CSA Notice 11-348: What "AI Washing" Means for Your Business
In December 2024, the Canadian Securities Administrators quietly issued Staff Notice 11-348, a warning shot aimed at public companies overselling their AI capabilities. Eighteen months later, most private business owners have never heard of it, and that gap is starting to cost people.
It's a regulation that has been sitting on the books for a year and a half, applying quietly to Canada's reporting issuers while the AI hype cycle around it kept accelerating. What makes it worth revisiting now isn't its age, it's that the practice it was written to stop, exaggerating what your AI does, has spread well beyond the public markets it was designed to police. If you run a private business in Canada, the notice itself may not apply to you directly. The problem behind it almost certainly does.
What the notice targets
CSA Staff Notice 11-348 is a staff statement from the Canadian Securities Administrators, the umbrella body that coordinates provincial regulators like the Ontario Securities Commission and the BC Securities Commission. It reviewed how public companies were describing their AI use in financial filings and found a lot of vague, aspirational language doing a lot of heavy lifting: companies calling themselves "AI-powered" or "AI-driven" in ways that inflated investor expectations without much to back them up.
The regulators have a name for this: AI washing. It's the AI-era cousin of greenwashing. A company overstates its AI capabilities, or understates its AI-related risks, to attract capital, boost its valuation, or look better to investors and insurers than its actual operations support.
The notice doesn't ban companies from talking about AI. It requires them to be specific. Reporting issuers are now expected to:
- Explain, in concrete terms, how they define and use AI in their operations, not just gesture at it
- Disclose the material risks AI introduces to the business, not bury them in generic risk-factor boilerplate
- Describe how AI affects competitive positioning and financial performance with the same rigour applied to any other forward-looking claim
Regulators are treating vague AI language in annual filings and MD&A sections the same way they treat any other misleading forward-looking statement. That's a meaningful shift. AI claims used to get a pass as marketing colour. Now they get read as disclosure.
Who this applies to directly
Strictly speaking, Notice 11-348 applies to reporting issuers: companies listed on Canadian exchanges or otherwise subject to continuous disclosure obligations under provincial securities law. If your business isn't publicly traded and isn't raising capital through a prospectus, you are not the direct audience for this notice.
A narrower group of professionals should read it closely regardless: securities lawyers, auditors, investor relations consultants, and any advisor who helps a public company draft its annual report or MD&A. For that group, the notice is now a live compliance standard.
Why private small and medium-sized businesses should still pay attention
Here's where it gets relevant for the other 99% of Canadian businesses that will never file a prospectus.
Insurance underwriters are already reading across these lines. Directors and officers liability underwriters increasingly cross-reference what a company says publicly about its AI use against what that same company (or a comparable private one) claims on an insurance application. If your public-facing marketing describes sophisticated AI governance that your actual operations can't demonstrate, that inconsistency can affect coverage, premiums, or a claim outcome after the fact.
The underlying problem isn't unique to securities filings. Swap "annual report" for "sales pitch," "website copy," or "RFP response," and the same failure mode shows up in private business. A consulting firm claims proprietary AI tools it hasn't built. A professional services shop advertises "AI-powered insights" that amount to a ChatGPT subscription and no governance process behind it. None of that is securities fraud. But it's the same instinct the CSA was trying to correct, and it carries its own risk: client disputes, breach-of-contract claims, and reputational damage when the gap between the pitch and the reality gets noticed.
Growth-stage companies eventually meet this regulation head-on. Any small or medium-sized business planning an eventual acquisition, IPO, or significant capital raise will, at some point, need financial disclosures that meet exactly this standard. Building the habit of specific, honest AI claims now is cheaper than retrofitting it under a due diligence deadline later.
The broader lesson: disclosure discipline, not disclosure paperwork
The real value of Notice 11-348 for a private business owner isn't the regulation itself. It's the discipline it points to. Three habits are worth adopting regardless of whether securities law touches your business at all.
Say what your AI does, not what you wish it did. If a tool summarizes documents, say it summarizes documents. Don't let "AI-powered" stand in for a capability nobody on your team could explain in plain language if a client asked.
Keep your AI story consistent across every audience. What you tell a prospective client, what you tell an insurer, and what you tell your own team about your AI use should be the same story, told with the same level of detail. Divergence between those versions is the signal that regulators, underwriters, and increasingly, clients themselves, are learning to look for.
Document what you can't yet prove. If you're building toward a genuine AI capability but aren't there yet, say so. "We're piloting AI-assisted review with human sign-off on every output" is a specific, defensible claim. "AI-driven" with nothing behind it is not.
This connects directly to Evolutie's Disclosure principle: telling clients, partners, regulators, and insurers what your business does with AI, accurately and without spin. Notice 11-348 is a useful preview of where that expectation is heading for everyone, not just companies with a ticker symbol.
What to do next
You don't need a securities lawyer to apply the lesson here. Pull up your own website, your last three client proposals, and your current insurance application. Read your AI claims across all three side by side. If they don't match, or if any of them describe a capability your business can't demonstrate today, that's your starting point.
If you'd like help auditing where your AI claims and your actual AI governance line up, a Comprehensive AI Audit is a practical place to start. It looks beyond a simple tool inventory to how your AI use is represented across marketing, client materials, and insurance applications, so you can close the gap before an underwriter, a client, or a regulator finds it for you.
This article is general guidance, not legal advice. Consult a qualified securities or corporate lawyer for decisions specific to your business.