Since the release of OpenAI’s ChatGPT in late 2022, Artificial Intelligence (AI) has quickly evolved from experimental pilot programs to a core operational input for many publicly traded companies.[1] However, this adoption may have outpaced corporate governance for some issuers. A primary AI-related risk facing public companies is therefore not AI itself, but AI’s integration into the business without a corresponding investment in rigorous, issuer-specific governance structures.
Leveraging statistics on Canadian public company disclosure on AI in Fasken’s 2026 ESG Disclosure Study (the Fasken Study), we explain how the organizations best positioned to capture AI's benefits while effectively containing its risks are those that (1) make AI literacy central to AI adoption, and (2) proactively build governance frameworks tailored to how AI is actually used within the business.
For Fasken’s related and ongoing series on AI in the Boardroom, see here (part 1),[2] here (part 2)[3] and here (part 3).[4] For more Fasken corporate governance thought leadership, visit our Capital Markets and M&A Knowledge Centre and subscribe.
I. The AI Value and Governance Gaps
The scale of corporate AI adoption in Canada is no longer in question. 73% of companies surveyed in the Fasken Study reported having adopted AI in some form across their products, operations, or services.[5] This adoption is not limited to narrow, task-specific tools. Many firms are increasingly deploying agentic systems capable of participating directly in organizational decision-making, raising the stakes of governance failures.
Key Statistics on AI Value Capture and AI Governance Readiness
Notably, however, AI adoption is not translating uniformly into value. A recent PwC report found that only 20% of firms capture the majority of the economic benefits generated by AI,[6] pointing to a significant gap between firms that deploy AI strategically and efficiently and those that do not. Separately, 72% of organizations name responsible AI as a top priority, yet 36% still lack a dedicated governance function to manage the associated risks.[7] These figures pose two key questions: what distinguishes firms able to capitalize on AI’s gains, and how do those firms effectively mitigate the risks AI introduces?
Canada’s Corporate AI Readiness Gap
Canadian firms illustrate this AI value and governance readiness gap acutely. A KPMG study ranked Canada 44th out of 47 surveyed countries on AI literacy.[8] The Fasken Study found that only 20% of surveyed companies have directors with specific AI knowledge and only 4% have an officer whose title or description expressly refers to AI.[9] These statistics suggest that a significant number of Canadian boards and management teams may lack the technical fluency needed to implement and govern AI systems efficiently and effectively.
AI-Related Shareholder Proposals in Canada
To begin to gauge investor concern around AI adoption and governance by Canadian public companies, the Fasken Study reviewed AI-related shareholder proposals received by the top 100 TSX-listed companies by market cap. Fourteen of such proposals were received, and 71% of these proposals were put to a vote.[10] The average support level for the proposals that went to a vote was only 8.63%.
One could interpret these statistics to suggest that public companies currently face little direct market pressure to strengthen their AI governance. This would, however, be an oversimplification. The proposals varied widely in their substance, as did the applicable companies’ counterarguments, thus making generalizations inappropriate. That said, as a backlash against AI is gaining momentum in certain quarters of society (both in Canada and internationally), we expect continued and more complicated developments on the shareholder proposal front, and will continue to monitor same in subsequent annual editions of the Fasken Study.
II. Identifying AI Risk
AI risk is multidimensional. 72% of companies surveyed in the Fasken Study identified AI as part of their disclosed risk profile,[11] and industry leaders consistently point to reputational, cybersecurity, and regulatory risk as among their top concerns.[12] While a fulsome review of all AI-related risks is beyond the scope of this article, as key AI-related risks will be business-specific, we highlight a representative sample below.
Shadow AI
“Shadow AI” is the unsanctioned use of AI tools by company personnel. The acute risk posed by shadow AI flows from, among other things, the potential input of commercially sensitive or proprietary corporate or client data into consumer-grade AI models without organizational oversight. This can lead to, inter alia, various types of competitive, data privacy, security vulnerability, and regulatory compliance issues.
Shadow AI risk is not necessarily limited to lower level or mid-level company employees. As we discussed in AI in the Boardroom: The Good, the Bad, and the Complex Balance Directors Must Navigate, a recent Nasdaq study states that while only 8% of directors and executives reported that their board uses an approved AI tool, “by some accounts, approximately two-thirds of board members are currently using AI in their roles as directors.” An example of a shadow AI risk specific to public companies is the potential inadvertent disclosure of material non-public information (e.g., in connection with the company’s internal continuous disclosure processes – see AI in the Boardroom E3 - “Shadow AI”, Continuous Disclosure, and the Inadvertent Disclosure of Material Non-Public Information).
