OSFI Guideline E-23 sets out how federally regulated financial institutions in Canada should manage model risk across a model's life, with clear roles. The model owner is central: accountable for a model's use, performance and remediation. As banks and insurers apply E-23 to AI, owning an AI agent becomes a recognisable career in Canadian finance.
What does E-23 ask of model owners and the people around them?
E-23 is OSFI's guideline on model risk management. In substance, it expects an institution to manage model risk across the enterprise and across the lifecycle: the rationale for a model, its data, development, independent validation, approval, deployment, ongoing monitoring and eventual retirement. It expects a model inventory, a risk-based approach so that higher-risk models get more scrutiny, and clearly defined roles and responsibilities. OSFI has made clear, in substance, that models using AI and machine learning fall within this framework.
The roles it relies on are familiar to anyone who has worked in bank risk:
- Model owner: accountable for the model, its appropriate use, its documentation, its monitoring and fixing it when it falls short.
- Model developer: designs and builds it.
- Model validator: tests it independently of the developer.
- Model user: relies on its output in decisions.
When the "model" is an AI agent, the owner's job expands. The agent has instructions, sources, tools and limits as well as an underlying model, and each can drift or fail.
Who does it apply to?
E-23 applies to federally regulated financial institutions: banks, federally regulated insurers, and trust and loan companies. Provincially regulated credit unions and insurers answer to provincial regulators, who may have their own expectations. FCAC oversees consumer protection obligations for federally regulated institutions, and PIPEDA governs personal information in the private sector.
For job seekers, the main employers are the large banks, the federally regulated insurers and their service centres, mostly in Toronto, Montreal and other major cities, with hybrid arrangements common in some roles.
What does a model owner do when the model is an agent?
The general role is described in what does an AI agent owner do. Under E-23, the work becomes specific:
| Lifecycle stage | What the owner does for an agent |
|---|---|
| Rationale | Writes down what the agent is for and what it must not do |
| Data | Confirms which sources it may use and how reliable each is |
| Development | Works with builders on its brief, bounds and depth |
| Validation | Supplies real cases for independent testing and acts on findings |
| Approval | Presents evidence to the approving authority |
| Monitoring | Reviews override rates and reasons, incidents and drift |
| Remediation | Drops the agent's depth or pauses it when it falls short |
| Retirement | Decommissions it cleanly when it is replaced |
Owners rarely start as owners. Most come from operations leadership, credit or claims management, or product roles, after time as reviewers or team leads who worked closely with the agent. The definition of the role is in what is an AI agent owner, and the path in Canada is in how to become an AI agent owner in Canada.
Which competence do employers expect, and how do you show it?
| Requirement | What employers will expect of you | How to show it |
|---|---|---|
| Clear accountability | Take ownership of outcomes, including failures | An example of a process you owned end to end |
| Lifecycle management | Understand each stage and your part in it | A description of a system or process you took from design to use |
| Data and source quality | Judge which sources an agent may rely on | A case where you challenged a data source |
| Independent validation | Support validators and act on their findings | Findings you remediated, and how |
| Ongoing monitoring | Read performance and decide when to act | A trend you spotted and what you changed |
| Risk-based scrutiny | Match effort to the agent's risk | An explanation of why one process needed tighter control than another |
| Documented competence | Show the skills in a form the institution can file | A credential checkable at source, plus a record of decisions |
What might a Canadian interviewer ask?
- "The validator finds the agent mishandles a type of case one time in ten. What do you do?" Restrict or hold that capability, fix the cause, have it retested, and document each step.
- "How would you know your agent needed revalidation?" When its scope, sources or underlying model changed, or when monitoring showed drift.
- "Who decides whether the agent can act without review?" An approving authority, based on evidence. The owner presents the case; the owner does not decide alone.
- "What is the difference between an owner and a user?" The user relies on its output; the owner answers for the model being fit for that use.
A credit adjudication team lead we will call Priya prepared by describing how she had already acted as the de facto owner of a scoring rule set, including the time she pushed back on a change that would have weakened it. That story did more than any title.
What does E-23 not cover?
It does not apply to provincially regulated institutions directly. It does not certify individuals or require a particular qualification for owners. It does not set consumer protection rules, which come from FCAC and other legislation, or privacy rules, which come from PIPEDA. It does not prescribe exact tests; institutions design them proportionately. And Canada has no federal AI act in force, so E-23 and existing law, not an AI statute, frame the role.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's Builder track fits people moving towards ownership: it covers designing, training and certifying agents, ending in a capstone agent certified in Attest to depth 2 or higher. Most owners start with the Operator track first, because owning an agent means understanding the review decisions it generates. Each track is the key to the next.
Questions people ask
Is model owner an entry-level role?
No. It usually follows experience as a reviewer, team lead or product manager working with the agent. Start with roles that put you close to its decisions.
Is the role similar in other markets?
Yes, in substance. Compare how to become an AI agent owner in Singapore. Employers' training for owners in Canada is covered in OSFI Guideline E-23 and training model owners of AI agents.
Where can I see the wider career picture?
The guide to AI agent jobs and careers shows how ownership connects to review and building roles.