, such as financial fraud through voice impersonation, blackmail, extortion, sabotage of professional reputation, etc. Risks from malfunctions cover unintended harm caused by system issues, such as reliability problems (the systems produced inadequate content or generate answers with falsehoods) or biased outputs (see below). Systemic risks cover the broad social impacts previously highlighted, such as labour market and environmental risks. While other risk frameworks exist – and can vary depending on what type of AI they refer to – these three are particularly salient in many policy conversations in Canada and elsewhere.
While these frameworks help navigate the AI risk landscape and could be helpful to guide businesses, we can mention in more detail some of the specific risks that businesses need to pay attention to. These risks can impact the operations, liability and reputation of businesses on various fronts if not managed adequately. First, there are algorithmic biases that can be embedded in the data used to build AI systems (unrepresentative datasets, historical data, etc.) or in the parameters used to create the algorithms (which can reproduce stereotypes, historical biases or proxies that lead to discriminatory outputs). There have been some vivid examples of such biases that led to discriminatory results in hiring, lending and customer service in businesses worldwide (Atkinson & Collins, Reference Atkinson, Collins, Quintavalla and Temperman2023). Second, there are the data privacy and security risks, as many AI systems require access to large volumes of personal and sensitive data, or more broadly, data that, when aggregated, can lead to identifying people. As such, cyberattacks, improper handling or unauthorized access to data could lead to data breaches that expose confidential information, damage trust with consumers and employees and lead to violations of privacy or other laws. Third, AI-generated content, notably with general-purpose AI, trained on large data collections, often coming from the internet (some of which can be protected by copyrights or intellectual property rights), can then be used to generate text, images, audio or videos that resemble the content on which they were trained (Bengio et al., Reference Bengio2025, p.13). This can create, knowingly or not, copyright and intellectual property issues that can lead to legal, reputational or financial risks; for instance, if businesses lose credibility or the benefits of their innovation in such contexts. These are only a few illustrations of the current AI risk landscape.
There have been ongoing efforts to improve our understanding of AI risk based on current and future AI developments. The research, business and policymaker communities in Canada and elsewhere are working through various distinct and collaborative initiatives to better understand AI risks and mitigation strategies. These strategies are intended for immediate and forthcoming implementation. The Canadian AI Safety Institute and similar institutes in France, Japan, the United Kingdom and other countries are specifically working on this issue. Despite this evolving background, three elements remain relatively clear in the context of AI risks: First, it is important to acknowledge the reality of these risks and the necessity of meticulous attention and effective governance mechanisms to proactively mitigate their repercussions. Second, in light of AI’s continuous evolution, businesses, policymakers and citizens must remain vigilant and well informed of their advancements. Third, the extensive range of AI risks poses a potential impact on a wide array of stakeholders, including consumers, employees, managers and communities.
It is noteworthy that pressing concerns regarding AI risks may have led to the emergence of a new category of risk, which is now being addressed by the Canadian government and other stakeholders, such as the OECD.Footnote 1 This risk is the low adoption of AI at the government and business levels, which is a reality in Canada.Footnote 2 In 2025, despite an increase from previous years, 12.2 percent of Canadian businesses declared having used AI to produce goods and provide services and when comparing the adoption rate by sectors, we note that information and cultural industries, as well as finance and insurance, remain among the leading ones, gravitating around 35 and 30 percent (Bryan et al., Reference Bryan, Sood and Johnston2025). This low rate of adoption aligns with a 2025 global study, which ranked Canada 41st out of 47 surveyed countries regarding the percentage of individuals using AI at work (KPMG, 2025, p.73). This risk could hinder Canadians and businesses from fully leveraging AI advancements and the opportunities the technology offers. For businesses, this means that they may become less competitive in national and global markets and less resilient in an increasingly technological and competitive world – especially compared to more tech-savvy competitors (Kergroach & Hérétier, Reference Kergroach and Hérétier2025). Some of the challenges they may face include difficulty attracting and retaining talent, adapting to and innovating with technology (in product development and efficiency gains, for instance), and developing business opportunities.
In addition, boards’ perception of AI seems to be fundamentally flawed. Directors tend to focus primarily on mitigating AI risks and avoiding liability rather than identifying opportunities and leveraging AI to gain strategic advantages. In fact, a recent Canadian study conducted among board members of private and public companies found that when discussing corporate strategy, 86 percent of respondents indicated that AI is not a recurrent topic of discussion, and 22 percent of respondents mentioned it was never even talked about in this context (Hartmann & Hartmann, Reference Hartmann and Hartmann2026, p.5). In the current era of AI, such findings are concerning for Canadian businesses and the Canadian economy, as businesses using AI effectively are likely to remain more competitive in global markets. It is thus imperative for companies to strike a balance between managing risks and leveraging AI to enhance corporate efficiency. A comprehensive and agile governance strategy is essential for achieving this objective. A comprehensive and agile governance strategy is essential for achieving this objective.
In conclusion, the foregoing risk taxonomy (spanning cybersecurity, data privacy, reputational harm, regulatory uncertainty and ethical concerns) provides the analytical grid against which the empirical findings presented in the next section are assessed. A key question animating the empirical study is whether, and to what extent, the governance structures and disclosures of TSX 60 companies are calibrated to address the specific risk categories identified in the literature. As will become apparent, the fit between recognized risk categories and disclosed governance responses is uneven: cybersecurity and data privacy risks are relatively well reflected in corporate filings, while risks relating to algorithmic bias, autonomous decision-making and workforce displacement, though prominent in academic and policy discourse, remain largely absent from corporate disclosures.
3.2. Empirical study
3.2.1. Methodology
We sought to gain a better understanding of how boards of directors of large publicly listed companies deal with AI-related risks and opportunities. To do so, we compiled the disclosure documents of the companies forming the TSX 60 index, using the SEDAR+ database. Using the disclosure documents, we created a structured Excel-based dataset classifying corporate governance practices with respect to AI (board literacy, internal monitoring, board training, use and development of AI, etc.). We also conducted a textual content analysis of risk factor disclosures related to AI in public filings. This allowed us to gather data serving to assess the state of AI governance in Canada’s largest listed companies by measuring the extent of proactive oversight, the nature of risk perception and the sectoral distribution of these patterns.
