How does OSFI E-23 apply to AI agents?

Across the whole model lifecycle. OSFI Guideline E-23 sets expectations for model risk management at federally regulated financial institutions, and an AI agent that informs or makes decisions is a model for its purposes. That means it needs a clear rationale, sound data, validation before use, approval, monitoring in use and a planned retirement, all proportionate to its risk.

What does E-23 ask, in substance?

OSFI supervises federally regulated financial institutions in Canada, such as banks and federally regulated insurers. E-23 is its guideline on model risk management. In substance it expects institutions to:

• Define models broadly and keep an inventory of them, including those using AI.
• Rate model risk so that the intensity of controls matches each model's materiality and complexity.
• Manage the lifecycle: model rationale, data, development, validation, approval, deployment, monitoring and decommissioning, each with clear responsibilities.
• Govern model risk through an enterprise framework, with senior management accountable and the board informed.

The lifecycle view is examined in OSFI E-23 model lifecycle and AI agent validation.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How does the lifecycle change for an agent?

Rationale must cover each capability. "Customer service agent" is not a rationale; "answers card queries, waives fees up to a limit, drafts complaint replies" is.

Data includes everything the agent reads at run time, not only training data. Policies, customer records and emails all shape its outputs.

Validation must test the assembled agent: its instructions, sources, tools and limits together, on the institution's own cases.

Deployment has to enforce the limits validation assumed. If validation tested fee waivers up to a set amount, the deployed agent must not be able to exceed it.

Monitoring must catch changes the institution did not make, such as a model provider's update.

Decommissioning must remove the agent's credentials and tool access, not only switch off the interface.

The fit with Canadian bank practice is covered in OSFI E-23 model risk and AI agents in Canadian banks.

Concrete examples: what may the agent do, and what stays with a person?

An illustrative example

Take a Canadian bank that deploys an agent to prepare small business credit memos. The agent reads financial statements and the applicant's banking history, and drafts a memo with a recommended risk grade.

Applying E-23, the model risk team rates it high: the grade drives approval authority and pricing. The rationale is written per capability. Validation tests the agent on past applications with known outcomes, including cases with incomplete statements. Approval comes from the model risk committee, with a condition that grades below a threshold are always reviewed by a senior credit officer. In use, the bank tracks how often officers change the grade and re-validates when the model provider updates its model. When the bank later retires the agent, its access to the banking history system is revoked the same day.

Which controls meet E-23 for agents?

• An inventory entry per agent, covering capabilities, sources, tools, owner and risk rating.
• Capability-level rationale and limits approved before deployment.
• Validation of the whole agent on the institution's own cases, by an independent team.
• Enforcement of validated limits at the moment of action.
• Monitoring of outcomes, overrides and provider changes.
• A decommissioning checklist that removes access.

The UK's equivalent is compared in whether PRA SS1/23 covers AI agents. Privacy duties sit separately under federal privacy law; see how PIPEDA applies to AI agents. The cross-regulation map is in AI agent regulation, mapped to controls.