← Security Watch

Security Watch · Canada · Sept. 11, 2025

OSFI's final E-23 brings AI models under model-risk rules from May 2027

All models, from actuarial tools to machine learning and AI, need governance, inventories and risk ratings.

Regulation

What happened

OSFI released the final Guideline E-23 on model risk management. It applies to all models regardless of technology, including AI and machine learning, and does not ban any approach. It takes effect in May 2027 after an 18-month transition and applies to all federally regulated financial institutions, scaled to their size and risk. (Office of the Superintendent of Financial Institutions (OSFI), Sept. 11, 2025)

What it means for Canada

From May 2027 every model at a federally regulated financial institution, AI included, must be inventoried, risk-rated and governed through its lifecycle. Vendor AI counts.

Sectors
Banks · Insurers · Trust and loan companies · AI vendors to them
Tools involved
Machine-learning and AI models · Vendor AI products
Canadian rules
OSFI E-23 (model risk, in force May 2027)

Takeaways for Canadian businesses

  1. BusinessIf you are an institution, start your AI model inventory and risk ratings now.
  2. BusinessIf you sell AI to a bank or insurer, prepare documentation on purpose, data, limits, validation and monitoring.
  3. BusinessAgree with clients who monitors model performance after deployment and how drift is reported.

For the Canadian AI sector

Canadian AI vendors selling to financial institutions will be asked for documentation, validation evidence and monitoring data to fit their clients' E-23 inventories.

Written by AgentsNorth from the source below. General information, not legal or security advice.

Related briefs

Canada Oct. 23, 2026 · Canadian Centre for Cyber Security, alert AL26-026

Cyber Centre alert: patch PHP now for the AI-assisted PHP2Shell remote code execution flaws

The Canadian Centre for Cyber Security issued alert AL26-026 on PHP2Shell, two critical PHP flaws that let an unauthenticated attacker run code, and updated it with a third unpatched bug.
What it means for Canada: The Cyber Centre directed this alert at Canadian IT teams. PHP runs a large share of web apps, so Canadian retailers on WordPress or WooCommerce, government and municipal sites,…
RegulationAI Agent Defence
Canada Oct. 13, 2026 · Innovation, Science and Economic Development Canada

Canada and the UK renew their AI security partnership

Focus areas: AI security standards, sharing on frontier-AI risks, and coordinated model evaluations.
What it means for Canada (our assessment): Canada and the UK will work on shared AI security standards and coordinated model evaluations. Canadian AI vendors may soon be asked to meet them.
RegulationAI Agent Defence
Canada July 2026 · Office of the Superintendent of Financial Institutions (OSFI)

OSFI sets sound practices for generative and agentic AI at banks and insurers

Limits on autonomy, human oversight for high-impact decisions, and tight control of AI-written code.
What it means for Canada: OSFI expects banks and insurers to set limits on AI autonomy, keep humans accountable for material decisions and control AI-written code. Their AI vendors will be asked to show the same.
RegulationAI Agent Defence

See Canadian AI use cases in Security & Fraud

Get new Canadian AI agent use cases each week

New use cases, one prompt to steal and one failure to avoid. Free. Unsubscribe anytime.