More specifically, the following types of disclosure documents available on SEDAR+ were analysed for each of the TSX 60 constituent companies as of December 2024: annual information forms, annual reports (management’s discussion and analysis), management information circulars (proxy statements), and, where available, standalone sustainability or corporate governance reports published for fiscal years 2023–2024. Where a company’s fiscal year did not align with the calendar year, the most recently filed annual documents were used. In total, the corpus comprised approximately 240 disclosure documents.
The structured Excel-based dataset was built around six coding dimensions: (i) recognition of AI as a material risk factor; (ii) existence of board-level AI oversight mechanisms (dedicated committee or revised committee mandate); (iii) evidence of director AI’s literacy (defined according to the criteria set out below); (iv) disclosure of formal AI use or development by the company; (v) evidence of board education or training on AI; and (vi) existence of a company-wide AI policy or code of conduct. Each dimension was coded as present, absent or indeterminate based on explicit textual references.
Several important methodological limitations must be acknowledged upfront. First, the analysis is based exclusively on what companies chose to disclose; absence of disclosure should not be equated with absence of practice. A company may have a functioning AI governance structure without disclosing it in regulatory filings, either because disclosure was not deemed material or because no specific obligation compelled it. Accordingly, our findings are best understood as measuring the state of AI governance disclosure rather than the full range of underlying governance practices. Second, disclosure documents are drafted for regulatory and investor relations purposes, which may lead to selective or strategic presentation of information. Third, the study does not capture informal governance dynamics, such as how boards actually deliberate on AI issues in practice, nor does it reflect changes occurring after the document’s filing dates. These limitations call for caution in interpreting our results and suggest that qualitative follow-up research, including interviews with directors and senior officers, would be valuable to complement the picture drawn from public filings.
3.2.2. Results
The analysis of the Excel data provided a detailed snapshot of the maturity and variability of AI governance practices among TSX 60-listed companies. The charts (pie and bar graphs) reveal several important patterns.
3.2.2.1 Recognition of AI as a risk factor
Of the 60 companies forming the index, 45 explicitly identify AI as a material risk factor in their regulatory filings, as shown in Figure 1.
AI as a risk factor.
As AI use and development become more widespread, it is likely that all companies will list it as a risk factor. Indeed, over and above securities regulation disclosure requirements, emerging best practices emphasize that effective AI governance begins with formally recognizing AI-related risks in enterprise risk management (ERM)frameworks.
A review of the risk disclosures across companies’ filings allowed for the identification of recurring AI-related risk themes. The following five themes emerged most frequently as risk factors:
• Cybersecurity Risks: By far the most cited category, mentioned in over 70 percent of cases in which AI risks were disclosed. Companies perceive AI as a potential attack vector or amplifier of existing cyber vulnerabilities.
• Data Privacy and Protection: Often co-occurring with cybersecurity, this theme reflects increasing concern over compliance with global data protection laws.
• Regulatory and Legal Uncertainty: Many companies noted the unsettled and evolving legal landscape as a material risk.
• Reputational Harm: Firms are increasingly aware that failures in AI implementation – especially those involving bias or opacity – may damage public trust and investor confidence.
• Lack of Technical Governance or Expertise: Some disclosures mentioned internal knowledge gaps, lack of risk mitigation tools or unclear accountability structures related to AI.
Notably absent in many filings are mentions of generative AI, algorithmic misinformation or autonomous decision-making risks, despite their prominence in academic and policy discourse. It is also worth pointing out that there is little discussion regarding the competitive threats or business model disruption arising from AI in the risk disclosures of TSX 60 companies.
3.2.2.2 Board monitoring mechanisms
As Figure 2 indicates, only slightly more than half of TSX 60 companies disclosed having established a form of AI oversight at the board level, either through the creation of a dedicated AI committee or by the revision of a board committee’s mandate.
AI board oversight.
These results may be explained by the fact that AI is an item addressed by the whole board. Still, these results remain puzzling to the extent that 75 percent of the companies surveyed did disclose AI as a risk factor.
3.2.2.3 AI committees
Only two TSX 60 companies reported the existence of a board committee with a specific mandate related to AI, as shown in Figure 3. While this low adoption rate may indicate a limited degree of formal institutionalization, it may also reflect a deliberate governance choice. Some boards may prefer not to create standalone AI committees to avoid fragmenting oversight responsibilities (“balkanization”) and instead opt to integrate AI-related issues into the mandates of existing committees – such as those focused on risk, audit or technology. This integrated approach aligns with the view of AI as a transversal issue that intersects with multiple areas of corporate governance.
AI board committee.
Rather than creating a board committee dedicated to AI, Figure 4 shows that about 10 percent of TSX 60 companies disclosed that they have established a management committee in charge of AI.
Management committee.
3.2.2.4 Board AI literacy
The proportion of board members in TSX 60-listed companies with demonstrable expertise, experience or training in AI or data science is remarkably low, with only 5 percent of directors having AI literacy, as indicated in Figure 5. For our purposes, we used a rather liberal definition, considering that a director has AI literacy when any of the following applies: (i) current or past employment with companies in AI or a relevant industry; (ii) current or past employment positions relevant to the AI industry; (iii) board membership with companies in AI or a relevant industry; (iv) certification in AI; and (v) employment titles related to AI.Footnote 3
Director AI literacy.
A ranking of the top 5 or 10 companies with the highest percentage of AI-literate directors reveals sectoral concentration: tech companies lead the way, while financial institutions – despite their data-heavy operations – lag behind.
3.2.2.5 Use and development of AI tools
About 40 percent of companies formally disclose the use of AI in their operations, as shown in Figure 6. This figure likely understates the informal use of AI by employees, a phenomenon labelled shadow AI use, which raises cybersecurity and data risks, and may lead to intellectual property leakage (Farrar, Reference Farrar2025).
Use of AI.
In contrast, Figure 7 shows that less than 10 percent of companies disclose that they are developing AI. Most likely, this figure will evolve in the coming years as AI becomes embedded in companies’ activities and operations.
AI development.
3.2.2.6 Board education
Despite the ubiquitous nature of AI, Figure 8 reveals that a little more than half of TSX 60 companies have disclosed that their boards had received a presentation or training on AI.
Board education.
