Guideline E-23: What Canadian Financial Institutions Need to Know about Model Risk

In September 2025, Canada's financial regulator published a new rulebook for how banks and insurers build, check, and rely on their models. It is called Guideline E-23, and it takes effect on May 1, 2027. If your institution uses AI today, or expects to, E-23 is the document that will decide what responsible use has to look like in practice.

What is Guideline E-23?

E-23 is the Office of the Superintendent of Financial Institutions' guideline on model risk management. OSFI is the federal regulator for Canada's banks and insurers. A model, in its language, is any system that takes in data and produces a result you then act on. A credit-scoring algorithm is a model. So is an actuarial pricing engine, a fraud-detection system, and the growing family of language-model tools: a system that summarizes claims, extracts data from contracts and submissions, analyzes customer complaints, answers questions out of policy documents, or drafts an underwriting note.

Model risk is the chance that one of these systems is wrong in a way that costs you something: a bad lending decision, a mispriced policy, a regulatory finding, a customer treated unfairly. E-23 sets out what OSFI expects you to do about that risk across the entire life of a model, from the moment someone proposes building one to the day it is retired.

There was an E-23 before this one. The 2017 version applied only to deposit-taking institutions, which in practice meant the banks, and it said next to nothing about AI. The 2025 guideline replaces it and widens the net considerably. It applies to every federally regulated financial institution — banks, foreign bank branches, life and fraternal insurers, property and casualty insurers, and trust and loan companies — with insurers covered for the first time. It was also written with machine learning and generative AI squarely in view, and OSFI kept its definition of a model deliberately wide: it reaches the spreadsheet a pricing team relies on, the vendor tool nobody built in-house, and the generative AI a department started using last quarter without telling anyone.

One thing to understand about OSFI before going further: it is a principles-based regulator. It tells you the outcomes it wants and trusts you to design the controls that get there. You will not find a checklist in E-23. You will find expectations, and the burden of showing you have met them sits with you.

Why this matters now

May 2027 sounds far off. It is not, given what has to happen first. An institution starting from a blank page has to write a governance framework, find and catalogue every model it runs (counted honestly, with every AI use case and every consequential spreadsheet included, that list usually runs into the hundreds, not the dozens), build a way to rate them by risk, stand up an independent function to check them, and renegotiate contracts with the vendors whose tools fall in scope. None of that happens in a quarter. Programs that intend to be ready in 2027 are the ones already moving in 2026.

The pressure is sharpest for two groups. Insurers, in scope for the first time, are building enterprise model risk management from the ground up: many have governed their actuarial models carefully for years, but few have run the kind of single, enterprise-wide, AI-inclusive program E-23 describes. And any institution leaning into AI is discovering that its vendors are not yet ready to support compliance. Lawyers who advise on these contracts report that E-23 is already complicating deals and, in some cases, slowing AI adoption outright, because suppliers cannot yet provide the documentation and validation cooperation their financial-institution clients now need.

The stakes are not fines; OSFI does not issue them. They are supervisory: examination findings, lower ratings, closer scrutiny, demands for action from your board. The more immediate cost is commercial. An institution that cannot show its AI systems meet E-23 will find itself unable to deploy them, and that constraint is already showing up as stalled vendor deals and delayed AI projects.

What E-23 actually requires

OSFI organizes the guideline around three outcomes: that you understand and manage model risk across the whole enterprise, that you do so in proportion to how risky each model is, and that your oversight covers a model's full lifecycle. Underneath those outcomes, the substance comes down to five things you have to get right.

Governance and accountability. Senior management owns model risk, has to resource it properly, and has to report it up to the board. OSFI expects the people doing this work to come from more than one discipline, with legal and ethics expertise in the room when it matters, not just quantitative modelers.

Inventory and risk rating. You have to find your models, including the vendor ones, and keep a living catalogue of them with a defined set of details for each: who owns it, who built it, what it is used for, what it depends on, when it was last reviewed. Each model gets a risk rating based on what it could actually cost you, combining hard factors like financial exposure with softer ones like how autonomous it is and how directly it touches customers. That rating is the dial that controls everything else. A high-risk model gets intensive governance; a negligible one can be exempted from the full treatment, provided you can justify the call.

Lifecycle controls, starting with data. The lifecycle requirements are the longest part of the guideline, and they track a model from design through to decommissioning. The thread that matters most to a general reader is data: OSFI expects the data feeding a model to be accurate, representative, traceable, and current, and it ties data quality directly to two things people care about with AI: whether you can explain what the model is doing, and whether it is producing biased outcomes. Readers tracking the EU AI Act will recognize these expectations almost line for line, and compliance programs are emerging that cover the requirements of both regimes with one set of controls.

Independent review. This is the requirement that does the most work. Before a consequential model goes live, and at intervals after, someone independent of the people who built it has to check that it is sound, that it does what it claims, and that it is fit for its purpose. OSFI is explicit that this review can be done by an outside party, and that how often and how deeply you do it scales with the model's risk rating. It deliberately did not set a fixed schedule, so there is no blanket "validate everything once a year" rule; the cadence follows the risk.

Vendor models. OSFI gave the industry less room here than it asked for, and the point deserves stress because the natural assumption gets it backwards. The natural assumption is that buying from a reputable supplier transfers the burden: the vendor attests that its system works, you keep the attestation on file, and the regulator is satisfied. E-23 works the other way around. A model you bought is still your responsibility. You have to rate it on its own terms, not lean on whatever assurance the vendor offers, and OSFI declined to grant a grace period for validating vendor updates or to soften the rules when a supplier is uncooperative or its system is a black box. If you cannot get what you need from the vendor, the obligation to find another way to assess the model stays with you.

