Canada: Technology

Much ink has been spilled on what AI means for public companies and their continuous disclosure obligations. Is the company’s use or development of AI material to its business? Could any discussion of its plans around AI constitute forward looking information? How should AI inform its risk factors?

Following similar forums held in 2018 and 2023, the Canadian Securities Regulatory Organization (CIRO) is hosting another series of cybersecurity table-top exercises for investment dealers and mutual fund dealers on September 30 (Toronto) and October 7 (Calgary). The forum is intended to allow participants to discuss threats, gaps in response plans and best practices through targeted case scenarios. All CIRO members are invited to participate, and CIRO has separately requested input on the development of the case scenarios.

In-house counsels are increasingly asked to rely on cybersecurity evidence that was not written for lawyers. A vendor may provide a SOC 2 report, ISO 27001 certificate, penetration test summary, cyber insurance certificate, or completed security questionnaire. The document may look reassuring. The harder question is whether it actually answers the risk question in front of the business.