3.3. Discussion
Our results show that there is a widespread recognition of AI as a risk factor. We note that the identification of AI as a material risk in companies’ disclosure documents varies across industries, with the banking sector leading the group. This trend reflects increasing awareness that AI systems can pose strategic, operational, reputational, ethical and legal risks. More specifically, we note that TSX 60-listed companies have identified AI risks that are in line with those emphasized by the literature, although not all of them. That being said, risk disclosure tends to be general, if not generic, with few companies providing granular detail on how AI risks are quantified or mitigated. In a way, companies appear to treat AI as a black box risk. This may be attributed to the lack of guidance on the part of securities regulators, or other regulators, and the novelty of AI use.
A second key observation emerging from our findings is that corporate disclosure documents offer limited insight into the formal structures overseeing AI development and use. Although AI is increasingly recognized as a strategic risk, governance disclosures suggest that boards are still in the process of formalizing oversight responsibilities. In addition, less than 50 percent of companies have explicitly assigned this responsibility to a board committee. While ultimate board-level oversight aligns with directors’ fiduciary duties, the growing complexity and workload associated with AI governance – especially as adoption accelerates – would justify delegating this mandate to a committee tasked with the mandate of monitoring AI-related risks and reporting regularly to the board. As one author notes, “Some aspects of AI oversight and governance might be relevant for the full board – those topics that are generally more pervasive – while some might be more appropriate for a committee to handle” (Abrash et al., Reference Abrash, Probst and Edelman2024).
Relatedly, we note that few boards currently have a significant number of AI-literate directors. This finding reflects a general trend regarding the difficulty of recruiting directors with AI expertise. It may also mean that “many companies are prioritizing bringing a diverse range of skills and backgrounds to their boards, rather than solely focusing on bringing digital transformation and AI knowledge and experience” (Abrash et al., Reference Abrash, Probst and Edelman2024).
Finally, our review of public disclosures by TSX 60 companies reveals that, while a few firms – particularly in the tech and financial sectors – have adopted internal frameworks to govern AI use, two-thirds do not report having formal, company-wide AI policies. In this respect, it is worth noting that about 5 percent of TSX 60 companies have adhered to the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems presented above. In any case, if such policies do exist, their disclosure would be highly valuable, as shareholders and stakeholders increasingly seek clarity on whether companies have codified standards for data governance, model explainability, accountability mechanisms and post-deployment monitoring.
Our findings accord with a Canadian survey study on boards, which found that only 35 percent of respondents rated themselves as being either proficient (28%) or expert (7%) in AI (Hartmann & Hartmann, Reference Hartmann and Hartmann2026, p.4). However, while we found that 58 percent of boards received some sort of AI training, the same Canadian study found that 64 percent of the surveyed boards never received any training (Hartmann & Hartmann, Reference Hartmann and Hartmann2026, p.8). This gap may be attributed to the fact that boards of public companies are under more pressure to effectively oversee the integration of AI within their organizations.
To summarize, we find that even if AI has already entered the boardroom, it has not entered the “corporate governance architecture” of companies.
The gap between recognition and formalization is well illustrated by contrasting the practices of leading companies within the TSX 60 with the median. Among the most advanced in terms of disclosed AI governance, financial institutions and technology companies stand out. Several major Canadian banks have publicly disclosed that their boards receive regular briefings on AI risks, that AI oversight has been formally assigned to their risk and audit committees, and that senior management positions with specific AI or digital risk accountability have been created. Some have also adopted publicly available AI principles or codes of conduct applicable to the use of AI in lending, fraud detection and customer service applications. This level of institutionalization is, however, the exception rather than the rule across the TSX 60. The majority of companies in other sectors have taken no publicly visible steps toward formalizing AI governance, despite acknowledging AI as a risk factor. This sectoral disparity underscores that the absence of regulatory expectations is not merely a theoretical gap: it translates into concrete variation in the quality of corporate AI governance across the landscape of Canadian-listed companies.
The cost of this governance gap is not merely hypothetical. The literature and regulatory record document a number of AI-related incidents with material consequences for listed companies, illustrating the concrete risks that inadequate board oversight fails to mitigate. In the financial sector, algorithmic pricing and lending models have been found to produce discriminatory outcomes in multiple jurisdictions, generating regulatory investigations, remediation costs and reputational damage. In the retail and consumer sector, facial recognition and automated customer profiling systems have triggered privacy investigations and consumer backlash. Perhaps most directly relevant to board oversight, several companies have faced investor and shareholder scrutiny specifically because their governance disclosures failed to adequately account for AI-related risks, a dynamic that is increasingly reflected in the shareholder proposal activity documented in Part IV.A. These examples illustrate that the question is not whether AI governance failures can have material consequences for listed companies and their stakeholders, but when and in what form those consequences will manifest.
4. Toward governance best practices for Canadian-listed firms?
4.1. A survey of AI governance best practices
AI is increasingly embedded in corporate strategy, operations and decision-making. This generates expectations vis-à-vis boards of directors regarding their monitoring function. Thus, many are of the view that the transformative potential of AI demands a revision of traditional governance practices. Below, we survey positions on best practices from various key perspectives.
4.1.1. Academic and professional perspectives
Our review of the academic and professional literature leads us to identify seven recurring themes regarding best practices.
A first recurring theme is the importance of enhancing board-level AI fluency so as to enhance oversight capacity and signal to stakeholders a commitment to responsible innovation. While general digital literacy is necessary, AI-specific literacy is increasingly viewed as critical for effective oversight (Abrash et al., Reference Abrash, Probst and Edelman2024; International Corporate Governance Network, 2024). Boards should ensure that their composition reflects the complexity of the technological landscape. This can be achieved through a number of well-known governance strategies such as board refreshment and succession planning so as to foster the recruitment of directors with relevant background in AI, data science and ethics (Institute of Directors, 2025). To compensate for their limited expertise, boards can also have recourse to external advisors or advisory committees (Giunta & Suvanto, Reference Giunta and Suvanto2024).
A second theme relates to director education and continuous learning in order to allow directors to face the fast-changing environment created by AI. In fact, as directors get more educated on AI, boards are more inclined to use AI for business strategy, and higher levels of board AI literacy are also associated with stronger risk oversight and improved preparedness for workforce impact (Hartmann & Hartmann, Reference Hartmann and Hartmann2026, p.4). Structured learning opportunities identified include workshops, simulations and scenario planning to expose directors to real-world AI use cases, board development sessions with AI specialists and ethicists, on-the-job learning through direct interaction with AI tools and systems (Institute of Directors, 2025; International Corporate Governance Network, 2024; Marks et al., Reference Marks, Abrash and Probst2025).
