How to Prepare for OSFI Guideline E-23 Before May 2027

Current as of October 29, 2026. This guide draws on OSFI Guideline E-23 (Model Risk Management), the letter and summary of stakeholder comments OSFI published with it, OSFI's backgrounder, OSFI's October 2026 statement on artificial intelligence and Guideline B-10, as published on that date. It is not legal advice.

Canada's Office of the Superintendent of Financial Institutions (OSFI) published the final Guideline E-23 on September 11, 2025. Its letter says the guideline "will take effect for all Federally Regulated Financial Institutions (FRFIs) on May 1, 2027". The guideline is principles-based: it sets outcomes and principles and leaves rating methods and review frequencies to the institution, so most preparation is design decisions the institution must be able to defend.

This guide walks through what E-23 asks and ends with a preparation sequence to May 1, 2027. Unless a step quotes the guideline or an OSFI document, it is a recommendation, labeled (interpretation).

On scope: E-23 is an OSFI guideline, which sets supervisory expectations for the institutions OSFI regulates (its sector list names banks, foreign bank branches, life insurance and fraternal companies, property and casualty companies, and trust and loan companies, and its scope adds foreign insurance company branches); it is not a statute. Provincially regulated credit unions and insurers are outside its scope. Branches apply it "to the extent it is consistent with applicable requirements and legal obligations related to their business in Canada" under Guideline E-4. It applies proportionally to the institution's size, strategy, risk profile, the nature, scope and complexity of its operations, and its interconnectedness.

Step 1: Read the E-23 model definition broadly, including AI and generative AI

E-23 defines a model as "An application of theoretical, empirical, judgmental assumptions or statistical techniques, including AI/ML methods, which processes input data to generate results." Stakeholders asked OSFI to narrow the definition; OSFI's response was that it has been left "intentionally broad", with risk managed according to the model risk rating.

Stakeholders also asked whether low-risk generative AI uses, such as document summarization or marketing emails, could be excluded from the requirements for managing critical or high-risk models. OSFI answered that "institutions are empowered to make risk-intelligent decisions, based on the application of the model within the organizational context, when establishing model risk ratings." By contrast, the non-binding US interagency guidance SR 26-2 (April 2026) places generative and agentic AI outside its scope, so group inventories spanning both will not match one to one (interpretation).

Step 2: Build the MRM framework around E-23's three outcomes

E-23 is organized around three outcomes: "Model risk is well understood and managed across the enterprise." "Model risk is managed using a risk-based approach." "Model governance covers the entire model lifecycle."

Senior management is responsible for roles, skilled MRM staff (particularly for AI) and reporting model risk to the board. The framework itself should reflect the institution's risk appetite for model risk, be periodically reviewed, and have "clear guidelines for the major components of their MRM framework such as: model identification, model inventory, model risk ratings, and requirements for model lifecycle governance". It also has to cover "models or data sourced from external sources like foreign offices or third-party vendors".

Approve the framework policy, its owner and its board reporting line before writing the procedures under it (interpretation).

Step 3: Identify every model, including vendor models, and build the inventory

Principle 2.1 reads: "Institutions should identify and track all models in use or recently decommissioned." Institutions "should have defined processes to periodically identify models used throughout the enterprise, including vendor and third-party models": survey, triage for non-negligible inherent risk, assign provisional ratings, and store every model with non-negligible risk in an enterprise inventory that keeps decommissioned models for a period the institution considers reasonable and is "accurate, evergreen, and subject to robust controls."

OSFI's letter confirms the boundary: "Only models that carry risk to the institution need to be captured on the model inventory and are subject to full model lifecycle governance under the final guideline." The guideline's appendix lists minimum fields, from ID, owner and origin for every identified model to approved uses, limitations and review dates for inventoried ones.

Keep triaged-out models in a separate register, and survey procurement and business units, where vendor tools and embedded AI hide (interpretation).

Step 4: Design the model risk rating and tie governance intensity to it

Principle 2.2 asks for a rating approach based on inherent model risk, "supported by clear, measurable criteria for each risk dimension". Quantitative factors include "the importance, size and growth of the portfolio that the model covers (as applicable), or potential operational, security or financial impacts." Qualitative factors include "business use or purpose, model complexity or level of autonomy, reliability of data inputs, customer impacts, or regulatory risk." Ratings may start as temporary and should be updated on trigger events such as a fall in performance or a material change in use, data or infrastructure.

A negligible-risk category is allowed: "Institutions may include a risk rating category that implies a negligible level of inherent model risk and therefore exempts such models from the full model lifecycle governance requirements. There should be a robust process to approve and track such exemptions."

