OSFI Guideline E-23, with the AMF guideline on AI

Key dates

E-23, final

Published 11 September 2025 (OSFI)

E-23, in effect

1 May 2027, for all federally regulated financial institutions

AMF guideline, in effect

1 May 2027 (AMF); the guideline’s cover is dated March 2026

E-23, the draft

Published for consultation on 20 November 2023, until 22 March 2024

OSFI describes the timing as an effective date in May 2027 “following an 18-month transition period” (backgrounder). It revised the implementation date to 1 May 2027 after comments on the draft (letter).

What OSFI Guideline E-23 covers

E-23 applies to all federally regulated financial institutions, including foreign bank branches and foreign insurance company branches: banks, life insurance and fraternal companies, property and casualty companies, and trust and loan companies. Pension plans are outside its scope. It applies on a risk basis, proportional to each institution’s size, strategy, risk profile and complexity.

A model, in E-23, is “an application of theoretical, empirical, judgmental assumptions or statistical techniques, including AI/ML methods, which processes input data to generate results.” OSFI says it left the definition intentionally broad. Its three outcomes: model risk is well understood and managed across the enterprise, is managed using a risk-based approach, and model governance covers the entire model lifecycle (E-23, A.4 and A.5).

The model inventory and Appendix 1

Principle 2.1 says institutions should identify and track all models in use or recently decommissioned. The inventory is the institution’s system of record for models whose inherent risk is non-negligible, and should be accurate, evergreen and subject to robust controls. Appendix 1, “Information tracking for models”, lists what institutions should maintain:

• At a minimum, for each identified model: model ID; model name and description of key features and use; model risk rating; model owner; model developer; model origin (for example, internally developed or vendor).
• Also, for models with non-negligible risk: model version; date of deployment into production; model reviewer; model approver; model dependencies; data sources and description; approved uses; model limitations; date of the most recent review; monitoring status; next review date.

Risk rating, lifecycle and roles

Each model should be assigned a model risk rating (Principle 2.2), on quantitative and qualitative factors that include the model’s complexity or level of autonomy, and the rating sets how intense its review, documentation, approval and monitoring are (Principle 2.3). The lifecycle runs from design through review, approval, deployment and monitoring to decommission, and the review should be independent from model development (Principle 3.4). E-23 names the roles: model owner, developer, reviewer, approver, user and stakeholder. Models from third-party vendors are within the framework.

The AMF Guideline for the Use of Artificial Intelligence

The AMF guideline applies to authorized insurers, financial services cooperatives, authorized trust companies and other authorized deposit institutions in Quebec (insurers, deposit institutions and trust companies). It supplements the AMF’s Model Risk Management Guideline, and defines an AI system in the OECD’s words: a machine-based system that infers from its input how to generate outputs such as predictions, content, recommendations or decisions.

• Inventory (6.1): the institution should keep a regular record of all models and AI systems, and list those with non-negligible risk in a centralized inventory, such as the model inventory.
• Risk rating (6.2): each AI system should get a risk rating, updated regularly, with the model risk rating of each of its models among the factors.
• Accountability (4.1, 4.2): the board has its own duties, and a member of senior management is accountable for all AI systems in the institution; each system is under its model owners’ responsibility for its whole lifecycle.
• Clients (8.3): the institution should inform clients when they are communicating with an AI system, and explain decisions in plain language.

Annex 2 lists examples of information specific to AI systems, among them the involvement of a person in interpreting outcomes (human in the loop), validation triggers and the system’s risk rating (the guideline).

How GovernanceOS™ helps

• Check a register, free, in your browser: goslint carries a rule pack for E-23 Appendix 1 (17 fields) and one for the AMF guideline (13 fields), and shows what to fix in each regulator’s own words.
• Download the register template for E-23 or the AMF guideline, with the columns goslint checks.
• E-23 Studio: nine documents in the Defensible AI Library that fill from your records.
• Each gate on a GovernanceOS record names one approver and hashes the evidence at that moment, so the reviews and approvals E-23 describes are kept as records, by design. How it works
• The OSFI Guideline E-23 endorsement on the AI governance certification, added to level 2 or 3, for practitioners.

Conformance with any framework is self-declared. GovernanceOS implements; it does not certify an institution.

Sources

• OSFI, Guideline E-23, Model Risk Management (2027)
• OSFI, letter on the final Guideline E-23, 11 September 2025
• OSFI, backgrounder on Guideline E-23
• AMF, Guideline for the Use of Artificial Intelligence (PDF)
• The E-23 and AMF rows, with the date each was checked