A third theme discussed in the literature concerns governance structures. Commentators advocate a multilayered approach to improve such structures, encompassing measures such as
• Having dedicated AI or technology committees to centralize oversight and reporting (Hickman & Petrin, Reference Hickman and Petrin2021; Montagnani & Passador, Reference Montagnani and Passador2022);
• Integrating AI oversight into existing committees, such as audit or risk committees, where appropriate (Giunta & Suvanto, Reference Giunta and Suvanto2024);
• Appointing a Chief AI Officer or equivalent executive to coordinate AI strategy, compliance and risk management (Schmitt, Reference Schmitt2024).
More generally, commentators recommend that boards delineate responsibilities across the C-suite, so as to ensure that AI governance is not fragmented (PwC, 2024). Stated differently, a single point of accountability can enhance coordination and reduce oversight gaps.
Fourth, commentators stress that the novel risks introduced by AI call for their integration into the companies’ ERM framework (International Organization of Securities Commissions, 2025; Mignault & Rousseau, Reference Mignault and Rousseau2024). To be sure, the role of boards is not to establish their companies’ ERM framework, but rather, as part of their fiduciary duties, to provide oversight and guidance to ensure risks are effectively managed (Armour & Eidenmueller, Reference Armour and Eidenmueller2020; Brand, Reference Brand2024; Else & Pileggi, Reference Else and Pileggi2019). In doing so, boards should expect from management that they implement the ERM framework that involves periodic AI risk assessments, including scenario analysis and stress testing, and that allows for the monitoring of high-risk AI systems, particularly those with self-learning capabilities (Hong Kong Monetary Authority, 2019). Relatedly, others call for boards to extend oversight to the ethical issues raised by AI by establishing an AI ethics committee or appointing a chief AI ethics officer (Minevich & Rossi, Reference Minevich and Rossi2021).
A fifth theme relates to the stakeholder view of the corporation. It encompasses proposals to ensure that AI governance is stakeholder-inclusive. For instance, it is recommended that boards identify key stakeholder groups affected by AI systems, including employees, customers and communities, so as to consider their interests in decision-making (Abrash et al., Reference Abrash, Probst and Edelman2024). In order to do so, boards are encouraged to “institute processes for external engagement in order to consider feedback when developing internal frameworks for risk management and responsibility” Chiu and Lim (Reference Chiu and Lim2021). In fact, few companies have an active AI stakeholder engagement strategy in place (Hartmann & Hartmann, Reference Hartmann and Hartmann2026, p.11).
From a different angle, another theme stresses the need for boards to be cognizant of the strategic opportunity that AI generates. To that end, boards should pay attention to how AI adoption aligns with long-term corporate objectives. This involves measures such as ensuring that AI has its place on the board agenda as a recurring strategic item (Abrash et al., Reference Abrash, Probst and Edelman2024), evaluating AI maturity across the organization to guide investment and innovation (Marks et al., Reference Marks, Abrash and Probst2025), and aligning AI initiatives with business transformation goals, including talent development and operational agility. To summarize, this theme emphasizes the importance of boards not treating AI as a siloed technical issue and instead integrating it into broader discussions of competitiveness, resilience and value creation. As studies have shown, boards generally need a critical mass of like-minded individuals to meaningfully change the board’s culture and recurring discussions (Konrad et al., Reference Konrad, Kramer and Erkut2008). Accordingly, boards should put an emphasis on collective AI competencies, either by recruiting multiple AI-literate individuals or by prioritizing AI training for existing directors.
A last theme of interest pertains to compliance and legal accountability. It speaks to the changing regulatory landscape as various initiatives are put forward to deal with the challenges raised by AI. Put simply, as AI regulation evolves globally, boards must stay abreast of legal developments: “Boards must understand how national policy, international standards, and foreign legislation may impact their business operations, directly or indirectly” (Institute of Directors, 2025, p.8). To do so, boards are well advised to stay informed of applicable laws and standards, such as data protection regulations and sector-specific AI rules. They should also inquire as to whether appropriate compliance frameworks are in place, including policies, procedures and training.
4.1.2. Private ordering
4.1.2.1 Proxy voting advisors
As AI becomes increasingly central to corporate strategy and operations, institutional investors and proxy advisory firms are sharpening their expectations regarding board oversight. In this section, we concentrate on the guidelines issued by the two most influential proxy voting advisors: ISS and Glass Lewis. Proxy voting advisors play a central role in shaping governance practices by advising investors on how to vote on shareholder proposals and director elections, based on an assessment of governance risks and alignment with best practices (or guidelines) they publish. While their role is criticized, their influence is notable and extends to emerging areas such as cybersecurity, diversity and increasingly, AI governance, where it encourages boards to demonstrate oversight of material technological risks.
Of the two firms, only Glass Lewis discusses the role of the board vis-à-vis AI. Indeed, for the 2025 proxy season, Glass Lewis has included a section of its 2025 Benchmark Policy Guidelines that deals with “board oversight of AI” and that articulates its expectations in this respect. Glass Lewis emphasizes that boards must be proactive in identifying and mitigating material risks associated with the development and use of AI. To that end, companies are encouraged to adopt robust internal governance frameworks that incorporate ethical considerations and ensure appropriate oversight mechanisms are in place. Glass Lewis, however, stops short of mandating a specific oversight mechanism, leaving it to the discretion of boards.
While it is important that these issues are overseen at the board level and that shareholders are afforded meaningful disclosure of these oversight responsibilities, companies should determine the best structure for this oversight. Glass Lewis’ benchmark policy recognizes that this oversight can be effectively conducted by specific directors, the entire board, a separate committee or be combined with the responsibilities of a key committee (Glass Lewis, 2025, p.24).
Boards should address any skill gaps by investing in director education or appointing individuals with relevant AI expertise.
