If your organisation uses AI to make or inform decisions, regulators now expect documented governance around it. This assessment shows you where you stand — and what to do about the gaps.
📊
Your Governance Score
Domain-by-domain scoring across 8 governance areas, benchmarked against peer institutions of your type and size.
🔍
Regulatory Gap Analysis
A mapped view of where your controls fall short across OSFI, EU AI Act, PIPEDA/CPPA, and FCA frameworks.
🗺️
90-Day Action Plan
Prioritized remediation guidance with technology enablers and a phased roadmap you can take into a board conversation.
Who this is for
CROsCIOsCISOsModel Risk LeadsCompliance OfficersAI & Data LeadersRisk Committees
⏱ ~15 minutes🔒 Runs entirely in your browser — nothing is transmitted📄 Exportable PDF report
AI Use Case Risk Screener
Determine whether your AI use case requires a comprehensive governance assessment. This screening evaluates data sensitivity, decision impact, regulatory exposure, and deployment scope against multi-jurisdictional regulatory expectations.
OSFI E-23 / B-13EU AI Act 2024PIPEDA / CPPAFCA Consumer DutySEC AI GuidanceNIST AI RMFISO/IEC 42001
📋
Use Case Context
Identify the AI system under evaluation and your organizational profile.
🔒
Data Sensitivity Classification
What data does this AI system process, ingest, or generate?
✓
Personal Information (PI)
Names, addresses, identifiers per PIPEDA
✓
Financial / Account Data
Account numbers, transactions, credit files
✓
Credit Bureau / Scoring Data
Equifax/TransUnion data, creditworthiness
✓
Health / Insurance Claims Data
Medical underwriting, claims, PHI
✓
Biometric Data
Facial, voice, behavioural biometrics
✓
Behavioural / Analytics Data
Usage patterns, browsing, app telemetry
✓
AML / KYC Data
Identity verification, sanctions, PEPs
✓
Public / Non-Sensitive Data
Market data, public filings, open datasets
Small / Single province
<10K records, domestic only
Medium / Multi-province
10K–1M records, Canada-wide
Large / Cross-border
1M+ records, includes US or international
Critical / Global
Systemic scale, multiple jurisdictions
⚡
Decision Impact & Autonomy
How does this AI system influence decisions and outcomes?
Assistive / Informational
Supports human decisions, no direct action
Recommendation
Suggests actions, human reviews before execution
Semi-Autonomous
Executes with human override capability
Fully Autonomous
Decides and executes without human review
✓
Credit Adjudication
Loan approvals, credit limits, scoring
✓
Insurance Underwriting
Risk pricing, policy issuance, claims
✓
AML / Fraud Detection
Transaction monitoring, SAR filing
✓
Trading / Portfolio
Algorithmic trading, allocation, risk
✓
KYC / Client Onboarding
Identity verification, suitability
✓
Collections / Servicing
Account management, workout decisions
✓
GenAI / Content Generation
Client communications, documents, reports
✓
None of the Above
Internal tooling, operational efficiency
📜
Regulatory Exposure
Which regulatory frameworks apply to this AI system?
✓
OSFI E-23 / B-13 iCanada's federal banking regulator. E-23 governs model risk management; B-13 covers technology and cyber risk. Mandatory for all federally regulated financial institutions.
Model risk management, technology risk
✓
PIPEDA / CPPA iCanada's federal privacy laws. PIPEDA is current law; CPPA is its successor. Both require transparency and explainability when AI makes or influences decisions about individuals.
Federal privacy, automated decisions
✓
EU AI Act (2024) iThe EU's landmark AI regulation (2024/1689). Classifies AI by risk level — high-risk systems (e.g. credit scoring, hiring, biometrics) face strict obligations. Applies if you operate in or serve EU markets.
High-risk AI classification, CE marking
✓
FCA / PRA (UK) iUK Financial Conduct Authority and Prudential Regulation Authority. Consumer Duty (2023) requires firms to demonstrate good outcomes for retail customers — including from AI-driven decisions.
Consumer Duty, operational resilience, SS1/23
✓
SEC / FINRA (US) iUS Securities and Exchange Commission and FINRA. Proposed rules target predictive analytics and conflicts of interest in AI-driven investment recommendations (Reg BI). Relevant if you have US clients or operations.
Predictive analytics, Reg BI, investment advice
✓
PCMLTFA / FINTRAC iCanada's anti-money laundering law. If your AI is used in transaction monitoring, fraud detection, or KYC/identity verification, FINTRAC expects documented controls and explainable decisions.
Anti-money laundering, terrorist financing
✓
Canadian Human Rights Act iProhibits discrimination in federally regulated services on grounds including race, gender, age, and disability. Applies directly to AI systems that influence credit, employment, insurance, or service decisions.
Anti-discrimination, fair treatment
✓
None / Uncertain
No known regulatory requirements
🔗
Model Provenance & Third-Party Risk
Assess supply chain and vendor risk dimensions per OSFI B-10.
Built In-House
Full control, internal development
Fine-Tuned Foundation Model
Third-party base, custom training layer
Third-Party API / SaaS
Vendor-managed, API access
Unknown / Unassessed
Provenance not documented
Deep Governance Assessment
Rate each control area using the 5-point scale. Responses generate domain risk scores, multi-jurisdiction regulatory gap mapping, and prioritized remediation guidance aligned to OSFI, EU AI Act, FCA, and international standards.
Scoring guide: ✓ Compliant — fully documented, tested and operating | ~ Largely — minor gaps only | △ Partial — in development or inconsistent | ! Gap — planned but not implemented | ✗ Non-Compliant — no controls exist