Under Principle 2.3, the inherent rating should drive review and monitoring intensity, documentation, approval authority and the re-rating interval. The guideline adds: "For example, the extensive use of advanced AI/ML techniques should have correspondingly mature governance and oversight." Write criteria and per-rating requirements as one policy table, and test it on a sample of models first (interpretation).

Step 5: Set lifecycle standards for model rationale, data and development

For AI/ML models, the rationale should consider the "level of transparency and explainability required", the need for alternative controls for black-box or autonomous models, and the "potential for the model to lead to biased outcomes, negative social and ethical implications, or privacy risks."

Under Principle 3.2, development data should be accurate and fit for use, relevant and representative, compliant with statutory, regulatory and internal requirements for data ethics and customer privacy, traceable, and timely. For AI, it warns: "This is especially crucial for AI/ML models, since they can easily mirror unwarranted data relationships and preserve them in the outputs." Principle 3.3 asks for development and documentation standards, including explainability requirements that may vary with the model's purpose, level of autonomy, regulatory requirements and impact on customers and stakeholders.

Step 6: Define independent review, approval, deployment, monitoring and decommissioning

Principle 3.4: "The model review process should be independent from model development." "Institutions can use the work of internal reviewers or objective third parties." "The extent and frequency of model reviews should be commensurate with the model risk rating." OSFI's response to comments treats validation and review as interchangeable terms. For self-learning models, it says "Institutions should establish internal criteria to determine when a self-learning model has materially changed."

A model with known weaknesses can still be approved if compensating mitigants are in place or the model stakeholder group justifies its use.

Principle 3.5: "Models should be deployed in an environment with quality and change control processes." Principle 3.6 asks for monitoring standards by rating level, breach thresholds, contingency plans, and processes for "autonomous decision making, autonomous re-parametrization, and the elevated potential for model drift". Decommissioning includes "Retaining the retired model and documentation for a set period as a benchmark or fallback."

Step 7: Bring vendor, parent-company and fourth-party models under the framework

OSFI's Guideline B-10 on third-party risk already says "the FRFI retains accountability for business activities, functions and services outsourced to a third party." E-23 adds: "Externally developed models should be assessed for model risk ratings on a standalone basis." OSFI's response to comments explains that a parent organization's rating may not reflect the risk to a subsidiary or foreign branch.

"Institutions should also ensure that third-party models receive validation and monitoring commensurate to the model risk." "It is up to each institution to ensure adequate documentation is provided by vendors to satisfy model risk management needs." On fourth-party models, such as generative AI a vendor builds on another provider's model, OSFI made no specific revision to the guideline but said: "Institutions have a responsibility to ensure that third-party model use is within the institution’s risk appetite limit. A third-party model review should include inputs into the model, including feeder models." On timing: "We have not incorporated a grace period for third-party model risk management in the final guideline. However, institutions may still establish an exceptions policy under which models can be used for limited and specific applications prior to the completion of validation." Add documentation and change-notification terms to vendor contracts at renewal (interpretation).

Step 8: Sequence the E-23 preparation to May 1, 2027

E-23 sets no interim milestones.

• November to December 2026: gap assessment against each principle; accountable senior executive named; model definition and triage rules agreed, including for generative AI.
• December 2026 to February 2027: enterprise survey, including vendor and embedded AI models; provisional ratings; a register of exempted models.
• January to March 2027: framework policy, rating methodology and per-rating governance table approved; lifecycle standards issued.
• February to April 2027: review plan starting with the highest-rated models; exceptions policy; vendor documentation requests.
• April 2027: first enterprise model risk report to senior management and the board, with the review backlog dated.

A complete inventory, defensible ratings and a dated plan beat partial work on everything (interpretation). On October 15, 2026 OSFI published a statement endorsing the Financial Stability Board's Sound Practices for Responsible Adoption of Artificial Intelligence, saying "They complement OSFI’s own guidelines, which set principles-based expectations that apply to the adoption and use of AI." E-23 is one of the guidelines it lists, so AI governance and model risk work can share one inventory and one rating (interpretation).

Checklist

Items restate the recommendations above (interpretation).

• The model definition, including AI/ML and generative AI uses, is written into policy with triage rules
• An approved MRM framework reflects risk appetite, names owners and reports to senior management and the board
• The inventory holds the appendix fields, and triaged-out and exempted models are recorded with approvals
• Measurable rating criteria drive review, monitoring, documentation and approval
• Lifecycle standards cover every component from rationale to decommissioning
• Vendor models are rated on a standalone basis, reviewed including feeder models, and backed by contract terms
• An exceptions policy covers models used before review, and a dated review plan starts with the highest ratings

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.