Furthermore, Glass Lewis expects companies to provide transparent disclosure regarding the board’s role in overseeing AI-related issues, including how directors are kept informed about this rapidly evolving domain. Such disclosure is seen as essential for enabling shareholders to assess the seriousness with which companies approach AI governance. While Glass Lewis does not prescribe a one-size-fits-all oversight structure, it acknowledges that effective governance may be exercised by the full board, a dedicated committee or through integration into existing board committees. In the absence of material incidents, Glass Lewis generally does not base voting recommendations solely on AI oversight or disclosure.
However, where there is evidence that inadequate oversight or mismanagement of AI has caused material harm to shareholders, Glass Lewis will closely examine the company’s governance practices. This includes identifying which directors or committees were responsible for AI oversight and evaluating the board’s response and related disclosures. If the board’s actions are found to be insufficient, Glass Lewis may recommend voting against the relevant directors under its benchmark policy.
For its part, ISS does not yet have a standalone voting policy specifically dedicated to board oversight of AI. However, its thought leadership research and proxy-based analyses provide clear signals about how it expects boards to address AI governance. Indeed, in March 2025, it published the results of a survey on board oversight of AI by analysing the disclosure of S&P 500 companies between 2022 and 2024. The study focused on the type of oversight (specific committee oversight responsibility, director(s) with AI expertise, and/or an AI ethics board) and director expertise. It notes that “[a]rtificial intelligence will be a key focus for both investors and boards through the forthcoming U.S. annual meeting season and beyond, as investors seek to understand how this fast-evolving technology will impact companies and boards adapt and evolve to cope with emergent risks and opportunities” (ISS, 2025). Thus, it is foreseeable that ISS will issue some guidance on that topic for the 2026 proxy season.
4.1.2.2 Shareholder proposals
A shareholder proposal is a mechanism provided by corporate law that allows a shareholder to submit a recommendation to be voted on by shareholders at a company’s annual general meeting. These proposals typically address issues related to corporate governance, environmental and social responsibility, and executive compensation. While most proposals do not garner enough support to pass, many lead to negotiated outcomes. Companies may agree to adopt certain practices or improve disclosures in exchange for the withdrawal of a proposal. This process, known as “private ordering,” is a key feature of shareholder engagement. From this perspective, shareholder proposals are seen as instruments that contribute to the accountability of boards of directors.
According to Martin Lipton, the first shareholder proposals regarding AI governance were filed during the 2023 proxy season in the United States. The proposals called for disclosure on “the board’s oversight of AI and ethical guidelines on the use of AI, and scrutiny of board oversight on AI will only grow as this technology is woven into long-term strategy and business operations” (Lipton, Reference Lipton2024). Ever since, the number of AI-related proposals has grown with each proxy season. In addition to calling for disclosure, the proposals now ask “for specific attributions of board responsibilities aimed at improving AI oversight, as well as disclosures related to the social implications of the use of AI on the workforce” (Cavé et al., Reference Cavé, O’brien and Hearon2024).
In Canada, AI-related governance proposals appeared for the first time during the 2023 proxy season with the Mouvement d’éducation et de défense des actionnaires (MÉDAC) filing proposals at a number of companies recommending that the board of directors review the terms of reference of the governance committee and the risk management committee to include an ethical component regarding the use of AI. In the 2025 proxy season MÉDAC filed shareholder proposals with 14 companies, including banks, a large retailer and a telecommunications giant, demanding that they become signatories of the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems. As commentators note, “[a]lthough support for AI-related proposals remained relatively modest, ranging between approximately 2% and 17%, it is clear AI has become a core governance issue, demanding board-level attention and oversight” (Loiselle & Bernasconi, Reference Loiselle and Bernasconi2025).
4.1.3 Corporate governance codes
Corporate governance codes serve as key instruments of soft law in regulating corporate behaviour, particularly in jurisdictions that favour principles-based regulation over prescriptive statutory mandates (Gargantini & Siri, Reference Gargantini, Siri, Birkmose, Neville and Sørensen2023). Typically, governance codes are not prescriptive; rather, they rely on approaches such as “comply or explain” so as to offer companies flexibility to adapt best practices to their specific context while maintaining accountability to shareholders and the public. In Canada, as discussed above, the CSA have espoused this approach with NP 58-201 that proposes a list of best practices to listed issuers (“reporting issuers”). Those best practices have yet to be revised to take into account the implications of AI. Before discussing whether a revision of NP 58-201 is warranted in this respect, it is useful to look at the experience with corporate governance codes across jurisdictions.
From our survey of corporate governance codes at the international level, it appears that the situation is similar to that in Canada, with national codes only starting to refer to AI. For instance, the influential UK Corporate Governance Code, revised in 2024, does not refer directly to AI or machine learning technologies (Financial Reporting Council, 2024). The Code remains focused on principles of board leadership, division of responsibilities, composition, audit, risk and remuneration. However, the Financial Reporting Council (FRC), which is in charge of the Code, is starting to pay attention to the implications of AI-related risks for boards. For instance, the revised version introduced important enhancements to internal control reporting, most notably through Provision 29, which broadens the definition of risk beyond financial and operational categories. This broadened scope – encompassing operational and strategic risks – creates a normative space where AI governance could be brought under board oversight. For example, if a company’s strategic use of AI includes high-impact tools such as customer-facing chatbots, algorithmic trading models or predictive analytics for hiring, these systems could fall within the remit of non-financial risk requiring board-level controls. More specifically, the FRC guidance notes accompanying the Code explicitly encourage boards to consider whether controls for emerging technologies such as AI are material to the company’s risk profile and therefore require board oversight and public reporting. Further, recent statements by the FRC signal a growing expectation that boards build internal capacity to assess and monitor the ethical deployment of AI (Financial Reporting Council, 2025, para. 272). This guidance builds on remarks made in the FRC’s 2023 Review of Corporate Governance Reporting that emphasized the importance for boards to “have a clear view of the responsible development and use of AI within the company and the governance around it” (Financial Reporting Council, 2023, p.58). The position of the FRC suggests that the governance framework is susceptible of evolving to recognize the relevance of AI-related risks to strategic oversight, stakeholder trust, and board responsibility.
