[Infographic] Navigating E-23: Key Trends for Canadian Banks

Last week in Montreal, I spoke with banks, insurers, and VC firms about the future of AI enablement in financial services. One theme kept coming up: OSFI’s new E-23 guideline. This framework is more than just a compliance update; it’s a call for Canadian banks and insurers to rethink how they manage model risk in the age of AI.

E-23 sets a clear expectation: model risk management (MRM) must evolve. The guideline expands oversight beyond traditional financial models to cover AI, machine learning, and even third-party systems. It also aligns Canadian institutions with global standards such as the U.S. SR 11-7, the U.K.’s SS 1/23, and the EU AI Act

So, how should Canadian financial institutions respond? In my view, they have two choices:

1. Plug the gaps in their current manual MRM frameworks by hiring additional staff.
   
2. Modernize, reducing costs while improving trust and resilience.
   

The institutions that choose modernization will be better positioned to thrive under E-23.

Trend 1: Expanding the Scope of Models

E-23 requires a centralized inventory of all models that pose material or non-negligible risk, and that includes AI/ML models and black-box vendor solutions. Banks can no longer treat these tools as outside the risk framework.

What this means: More models will be in scope, requiring stronger lifecycle governance—from development and validation through monitoring and decommissioning.

Trend 2: Manual vs. Modernized MRM

The old playbook of manual reviews, spreadsheets, one-off monitoring, and static documentation can’t keep pace with the volume and velocity of AI models. That’s why modernization isn’t just desirable. It’s necessary.

Modernizing done right means:

• Automating testing, documentation, and monitoring
  
• Embedding AI transparency, fairness, and accountability into frameworks
  
• Scaling oversight with new techniques like AI Teaming and Judge LLMs
  

These capabilities lower the cost of compliance while building greater trust with regulators, boards, and customers.

Trend 3: Proportionality in Oversight

E-23 emphasizes proportionality: oversight should scale with a model’s materiality and complexity. Smaller insurers may lean more heavily on external validators, while large banks will need to develop internal infrastructure to manage at scale.

What this means: Expect to see risk rating systems evolve to measure AI complexity, explainability, and fairness risk, not just financial exposure.

Trend 4: Stricter Third-Party Model Governance

Using a vendor model doesn’t reduce regulatory accountability. E-23 makes clear that banks are responsible for validation, monitoring, and controls, even when the model’s internals are opaque.

What this means: Vendor-provided models must follow the same model risk management standards as internally built models, with extra focus on independent validation and oversight of the vendor relationship.

Trend 5: Integration into Enterprise Governance

Perhaps the most significant theme is integration. E-23 requires banks to embed MRM into enterprise-wide data governance, ethics, and strategy. This will mean board-level reporting, cross-functional AI risk committees, and proactive regulator engagement.

What this means: The winners will be those who see E-23 as an opportunity to strengthen governance and fuel AI innovation with organization alignment and clear accountability.

Preparing for E-23

E-23 is not just about meeting regulatory expectations. It’s about future-proofing. To prepare, Canadian banks and insurers should:

1. Expand model inventories to capture AI/ML models and third-party tools.
   
2. Invest in scalable infrastructure to automate testing, monitoring, and documentation.
   
3. Strengthen governance and accountability, from executives to the board.
   
4. Adopt AI-ready validation practices, including human-in-the-loop and continuous monitoring tied to data quality controls.
   

Institutions that modernize now will reduce regulatory risk, improve trust, improve model velocity while driving down costs, and unlock safe innovation in the years ahead.

For a visual breakdown of these trends, see the full E-23 Executive Summary Infographic:

ValidMind-E-23-infographic