Critically Assess AI-Generated Outputs: What Canada's Audit Regulator Heard From Audit Committees in 2026

The Canadian Public Accountability Board (CPAB) calls itself "Canada's independent, public company audit regulator." In July 2026 it published Audit Committee Insights: Perspectives from Across Canada, an account of what it heard in its outreach to the committees that oversee a company's reporting and its external audit. In the first half of 2026 it hosted four forums that "brought together audit committee members and chief financial officers (CFOs) from Canadian reporting issuers."

The publication "offers insights gathered through these activities to date." Among the issues "most frequently discussed and top of mind," it lists artificial intelligence first. Parts of it follow, not the whole.

When the Company Uses AI

"Given the pervasive nature of AI, oversight responsibility often extends beyond the audit committee and may span multiple board committees," the publication says. Among the takeaways is a need to assess which AI matters fall to the audit committee, "such as risks related to financial reporting, internal controls, and fraud," and which belong to other committees or the full board.

Another takeaway is that "Effective oversight requires management to clearly articulate the organization's use of AI, including if it is being used for controls and estimates and whether it is appropriately disclosed." That, the publication says, "will allow the board to assess the associated risks and determine where governance and oversight responsibilities should reside."

Oversight starts with a clear list. A committee cannot weigh an estimate made with AI that nobody has told it about.

For most organizations, the publication says, AI is more likely to come through outside vendors than from models built in-house, which increases "reliance on a limited number of providers" and heightens "the importance of effective third-party risk management." The increased adoption of AI, it says, "is expanding the risk landscape beyond concerns related to unauthorized access to information to include challenges related to data integrity, model reliability, and the potential for manipulated or misleading outputs." And as AI applications "evolve toward more autonomous systems capable of making and executing decisions," committees are discussing "the challenges of maintaining effective oversight over AI-driven activities."

Committees are also asking whether management has access to the necessary skills and expertise to govern AI effectively, "including the ability to critically assess outputs and avoid overreliance on AI-generated information."

When the Auditors Use AI

Audit firms, the publication says, "are increasingly embedding tools such as advanced data analytics, AI, and automation into their audit workflows," and committee members raised points about their own auditors' use of it.

They are seeking clarity on how AI is used, and on how it affects the kind of information the auditor is given. Maintaining audit quality and professional skepticism "is a priority," and committees are interested in how firms are "building challenge and validation functions into their AI-enabled audit processes," so that audit teams still understand the business, exercise appropriate professional skepticism and critically assess what the tools produce.

They want to understand what AI may do to audit firms' staffing models, to the skills they will need, and to the number and quality of the people they recruit each year. They are interested, too, in how "technology-enabled efficiencies and increased investments in technology and AI capabilities will impact audit fees in the future."

Stakeholder expectations came up as well. "While AI has the potential to enhance audit quality and efficiency, audit committees noted the risk of widening the expectation gap if perceptions of AI-enabled audits exceed the auditors' actual responsibilities."

The Regulator's Own Tools

"A few questions were raised" about how regulators themselves use AI, and the publication answers for its own office. CPAB, it says, "has prioritized internal education and the responsible use of AI." Its tools, it says, are used "within a secure environment" to support information gathering and analysis, are aligned to existing policies, and "are subject to human validation." Among its uses are "agents that analyze financial statements to surface key data and highlight areas for further inspection."

The publication closes by saying it is not "legal, accounting, auditing or any other type of professional advice or service."