Elsewhere, the Portuguese Corporate Governance Code provides a recommendation with AI as part of its chapter on internal controls that states that companies should inform in the corporate governance report “on the manner in which artificial intelligence mechanisms have been used as a decision-making tool by the corporate bodies” (Portuguese Institute of Corporate Governance, 2023, p.29). Similarly, with respect to internal controls, the Code of Corporate Governance of the Bucharest Stock Exchange states that the “Board and Audit Committee should understand emerging information technology and artificial intelligence-related changes so to mitigate cybersecurity risks” (Bucharest Stock Exchange, 2025, p.12). Further, “[t]ime should be given to the AI risks and opportunities and cybersecurity on Board agenda to ensure understanding of cyber protection” (Bucarest Stock Exchange, 2025, p.12). These two codes are cited not as influential models for Canadian governance, but precisely because of their scarcity value: they represent the rare instances where national corporate governance codes have explicitly incorporated AI-related provisions, making them instructive as early movers even if their direct normative weight outside their respective jurisdictions is limited. Their inclusion illustrates the kind of targeted textual intervention in existing governance codes that is available to the CSA should it choose to revise NI 58-201.
Lastly, it is worth pointing out the recent publication of the CGF developed by COSO in collaboration with NACD and PwC (Committee of Sponsoring Organizations, 2025). The framework aims to enhance transparency, accountability and long-term value creation by offering practical guidance that boards, executive management, shareholders and other stakeholders can tailor to their specific governance roles. The CGF is meant to serve as a flexible reference to assess, improve and align governance with strategic priorities, ethical conduct and stakeholder expectations. The CGF recognizes that AI introduces new and complex risks that require proactive governance, robust control structures and continuous monitoring. It notes that “[w]hile committees may oversee specific risk areas – such as cybersecurity, emerging technologies, or regulatory compliance – the full board retains oversight responsibility for strategic and enterprise-level risks” (Committee of Sponsoring Organizations, 2025, p.43). Internal controls are seen as essential to regulate the use of AI, ensure data integrity, prevent bias and ensure regulatory compliance. Specifically, the CGF establishes a distinction between the roles of board and management vis-à-vis AI and other technologies from a risk management perspective:
The board sets expectations for the responsible adoption and oversight of technology, emphasizing ethical considerations, risk mitigation, and compliance with relevant laws and regulations. Executive management establishes governance structures, policies, and procedures to assess and guide the deployment of technologies such as AI, machine learning, and blockchain. (Committee of Sponsoring Organizations, 2025, p.55)
To summarize, the CGF recognizes that AI introduces new and complex risks that require proactive governance, robust control structures and continuous monitoring, without being prescriptive as to the details of such risk mitigation instruments.
4.1.4. Others
Canadian businesses also need to be aware of the broader normative environment in which they evolve, despite the current absence of any specific AI legislation in the country. The Voluntary Code mentioned above is an example of norms they can adhere to gain some clarity on their governance model in this context. There is also a companion document named the Implementation guide for managers of AI systems that helps managers implement the Code and therefore gives additional information and orientation on how to act on it. Besides, Canadian businesses operating in the European Union will also need to comply with the AI Act as it applies to businesses conducted within its territories, like the General Data Protection Regulation applies to organizations that offer goods or services to European data subjects. This is, more broadly, an extraterritorial consideration that businesses need to keep in mind, depending on which jurisdictions they do business in. There is also an emerging set of AI standards that are being proposed at the national and international levels that can guide and influence corporate practices in Canada and elsewhere that management teams might want or need to track. As illustrations, the International Organization for Standardization (ISO) and the Institute of Electrical and Electronics Engineers (IEEE) have been actively producing such standards, including the ISO 42001, which proposes a structured approach to AI governance and risk management and the IEEE 2894-2024, which provides a blueprint for building, deploying and managing machine learning models that respect transparency and trustworthy AI. While not exhaustive, this description of the broader normative environment gives a sense of the multilayered governance reality in which Canadian corporations have to operate.
4.1.5. Summation
Considering the foregoing, Table 1 summarizes a list of best practices that are relevant to the boards of directors as they reflect on AI governance in the context of their businesses.
Summary of best practices
Table 1 Long description
Themes are listed with corresponding best practices and comments. Under Board composition, best practices are Director AI fluency and expertise with a comment to recruit at least three directors and use board refreshment and succession planning, External advisors with a comment to engage advisory committees or experts, and Appoint a Chief AI Officer (CAIO) with a comment to coordinate strategy, compliance, and risk. Under Board structure, Committees is paired with a comment to establish dedicated AI or Technology, Ethics, and AI Governance Committees. Under Director education, Continuous learning is paired with a comment to provide workshops, simulations, scenario planning, and direct AI tool interaction. Under Risk Management and Oversight, best practices are ERM integration with a comment to include AI risks in enterprise risk management frameworks, Periodic assessments with a comment to conduct scenario analysis, stress testing, and monitor high risk AI systems, Clear accountability with a comment to define roles across the C suite, and Regulatory oversight with a comment to monitor the evolution of regulatory frameworks. Under Ethical and Stakeholder Governance, best practices are Stakeholder inclusion with a comment to identify affected groups and integrate their feedback, and External engagement with a comment to create channels for stakeholder input on AI policies. Under Strategic Integration, best practices are AI as strategic priority with a comment to include AI on board agendas and align with long term goals and business transformation, and AI maturity evaluation with a comment to assess organizational readiness to guide investment and innovation. Under Transparency and Disclosure, best practices are Explainability and auditability with a comment to ensure AI systems are transparent, interpretable, and auditable, Governance disclosure with a comment to share board oversight structures and director expertise with stakeholders, and Internal culture with a comment to promote responsible AI use through internal communication and awareness.
Obviously, there is no unique way of addressing AI-related risks and opportunities. So, boards of directors will have to examine whether those practices are fit for purpose for their businesses and how best to implement them where such is the case.
4.2. Are the current Canadian corporate governance best practices responsive to the challenges raised by AI?
As appears to be the case in most jurisdictions, the Canadian corporate governance best practices set out in NI 58-201 have not yet been revised to consider the challenges raised by AI. Thus, in light of these significant challenges, it appears necessary to reflect on whether the current Canadian best practices are up to the task and, if not, what is the proper course to follow.
As a starting point, it is useful to review the best practices enumerated in NP 58-201 in order to assess whether they speak to AI-related risks and challenges. Our review leads us to identify three relevant practices:
• Board Mandate
It is recommended that the board adopt a written mandate in which it explicitly acknowledges responsibility for the stewardship of the issuer, including responsibility for a number of specific items. Among those items is the identification of the principal risks of the issuer’s business and ensuring the implementation of appropriate systems to manage these risks.
