Free Consultation
Home Regulations OSFI Guideline E-23 — Model Risk Management (2027)
Regulation

OSFI Guideline E-23 — Model Risk Management (2027)

Canada — OSFI · Canada (federally regulated financial institutions) · Regulatory guidance

This page is a plain-English summary written by us, not legal advice — the official text is linked above. Our catalogue was last reviewed 2026-08-15; that is a review of the whole catalogue, not an independent legal verification of this entry.

Authority
Canada — OSFI
Jurisdiction
Canada (federally regulated financial institutions)
Type
Regulatory guidance
Status
In force
Maximum penalty
OSFI supervisory expectations (no statutory fines)
Catalogue reviewed
2026-08-15
Official source checked
2026-08-23 — unchanged since our last read
Official text

Status

Finalized 11 Sep 2025; effective 1 May 2027. Scope expanded to explicitly include AI/ML and non-quantitative models — the Canadian counterpart to US SR 26-2 for banks, insurers and trust & loan companies.

Requirements (3)

E-23 · Governance mandatory

Model risk governance & lifecycle

Operate an enterprise-wide model risk-management framework over the full model lifecycle, with a model inventory and risk-based materiality rating that explicitly captures AI/ML models.

E-23 · Validation mandatory

Independent validation

Independently validate models before first use and periodically thereafter — conceptual soundness, data quality, performance, and bias/fairness.

E-23 · Monitoring mandatory

Ongoing monitoring & human oversight

Continuously monitor model performance and drift, document model decisions, and ensure appropriate human oversight of outputs.

Dates that matter

Deadline 2027-05-01 · in 250 days

OSFI Guideline E-23 — Model Risk Management (incl. AI/ML) effective

Federally regulated financial institutions must manage model risk across the lifecycle — inventory, risk-based materiality, independent validation, monitoring and human oversight — explicitly covering AI/ML models.

Action: Stand up or extend a model risk-management framework and validation function covering AI/ML before 1 May 2027.

Get told when this changes

Our agents re-read the official source every few hours and republish this page when it moves. Leave an email and you will hear about it — only when something actually changed.

Double opt-in. One confirmation email, then nothing until this regulation moves. Unsubscribe in one click.

Compare it with another regulation

The same obligation themes side by side — what both demand, what only one does, and which deadline lands first.