Who Is Accountable for the AI? Governance in Sustainable Finance

Sustainable AI needs an owner. But assigning responsibility is only the beginning. Organizations must also be able to demonstrate how AI is used, what evidence supports its outputs, who reviews its decisions, and how risks are managed as models, vendors, and data change.

In sustainable finance, where decisions depend on the reliability of environmental, social, and governance (ESG) information, accountability must be more than a policy. It must be supported by evidence.

That accountability is AI governance. In sustainable finance, it is increasingly an expectation of regulators, clients and shareholders, although the applicable requirements vary by institution and jurisdiction. This article examines what AI governance means inside an investment firm, which rules apply, and where to start.

What AI governance means in an investment firm

AI governance begins with four practical questions. Can the firm identify where AI is used, establish clear ownership, validate and monitor performance, and oversee its vendors? If it cannot answer these questions, it has significant gaps in its governance.

The last row matters most in our field. Few investment firms develop their own foundation models. Much of their AI comes embedded in purchased tools, making vendor oversight an important part of AI governance. But firms remain responsible for establishing appropriate controls over how they use these tools and how their outputs inform decisions.

Language models also change in ways older models did not. A provider can update a model without notice, and the same prompt can return a different answer next month. Monitoring has to be continuous, because a one-time approval goes stale.

The rules are arriving unevenly

No single AI law covers a Canadian investment firm today. The obligations come from a patchwork of financial regulation, privacy law, European rules and voluntary standards.

Two things stand out. In Canada, AI governance expectations arise from existing financial regulation, privacy law and other legal obligations, rather than a single comprehensive federal AI statute. And the standards now reach the environmental footprint, so governance and sustainability are converging on the same evidence.

Different standards address different dimensions of responsible AI. ISO/IEC 42001 provides requirements for establishing and continually improving an AI management system. ISO/IEC TR 20226:2025 provides technical guidance on environmental sustainability aspects of AI systems across their life cycle, including considerations related to energy, water, and resource use. ^[7][5]

These frameworks can help organizations structure their governance and environmental assessments, but adopting a framework does not, by itself, demonstrate that an AI system is reliable, responsible, or environmentally sustainable.

Investors sit on both sides of the question

Investors ask portfolio companies about AI governance, and are now being asked about their own.

On the asking side, AI oversight has reached the proxy ballot. At Alphabet's 2026 meeting, shareholder proposals on AI board oversight, AI water use and climate disclosure went to a vote. None was approved. ^[6]

On the receiving side, E-23 is the clearest signal. It sets model risk management expectations for federally regulated financial institutions from 1 May 2027, and it names risks specific to AI, such as models that re-tune themselves and models that drift. Because models obtained from external providers are within scope, regulated institutions must also consider the risks of the models they purchase. The depth of oversight should reflect each model's risk and its role in the institution's activities. ^[1][2]

E-23 does not directly apply to every investment firm, but firms outside OSFI's reach still feel it. An asset manager serving a bank or a pension plan will meet these questions in due diligence, whatever its own regulator requires.

Consider an investment firm that asks its portfolio companies to explain how AI influences their operations. If the firm itself relies on AI-powered research tools, can it identify the sources supporting their outputs, understand their limitations, and determine when human review is necessary? Accountability requires applying consistent standards to the AI an organization evaluates and the AI it uses itself.

Where to start

Governance does not need a large programme to begin. Five steps cover most of the ground, and the first three need no new tools.

1. 1
   Inventory AI use. Identify AI applications used internally and those embedded in purchased tools. Record each application's purpose, the decisions it supports, the data it uses, the relevant vendor, and the person accountable for its oversight.
2. 2
   Rank each use by consequence. A drafting aid and a model that feeds investment decisions need different levels of control. Prioritize applications according to their potential impact on investment decisions, clients, regulatory obligations, and other affected stakeholders. The level of oversight should reflect the risks involved.
3. 3
   Name an owner for each material use. One person, with authority to pause it. Define who is responsible for monitoring performance, reviewing incidents, approving material changes, and suspending use when necessary. Accountability must include the authority to act.
4. 4
   Scale vendor requirements to risk. Request relevant documentation on model limitations, evaluation results, data provenance, material changes, and incident reporting. Where available, seek information about environmental impacts. Establish clear responsibilities for monitoring performance, reporting incidents, and addressing problems.
5. 5
   Adopt a framework and report against it. Select a framework appropriate to your activities and applicable obligations, such as ISO/IEC 42001 or the NIST framework. Document how its requirements translate into operational controls, monitoring procedures, and evidence that can be reviewed over time. ^[7][8] E-23 is the reference point for anyone serving federally regulated Canadian institutions. ^[1]

The fourth step connects governance to sustainability. Environmental impacts and traceability become more useful when organizations establish clear information requirements, assign responsibility for reviewing the information, and incorporate appropriate expectations into vendor agreements.

Governance is how the promise holds

AI for sustainability is a claim about purpose. Sustainable AI requires evidence about environmental impact, reliability, and responsible use.

For investment firms, the challenge is not simply to adopt AI or publish a governance policy. It is to demonstrate where AI is used, what evidence supports its outputs, who is responsible for overseeing its risks, and how performance and controls are reviewed as the technology changes.

Read how we handle this on our Trust page.