• Orientation and Continuing Education
The board should ensure that all new directors receive a comprehensive orientation. They should also understand the nature and operations of the issuer’s business.
The board should provide continuing education opportunities for all directors, so that individuals may maintain or enhance their skills and abilities as directors, as well as to ensure their knowledge and understanding of the issuer’s business remains current.
• Code of Business Conduct and Ethics
The board should adopt a written code of business conduct and ethics that addresses: (i) fair dealing with the issuer’s security holders, customers, suppliers, competitors and employees; (ii) compliance with laws, rules and regulations; and (iii) reporting of any illegal or unethical behaviour.
Thus, as part of its mandate, the board can integrate AI risks into its responsibility for monitoring risk management. It can incorporate training on AI use, development and risks as part of its continuing education program. Lastly, the code of business conduct and ethics can integrate provisions that relate to AI risk, drawing on national and international best practices. Admittedly, the practices set out in NP 58-201 remain general, and their guidance regarding AI is quite limited.
In a consultation document published in December 2024 on the applicability of Canadian securities laws and the use of AI systems in capital markets, CSA Staff acknowledged the corporate governance issues raised by this technology (CSA Staff Notice and Consultation 11-348, 2024). CSA Staff recommended that policies and procedures be designed in a way that accounts for the unique features of AI systems and the risks they pose: “With the rise in the use of AI systems in the capital markets, […] [i]ssuers are encouraged to establish clear governance practices, including those related to accountability, risk management, and oversight in respect of the use of AI systems in their business” (CSA Staff Notice and Consultation 11-348, 2024, p.9318). More specifically, it proposed guidance to boards as to the elements that could be covered by such policies and procedures, including
• Considering AI system planning, design, verification and validation, including being satisfied that the AI system is fit for purpose and that robust testing prior to deployment has taken place;
• Having a “human-in-the-loop,” where humans can effectively monitor the input and/or output of an AI system, as appropriate, prior to that input or output being used for its intended purpose;
• Adequate AI literacy of those using the outputs of AI systems to ensure that the users of a given output are using it for its intended purpose;
• Adequate measures to mitigate the technological and operational risks related to the use of AI systems (e.g., initial and ongoing monitoring of cybersecurity risks, AI system bias, model drift and hallucinations);
• The importance of data in the functioning of AI systems, including ensuring that data are accurate and complete, does not include prohibited information and accounts for privacy considerations; and
• An examination of the full supply chain of an AI system throughout its lifecycle, including third-party service providers, cloud services and data sources used.
In addition, CSA staff encouraged reporting issuers that incorporate the use of AI systems into their business operations, or are themselves developing products or services that rely on AI systems, to reflect on the implications for their disclosure obligations under securities laws with a view to provide accurate, equal and timely access to material information that would likely affect investors’ investment decisions (CSA Staff Notice and Consultation 11-348, 2024, p.9316). CSA Staff recognized that materiality determination should be made by issuers in connection with their use of AI systems and the associated risks, eschewing a one-size-fits-all approach.
It is too soon to tell whether the guidance provided by CSA Staff will have notable implications for the governance and disclosure practices of reporting issuers in Canada. Indeed, our empirical study indicates that issuers were only starting to revise their governance practices to take AI into account. With respect to disclosure, it was primarily via risk factors that some issuers commented on AI-related issues. Thus, we will have to wait until the 2026 proxy season to be able to assess whether the CSA Staff guidance has had an influence on reporting issuers.
While acknowledging the practical relevance of the CSA Staff guidance, we contend that such an approach ought to remain transitional for several reasons. Chief among them is the inherently non-binding nature of staff guidance, which merely reflects staff’s interpretation of overarching regulatory provisions as they pertain to AI. This observation does not imply that issuers will disregard the guidance; rather, it underscores the latitude afforded to them in the application of the recommendations (Strine, Reference Strine2025, p.105). Crucially, this latitude undermines the standardization of disclosure practices, thereby impeding the ability of investors, regulators and other stakeholders to draw meaningful comparisons across issuers. The absence of standardized disclosures not only complicates price discovery and the accurate valuation of issuers but also weakens mechanisms of accountability, making it more difficult for stakeholders to assess and monitor how issuers deploy AI in ways that may affect ethical, legal and strategic outcomes (Scarfone, Reference Scarfone2025).
A further concern, which is implicitly acknowledged in the questions raised by the CSA Staff consultation document, relates to the proliferation of frameworks currently available for addressing AI-related issues and risks (Cihon et al., Reference Cihon, Maa and Kemp2020). The multiplicity of standards, guidelines and best practices – ranging from sector-specific protocols to international ethical principles – creates a fragmented regulatory landscape that complicates efforts to achieve coherence and consistency in governance. In the absence of a unified approach, issuers may selectively adopt elements from various frameworks, leading to uneven implementation and further exacerbating the challenges of comparability, oversight and accountability. Comparable concerns have been voiced regarding ESG disclosure (Krueger et al., Reference Krueger, Sautner, Tang and Zhong2024).
From a regulatory standpoint, securities commissions are uniquely positioned to contribute to the development of AI-related governance and disclosure frameworks within capital markets (Mignault & Rousseau, Reference Mignault and Rousseau2024). This contribution would most effectively take the form of revisiting and adapting existing instruments pertaining to corporate governance, drawing on the comply-or-explain approach (Kamalnath & Varottil, Reference Kamalnath and Varottil2022, pp.8–9), rather than constructing an entirely new framework from the ground up. While it is imperative that regulators continue to deepen their understanding of AI, they remain best equipped to assess how issuers are deploying AI and to identify appropriate normative responses using the tools already at their disposal. Importantly, the role of securities regulators is not to design a comprehensive AI governance regime, but rather to exercise leadership in selecting, refining and contextualizing existing frameworks to suit the specificities of the Canadian business and regulatory landscape. In undertaking this task, the CSA should engage with the International Organization of Securities Commissions to leverage global expertise and promote regulatory harmonization. Such collaboration would enable the CSA to benefit from comparative insights and ensure that its approach to AI governance and disclosure remains aligned with international standards, thereby enhancing both credibility and cross-border consistency.
Four questions require more direct engagement to give these recommendations concrete normative content.