Intellectual Property Risks
AI use introduces intellectual property risk on several levels. These include (1) trade secret exposure (e.g., the input of commercially sensitive information or confidential product specifications into a public AI tool), (2) copyright infringement (e.g., because AI tools can reproduce copyrighted content found on the internet, the use of AI-generated content in business materials can raise potential exposure to infringement claims by third parties), and (3) unclear ownership (e.g., copyright) over AI-generated content (e.g., because the applicable terms of service give the AI service provider rights over the associated inputs and/or outputs).
The Risks of Non-Adoption
The various risks related to AI adoption typically attract the most attention. However, it bears emphasizing that insufficient AI adoption carries its own risks, and that these risks also manifest on multiple levels.
Perhaps most notable is competition and obsolescence risk. Simply put, the failure to productively adopt AI quickly enough could render a company’s products or services uncompetitive or obsolete relative to speedier and more efficient competitors. This can be the case as much for companies for whom AI is merely a potential or current operational input as it is for companies for whom AI-driven products or services are at the heart of their business.
Non-adoption can also raise internal risks. As we discussed in AI in the Boardroom: The Good, the Bad, and the Complex Balance Directors Must Navigate, AI is a double-edged sword for directors. On the one hand, overreliance on AI tools risks failing to meet the directors’ fiduciary duties to the company. On the other hand, given AI’s undeniable utility, under reliance on AI could plausibly raise similar risk from the opposite direction in respect of the board’s duty of care: boards should not unduly avoid technology that can enhance the depth and vigour of their decision-making. Another example is that firms that abstain from appropriate AI adoption risk undermining talent acquisition and retention. AI has rapidly given rise to talent wars in certain industries, e.g. tech. Across the broader economy, the AI revolution increasingly means that many employees (and prospective employees) have a base case expectation of suitable access to advanced AI tools.
III. How Public Companies Are Disclosing AI Risk
Disclosure practices confirm that AI risk has become a mainstream governance concern: 94% of companies surveyed in the Fasken Study addressed AI-related matters in their public disclosure.[13]
That said, disclosure strategies vary considerably by industry. Some companies isolate AI risk in dedicated disclosures, treating it as a distinct category warranting separate analysis. Others fold AI risk into existing operational risk disclosures, treating it as one input among many. As a general matter, firms whose core business is an AI platform or product are more likely to treat AI risk as central to their operations, and to disclose accordingly.
A useful analytical framework in this context is an inverted-U relationship between AI risk and disclosure intensity over the course of adoption, as explained by Dr. Bonelli of Venice School of Management.[14] In the early phases of AI adoption, risk is at its highest: market forces push firms toward rapid adoption, but this push is rarely matched by adequate governance frameworks. Firms integrating new AI systems into legacy processes face significant implementation friction, and governance models frequently lag behind the operational realities of increasingly autonomous systems. In more mature phases of adoption, by contrast, risk tends to decline as AI processes become better embedded within oversight and monitoring mechanisms.[15] We will watch with interest how this plays out in the Canadian market as we continue with subsequent annual editions of the Fasken Study.
IV. Risk Mitigation Strategies
As mentioned, mitigating AI-related risks requires matching AI control systems to business-specific operational realities. Actionable steps Canadian public companies should consider include:
- Building AI literacy: The Fasken Study identified that only 41% of the companies surveyed provide AI educational opportunities for directors. Director education and enlisting the advice of AI experts helps foster the organizational literacy that enables boards to oversee the prudent and proactive implementation and management of AI governance systems.
- Acceptable use policies: Companies should establish and regularly update written policies setting the acceptable use of both internally developed and externally sourced AI tools, with particular attention paid to the business’ critical AI risk touchpoints as well as shadow AI. Building professional competence and accountability throughout the organization is key.
- Enterprise-wide approach: Adopting an enterprise-wide governance approach mitigates the risks associated with siloed AI use and management and establishes a single source of oversight across departments, reducing the likelihood of ungoverned or unauthorized AI use. Firms should consider building strong cross-functional committees with representation across relevant business functions to continually monitor and address AI risks.
For further discussion, see AI in the Boardroom E2 – Not Just for Financial Institutions: What Other Canadian Companies Can Take from the AMF’s AI Guideline.
Conclusion
The Fasken Study indicates that a key AI risk facing Canadian public companies is a gap between the rapid pace of AI evolution and adoption, on the one hand, and developing the internal expertise necessary to efficiently and effectively implement AI use and AI governance systems, on the other hand. Firms that proactively close this gap with a clear focus on areas of greatest AI value add and AI risk exposure will be best able to capture AI’s benefits while mitigating its risks. The responsibility for doing so will ultimately fall on boards and senior executives, including to meet their duty of care to the company (see AI in the Boardroom: The Good, the Bad, and the Complex Balance Directors Must Navigate).
