The window OSFI gave you is more than half gone. OSFI Guideline E-23, Canada’s model risk management regime, was published on 11 September 2025 with a compliance deadline of 1 May 2027. That is a 19.6-month window, and 10.4 months of it have already elapsed. Federally regulated financial institutions have 40 weeks left.
Nine months is long enough to stand up an inventory, a validation cadence, and an evidence trail. It is not long enough to invent the discipline from scratch. Regulated institutions still building their own frameworks in 2026 need an operator, not another advisory deck.
What E-23 will require on 1 May 2027
- An enterprise-wide inventory of all models, including AI and machine-learning systems, with owners, purposes, and criticality tiering.
- Independent validation of every high-tier model before deployment and on a defined cadence thereafter.
- Model risk management framework with policies, roles, standards, and reporting to the senior management and board.
- Continuous monitoring for performance drift, data-quality issues, and unintended outcomes, with defined thresholds and escalation paths.
- Explicit governance of third-party and vendor models, including generative and agentic AI acquired from external providers.
- Documentary evidence sufficient for the regulator to reconstruct the lifecycle of any model in scope.