First, why is securities regulation the appropriate vehicle for AI governance? The answer lies not in a general authority over corporate governance, but in the specific obligations and leverage points that securities regulation creates for listed companies. Securities regulators do not govern companies; they require companies to disclose material information to investors and to explain their governance practices. This is precisely the mechanism through which AI governance can be most efficiently and immediately improved for TSX 60-listed companies. That is, by requiring disclosure of AI governance structures and practices, and by setting minimum expectations that reporting issuers must either meet or explain their departure from. The CSA’s jurisdiction over disclosure obligations, proxy statements and governance guidelines under National Instruments 58-101 - Disclosure of Corporate Governance Practices (NI 58-101) provides the legal foundation. Securities regulation is also appropriate because it can operate sector-neutrally across the TSX 60, while sectoral regulators such as OSFI can address specific industries. The two tracks are complementary rather than competing.
Second, what specifically should be added to NI 58-201? Building on the best practices surveyed in Part IV.A, we recommend that the CSA add to NI 58-201 the following targeted provisions on AI governance, drafted consistently with the instrument’s existing principles-based style: (i) a recommendation that the board’s written mandate explicitly recognize AI as a category of principal risk subject to oversight, and that the mandate specify how AI-related risks are monitored and reported to the board; (ii) a recommendation that the board ensure that at least one director or an advisory body has demonstrable competency in AI or data science, and that the board’s continuing education program include periodic sessions on AI developments, risks and governance; (iii) a recommendation that the code of business conduct and ethics address the responsible use of AI by employees and officers, including provisions on data governance, algorithmic fairness and accountability for AI-assisted decisions; and (iv) a recommendation that companies disclose whether and how AI oversight has been allocated within the board structure (whether to a dedicated committee, an existing committee or the full board) and the rationale for that choice. These four additions are incremental, targeted and directly mapped onto the existing architecture of NI 58-201, making them readily actionable without wholesale revision of the instrument.
Third, is “comply or explain” the right mechanism, given its permissiveness? The comply or explain model is recommended as the appropriate implementation mechanism for the governance recommendations above, but with an important qualification: it is a mechanism for implementing substantive standards, not a substitute for them. The critique that comply or explain inherently permits variation is accurate, but this flexibility is a feature, not a defect, when governance standards are properly designed. Comply or explain allows companies of different sizes, sectors and risk profiles to adapt governance structures to their specific circumstances while remaining accountable for their choices. What matters is that the standards against which companies explain their departures are substantively meaningful. This is why the four additions to NI 58-201 proposed above are drafted as positive recommendations rather than as vague principles. It should also be acknowledged that for certain high-stakes AI applications, particularly those involving automated decision-making with significant legal or financial consequences for individuals, more prescriptive requirements may ultimately be warranted, potentially through sector-specific regulation rather than through NP 58-201.
Fourth, how should the compliance burden be calibrated for smaller reporting issuers? The CSA has historically been attentive to the disproportionate compliance costs that governance requirements can impose on smaller issuers, which is itself one rationale for the comply-or-explain model. The AI governance recommendations advanced here apply in their full form primarily to large issuers such as those forming the TSX 60, which are most likely to use AI extensively and to have the resources to implement robust governance structures. For smaller reporting issuers, the CSA should make clear that the recommendations are to be interpreted proportionately: a smaller company with limited AI use may satisfy its disclosure obligation by confirming that AI does not currently constitute a principal risk and that it will revisit this assessment as its AI use evolves. A tiered approach, distinguishing at a minimum between venture issuers and non-venture issuers, would preserve the clarity benefits of having uniform governance standards while avoiding the imposition of disproportionate compliance burdens on companies for which AI governance is not yet a material concern.
5. Conclusion
This paper examined how AI governance practices remain undeveloped in the Canadian corporate world, despite increasing awareness of the risks and opportunities the technology presents for current and future business practices. Our empirical inquiry into TSX 60-listed companies yielded noteworthy insights regarding their approach to AI oversight strategies, AI literacy and education, and AI use and development. We observed that most AI risks are still approached from an overly general viewpoint, that most companies are still working on formalizing oversight boards’ responsibilities, and that most of them have not yet adopted internal frameworks to govern the use of AI. We also explored how the current Canadian CGF, in combination with the best practices in AI governance recommended by different stakeholders, demands that boards and regulators take concrete steps to update companies’ governance frameworks. The objective of these updates is to enhance clarity, establish trust and cultivate accountability in the utilization and implementation of AI. Against this backdrop, the CSA should take a leadership role and take concrete and prompt action in order to assist businesses in adjusting their governance. Indeed, updated governance strategies are a crucial step in fostering the adoption of AI, which can generate significant value for corporations and their stakeholders.
Acknowledgements
The authors are thankful for the capable research assistance of Nicolas Beauchemin, Thomas Grenier and Maxime-Olivier Guay.
Funding statement
The authors gratefully acknowledge the financial support of IVADO and the Strategic Partnership Program for Financial Education, Awareness, and Research of Québec Autorité des marchés financiers. The opinions expressed are those of the authors and do not represent the views of the funding institutions.
Competing interests
N/A.
Stéphane Rousseau is Full Professor and Associate Dean for Research and International Affairs at the Université de Montréal’s Faculty of Law. He is also an affiliated professor in the Department of Finance at HEC Montréal and serves as academic co-director of the Certification in Ethics and Compliance at the École des dirigeants. An internationally recognized scholar, Professor Rousseau teaches and conducts research in corporate law, corporate governance and financial markets regulation. His work bridges legal and financial perspectives, contributing to policy debates and best practices in Canada and abroad.
Catherine Régis is Full Professor at the Université de Montréal’s Faculty of Law, where she holds a Canada CIFAR Chair in Artificial Intelligence. She is an associate academic member of Mila (Québec Artificial Intelligence Institute) and co-directs the research programs of the Canadian Institute for AI Safety. Professor Régis has held several leadership roles, including co-chair of the Global Partnership on AI’s Responsible AI Working Group (2022–2023) and Associate Vice-Rector for Strategic Planning and Responsible Digital Innovation (2021–2024). She is also Director of Social Innovation and International Policy at IVADO and contributes to multiple international initiatives, including UNESCO and the OECD. Her research focuses on health law, AI governance and digital innovation, with an emphasis on collaborative governance and human-centred approaches.
Open access
