OSFI Guideline E-23, Model Risk Management (2027)

What it is

Guideline E-23, Model Risk Management (2027), is a guideline from the Office of the Superintendent of Financial Institutions (OSFI), the federal regulator of Canadian banks, insurers and trust and loan companies. The final version was published on 11 September 2025 and takes effect on 1 May 2027. It replaces the earlier E-23, which covered enterprise-wide model risk for deposit-taking institutions only.

The new guideline does two things the old one did not. It extends model risk expectations to insurers and other federally regulated institutions, and it brings AI and machine learning squarely into scope. OSFI’s position is that AI models are models, subject to the same discipline, with extra attention to the risks particular to them.

Who it applies to

E-23 applies to federally regulated financial institutions (FRFIs). They are banks and foreign bank branches, life insurance and fraternal companies, property and casualty companies, and trust and loan companies. Foreign bank and insurance branches apply it to their Canadian business, consistent with OSFI’s Guideline E-4. Expectations are risk-based and scale with an institution’s size, strategy, risk profile, complexity and interconnectedness.

A model is an application of theoretical, empirical, judgemental or statistical techniques, including AI and machine learning methods, that processes input data to generate results. It has three parts, data input, processing and result output.

What it requires

OSFI frames the guideline around three outcomes. Model risk is well understood and managed across the enterprise, model risk is managed using a risk-based approach, and model governance covers the entire model life cycle.

Governance. Senior management defines model risk management roles, makes sure staff have the skills needed (especially for AI), and reports model risk to the board. Model risk management should draw on multidisciplinary teams.

Framework. A model risk management framework aligned with the institution’s risk appetite, covering models and data from third parties and foreign offices, consistent with Guideline B-10 on third-party risk.

Inventory. Institutions identify all models, triage them for non-negligible risk, and keep an accurate, enterprise-level inventory of those models, with specified information about each.

Risk rating. Each model receives an inherent risk rating based on quantitative and qualitative factors. The rating sets the intensity of everything else, including review frequency, documentation, approval authority, monitoring and limits on use. Residual risk is tracked mainly for reporting.

Life cycle. Governance covers design (rationale, data and development), independent review, approval, deployment with change control, ongoing monitoring and decommissioning.

Data and AI. Data should be accurate, relevant, compliant, traceable and timely. AI and ML models need extra attention to explainability, bias, autonomy and model drift, which are the areas where traditional model validation tends to fall short.

Key dates

• 11 September 2025. Final guideline published.
• 1 May 2027. Guideline takes effect.

Institutions have the period before May 2027 to build the inventory, rate their models and extend governance to AI and ML models that may have been treated as software rather than models until now.

In practice the work tends to fall into four steps. The first is finding the models, including AI features inside vendor products and tools adopted by business units without a model risk review. The second is triage, deciding which have non-negligible risk and belong in the inventory. The third is rating each one, so the intensity of review, documentation and monitoring is set before the model is used. The fourth is putting monitoring in place for drift, bias and changes in autonomy, which for AI models is where most of the ongoing effort sits. An institution that starts with an AI inventory already has the first and second steps under way.

How it relates to other frameworks

E-23 now differs sharply from US practice. The US banking agencies’ SR 26-2, which replaced SR 11-7 in April 2026, expressly excludes generative and agentic AI from model risk guidance. OSFI’s definition does not carve them out, so a Canadian institution using a large language model in a decision process should expect to treat it as a model, inventory it and rate it.

E-23 works alongside other OSFI guidance, notably B-10 on third-party risk, B-13 on technology and cyber risk and E-21 on operational resilience. For the AI-specific governance that model risk does not reach, such as acceptable use, human oversight and incident response, institutions often draw on ISO/IEC 42001 or the NIST AI RMF. Federal government institutions follow a different instrument, the Directive on Automated Decision-Making.