Governance, risk & compliance

OSFI Guideline E-23: Model Risk Management (including AI and machine learning) OSFI page dated 11 Sep 2025; effective 1 May 2027

A supervisory guideline of the Office of the Superintendent of Financial Institutions, not a statute.

It applies, risk-based and proportionate to size and complexity, to all federally regulated financial institutions: banks, foreign bank branches, life and fraternal insurers, property and casualty insurers, and trust and loan companies, and takes effect on 1 May 2027. It covers every model, meaning any theoretical, empirical, judgmental or statistical technique, including AI and machine learning (it uses the OECD definition of AI) and flags the extra risk of black box behaviour, autonomous decisions and drift.

Three outcomes: model risk is understood across the enterprise, managed with a risk-based approach, and governed over the whole model life cycle. Twelve principles: 1.

1 organizational enablement, 1. 2 model risk management framework, 1.

3 appropriate use of models, 2. 1 model identification, 2.

2 model risk rating, 2. 3 risk management intensity, 3.

1 policies, procedures and controls, 3. 2 data, 3.

3 development, 3. 4 review, 3.

5 deployment, 3. 6 monitoring and decommissioning, plus Appendix 1 on information tracking.

Only the OSFI page (headings, scope, outcomes and principle titles) was read, not the full guideline text, so the requirement wording below is a summary of the principle titles. The OSFI page carries two dates (11 September 2025 and 29 November 2023) and which is the final publication date was not settled.

Provincially regulated institutions, investment dealers and credit unions are outside it. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses OSFI Guideline E-23: Model Risk Management (including AI and machine learning) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to OSFI Guideline E-23: Model Risk Management (including AI and machine learning) compliance

Most of OSFI Guideline E-23: Model Risk Management (including AI and machine learning) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to OSFI Guideline E-23: Model Risk Management (including AI and machine learning), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against OSFI Guideline E-23: Model Risk Management (including AI and machine learning) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports OSFI Guideline E-23: Model Risk Management (including AI and machine learning) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.