Canadian banks should treat most AI agents as models under OSFI Guideline E-23. An agent turns inputs into classifications, recommendations and actions, which brings it inside model risk management. The practical work is to rate each agent capability by risk, assign accountable owners, record it in the model inventory, and scale controls to the rating.
What does E-23 require, in plain words?
OSFI's Guideline E-23 sets out expectations for managing model risk at federally regulated financial institutions. In substance, it asks for:
- an enterprise-wide model risk management framework approved and overseen by senior management;
- a clear, broad definition of what counts as a model, including models that use AI and machine learning;
- a model inventory covering every model in use, with its purpose, owner, risk rating and status;
- a risk rating for each model that drives how much scrutiny it receives;
- controls across the whole model lifecycle, from design through independent review, approval, monitoring and retirement;
- clear roles and accountability, with independence between those who build and those who review.
The guideline is principles-based and proportionate. A small institution with few models needs a simpler framework than a large bank, but both must cover the same ground. Our companion piece on the E-23 model lifecycle and agent validation goes stage by stage.
Who does it apply to?
Federally regulated financial institutions supervised by OSFI, including domestic banks, foreign bank branches and federally regulated insurers. The framework applies to models used across the business, not only to capital or pricing models. For a short answer on scope, see how OSFI E-23 applies to AI agents.
Why does E-23 reach AI agents?
The argument is about what agents do, not what they are called. An agent reads a customer's request, classifies it, decides which policy applies, and either drafts or takes an action. Each step processes inputs into outputs used in decisions. That is model behaviour, and E-23's broad definition and explicit coverage of AI and machine learning methods bring it in.
Agents also stretch the framework in three places.
Risk rating. E-23 asks institutions to rate model risk by the model's materiality and complexity and the uncertainty in its outputs. For an agent, add a factor most rating schemes lack: what the agent can do. An agent that can execute a payment carries more model risk than one with the same model that only drafts, because its errors reach customers without a person in between. Rate per capability.
Ownership. A traditional model has one owner. An agent has a business owner for its outcomes, an operator for its configuration, a supplier for the underlying model, and owners for each system it touches. E-23 expects clear accountability; for agents, write down who owns each part.
Change. Model risk frameworks assume models change on the institution's schedule. Agents change when the model provider updates a model, when a source document is edited, or when a tool is added. The framework needs triggers for each, not only an annual review.
How do you apply E-23 to agents?
Take an illustrative case. A Canadian bank runs agents in three places: summarising call notes for advisers, answering online banking questions, and drafting collections letters. Under its E-23 framework, it records three inventory entries with capabilities listed under each. The summariser is rated low. The online agent is rated medium because it states fees and rates to customers. The collections agent is rated high because its letters affect customers in difficulty and carry conduct risk. Validation depth, approval level and monitoring frequency follow the ratings.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Enterprise framework | Model risk policy updated to name agents and their components | Approved policy |
| Model definition | Definition covers agents, their briefs, sources and tools | Definition and scoping decisions |
| Inventory | One entry per agent, capabilities listed, owners named | Inventory records; see a model risk inventory entry template |
| Risk rating | Rating per capability including what the agent can do | Rating rationale |
| Lifecycle controls | Validation, approval and monitoring scaled to rating | Validation reports; approvals; monitoring reports |
| Accountability | Named owners for outcomes, configuration and supplier relationship | Accountability map |
| Independence | Review by a function separate from the builders | Reviewer names and reporting lines |
| Change triggers | Model, source and tool changes prompt review | Change log linked to reviews |
What will OSFI ask?
- How does your model definition treat AI agents?
- How many agents are in your inventory, and how are they rated?
- What does an agent's risk rating take into account beyond the model itself?
- Who is accountable for each agent's outcomes?
- How do you learn of and respond to changes by the model provider?
- How does model risk reporting to senior management include agents?
What does E-23 not cover?
It does not settle third-party arrangements, technology and cyber risk, or operational resilience, which OSFI addresses through separate expectations. It does not cover privacy, which falls under PIPEDA. It does not cover consumer conduct, where the FCAC supervises. For a cross-border view, US banks apply similar ideas through interagency guidance; see NIST AI RMF and SR 11-7 model risk for agents in US banks. For the full map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is the language model inside an agent a separate model under E-23?
It can be recorded as a component, often as a vendor model. But the risk that matters is the agent's behaviour, which depends on the brief, sources and tools too. Most institutions inventory the agent and list the model within it.
Do agents that only draft for staff need to be in the inventory?
Yes, if they produce outputs used in decisions. Their risk rating may be lower, and controls lighter, but leaving them out hides model risk that grows if staff stop reviewing drafts.
Does E-23 require explainability for agents?
It expects the institution to understand a model's method and limitations to a degree suited to its risk. For agents, recording which facts and sources each output relied on gives a practical form of explanation.