How to comply: a practical path

For an institution starting from scratch, the work falls into a sequence:

1. Stand up the framework. Write the policy, set a risk appetite for model risk, name the governance bodies and the roles, and wire it into your existing risk and governance structure.

2. Build the inventory. Survey the whole enterprise, trace how models feed into one another, and capture the spreadsheets, vendor tools, and AI use cases that are easy to miss. Keep it current.

3. Create a risk-rating method. Decide how you score a model's risk, and define a defensible process for exempting the genuinely trivial cases.

4. Match oversight to risk. Set review frequency, documentation depth, approval authority, and monitoring according to each model's rating.

5. Stand up independent review. Build or buy the capacity to check models independently, with people who can actually evaluate AI systems and their explainability. Where you cannot build it fast enough, bring in an outside validation partner.

6. Put lifecycle controls in place. Document the rationale for each model, govern its data, control how changes get deployed, and monitor live models for drift and failure.

7. Fix the vendor contracts. Push model risk obligations, documentation rights, and validation cooperation into your supplier agreements.

8. Resource it and prove it. Staff the program across the disciplines OSFI expects, and keep the evidence that you have done so.

   
   

This is a multi-quarter program, not a project a small team finishes in a sprint. The institutions that find it manageable are the ones that treated 2026 as the year to do the bulk of it.

Where E-23 gets hardest

Most of E-23 is recognizable governance work that a disciplined institution can plan and resource. The hard part is concentrated, and it lands almost entirely on AI.

Four problems sit at the difficult end:

• Explaining what a complex model is doing, in terms a reviewer and eventually a regulator will accept.

• Testing whether a model produces biased or unfair outcomes, which requires probing it adversarially rather than reading its documentation.

• Watching a live model for drift, the slow decay in performance as the world it was trained on moves on.

• Validating a third-party or black-box model when the vendor will not, or cannot, open it up.

  
  

None of these gets done without specialized staff. They call for technical testing skill that model-risk teams built around credit and capital models rarely have, and independent review capacity is scarce enough that advisors expect the demand to outrun what institutions can build, pushing the work toward outside specialists. The binding constraint on E-23 compliance, for most institutions, will not be writing a policy. It will be finding people who can actually test the hard models and stand behind the result.

This is the gap independent assurance is built to fill. An outside validator that can probe an AI system technically, document what it found, and put an independent name to the conclusion turns the hardest requirement in E-23 into something an institution can demonstrably satisfy.

How E-23 fits with everything else

E-23 does not exist in isolation, and readers who know other regimes will recognize its family. Its closest relative is the American model risk framework known as SR 11-7, which has governed US banks for over a decade. E-23 shares its logic of independent challenge and risk-tiered oversight, but it reaches further: it covers insurers as well as banks, and it was written for the AI era that SR 11-7 predates.

It also runs alongside, rather than on top of, the AI-specific rules institutions are tracking elsewhere. The EU AI Act regulates AI systems as products and applies to firms with a European footprint; it complements E-23 without duplicating it. Voluntary standards like ISO 42001 and the NIST AI Risk Management Framework are useful scaffolding for building an E-23 program and increasingly show up as the benchmarks institutions ask their vendors to meet. With Canada's broader AI legislation still unsettled, E-23 is for now the binding instrument that governs how regulated financial institutions use AI.

The pattern worth noticing is that OSFI did not write a separate AI law. It built a model risk umbrella wide enough to cover AI, kept the principles neutral about the technology, and then layered AI-specific expectations into each stage. E-23 is technology-neutral on paper and AI-driven in fact, and that is precisely why its weight falls on the parts of AI governance that are hardest to do well.

Simplify E-23 compliance with Conformance AI

The institutions that will find May 2027 comfortable are the ones treating model risk as a live program now, not a policy to draft closer to the deadline. Conformance AI runs an E-23 compliance program that covers that work end to end:

• Inventory and risk classification. We find the models and AI systems across your enterprise, including the vendor tools and the quiet departmental deployments, and risk-rate them the way E-23 expects.

• Governance setup. A risk-rating methodology, review cadences, approval structures, and documentation standards, each proportional to the rating it hangs off.

• Independent testing and validation. Adversarial and behavioral testing of AI systems: explainability evaluation, bias and fairness testing, and validation of black-box vendor models. This is the work that is hardest to staff internally, and it is what we do all day.

• Ongoing monitoring. Drift detection and performance tracking on live models, with thresholds and escalation triggers that match your governance tiers.

• Audit trails and compliance documentation. Every test, rating, review, and approval produces its own evidence as you go, so the record OSFI expects exists before an examiner asks for it, not reconstructed after.

  
  

E-23 will also not be the last rulebook on your desk. We track emerging AI regulation across jurisdictions and map your controls onto the other regimes you face, including the EU AI Act, ISO 42001, and the NIST AI Risk Management Framework, so one program covers more than one regulator.

If E-23 is on your roadmap, talk to us before the scramble starts.

This article is general information, not legal advice. Confirm specific obligations against the current text of Guideline E-23 and with your own advisors.

---

Conformance AI provides AI safety and compliance services. This analysis reflects our perspective as industry participants; it is not legal counsel.