Technology strategy · Financial services
OSFI’s model risk guideline covers AI models from 1 May 2027.
OSFI’s model risk guideline treats AI models as models, so they are listed, rated and governed in proportion to their risk. It takes effect on 1 May 2027 for every federally regulated financial institution.
Why the answer holds
OSFI published Guideline E-23: Model Risk Management (2027) on 11 September 2025, and it takes effect on 1 May 2027. OSFI describes it as a principles-based guideline for managing model risk across the whole institution, using a risk-based approach. It does not set out a separate regime for AI.
The reason is in its definition. A model is an application of theoretical, empirical or judgmental assumptions or statistical techniques, including AI and machine learning methods, that processes input data to generate results. OSFI says in its accompanying letter that it left the definition intentionally broad, and that the outcomes and principles do not vary with the algorithmic approach.
So an AI model sits under the same duties as any other model, with extra considerations added where AI behaves differently. OSFI states plainly that institutions are accountable for their use of models. That accountability is what a leader should read first.
Who it applies to
The guideline applies to all federally regulated financial institutions, including foreign bank branches and foreign insurance company branches, to the extent consistent with Guideline E-4. OSFI’s page lists banks, life insurance and fraternal companies, property and casualty companies, and trust and loan companies. It is not a guideline for banks alone.
That is a change in reach. The letter says the draft revised the earlier guideline written for deposit-taking institutions, and that expanding the scope to all models at all federally regulated institutions remains a key revision. The letter also records that application to federally regulated pension plans was reconsidered.
Application is proportional. The guideline applies on a risk basis, in proportion to an institution’s size, strategy, risk profile, complexity of operations and interconnectedness. In our reading, a smaller institution with few models is not expected to build what a large bank builds.
How it treats AI models
The overview says that AI and machine learning models are growing in number and that models with dynamic self-learning and autonomous decision-making may become prevalent. The guideline then adds AI-specific points to its general principles. We read five of them as the ones that matter most to a leader.
First, explainability. The guideline lists explainability requirements, which may vary with the model’s purpose, level of autonomy, regulatory requirements or potential impact on customers and stakeholders. For black box approaches or autonomous models, institutions should consider the need for alternative controls.
Second, data. The guideline asks that data be traceable, with documented lineage and provenance, and it notes that AI models can easily mirror unwarranted relationships in the data. The letter adds that the rigour of data lineage should match the model’s risk rating.
Third, monitoring. The guideline asks for processes that cover autonomous decision making, autonomous re-parametrization and the elevated potential for model drift. We did not find a definition of drift in the guideline, and we take it to mean a model’s results moving away from what it was approved to do.
Fourth, change. The letter asks institutions to set internal criteria for when a self-learning model has materially changed. Fifth, contingency: the guideline expects plans for a model that becomes unavailable, deteriorates or fails.
Models from vendors
Many AI tools are bought from vendors, and the guideline does not exempt them. Institutions are to identify and track models in use, including vendor and third-party models. Every identified model carries a risk rating, and independent review covers third-party models and their sub-components, including data and libraries.
The letter is direct about the consequences. Third-party models should receive validation and monitoring commensurate to the model risk, and OSFI states that there is no grace period for them. An exceptions policy may allow limited use before validation is complete.
Documentation is the practical difficulty. OSFI made no specific revision for vendors that are unwilling to share it, and says it is up to each institution to ensure adequate documentation is provided. That question is better settled in the contract than after deployment.
What changes on 1 May 2027
On that date the guideline takes effect for all federally regulated financial institutions. The draft went out for consultation from 20 November 2023 to 22 March 2024. Stakeholders said twelve months was too short, and OSFI set the date after weighing that request and noting that many institutions had already begun work.
The sources leave two questions open. We found no statement on how or when supervisors will assess readiness. Nor does the letter say that the earlier guideline is withdrawn.
OSFI and the Financial Consumer Agency of Canada reported in 2024 that many institutions responding to a voluntary questionnaire said they were waiting for the final guideline before fully committing to AI-related actions. The report says its practices are not guidance. We read it as evidence that the guideline is already shaping decisions on AI.
What this means for you
OSFI has written an expectation and no checklist, so the steps below are our reading of it. They do not amount to meeting the guideline, and only OSFI can say what it expects of your institution.
- List every model in use, vendor models included, and give each an owner. The guideline sets out a minimum record for every identified model, including its risk rating and origin.
- Rate each model on quantitative and qualitative factors, which include complexity or level of autonomy, customer impact and regulatory risk, and let the rating set the depth of review.
- Name who answers for explainability and monitoring on each AI model, and ask your vendors for the documentation you will need.
- Decide what the board sees about model risk and how often, because senior management is responsible for reporting model risk to the board of directors.
These steps belong with your wider governance work. Our work on technology strategy covers governance and compliance, and our Financial services page sets out the evidence we have gathered for the sector. If it would help to test your own list against this reading, request a briefing.