OSFI Guideline E-23 expects Canadian federally regulated financial institutions to manage model risk across each model's life, with clear owners who understand what their models do. When an AI agent is, or relies on, a model, its owner must be trained to rate its risk, track its changes, read validation and monitoring results, and decide when it should stop.
What does E-23 ask of model owners?
E-23 is OSFI's guideline on model risk management. In its revised form it takes a broad view of what counts as a model, explicitly including those built with artificial intelligence and machine learning, and it expects a risk-based, enterprise-wide approach that covers the whole model lifecycle. In substance it expects institutions to:
- Keep an inventory of models and rate each by risk, so that effort is proportionate.
- Set governance with clear roles and accountability, including senior management oversight.
- Manage each stage of the lifecycle: design, data, development, review and validation, approval, deployment, monitoring, change and decommissioning.
- Validate models independently, in proportion to their risk.
- Monitor performance once in use and act when it degrades.
- Apply the same discipline to models from third parties.
Owners sit at the centre. They answer for the model's fitness for its purpose, its use within limits and its ongoing performance. The question of how E-23 applies to AI agents is covered separately; the short answer is that an agent that produces estimates, scores, classifications or decisions from data falls within the guideline's broad view, and so do the models it depends on.
Who does it apply to?
Federally regulated financial institutions supervised by OSFI: banks, federally regulated insurers and trust and loan companies. Provincially regulated institutions answer to their own regulators, though many use E-23 as a benchmark. Within an institution, roles include model owners, developers, users, validators and the senior managers overseeing model risk.
Peer regimes share the logic. UK banks work under PRA SS1/23, covered in PRA SS1/23 and training model owners, and US banks under SR 11-7, covered in SR 11-7 and training model owners in US banks.
What must an agent's model owner understand?
Owners of traditional models know a scorecard or a pricing model. Agents differ in ways the owner must grasp.
What is the model. An agent combines a foundation model from a provider, a brief, sources, connections and bounds. Owners must know which parts are inventoried as models, which are configuration, and how a change to any of them affects risk.
Risk rating by capability. One agent can read at depth 1, draft at depth 2, execute routine work at depth 3 and, rarely, move money at depth 4. Risk rating should follow the highest-impact capability, and owners must re-rate when a capability changes.
Evidence of fitness. An agent's authority should rest on evidence from the institution's own cases. Attest replays the agent against real cases and scores every answer against a floor across seven gates: grounded, refuses, depth, escalates, scope, adversarial and stable. Owners must be able to read those results, explain them to validators and decide whether they support the depth sought.
Expiry and drift. Agent certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day. Owners must plan recertification, understand the operational effect of a drop, and treat drift results as a monitoring signal under E-23.
Third-party models. The foundation model is a third-party model. Owners must know how the provider communicates changes, and how the institution tests their effect before they reach customers.
Use within limits. The agent's bounds, the customer's own limits and the platform guardrails form a chain where the lowest bound wins, and every verdict names the bound that decided it. Owners should read the record to confirm the agent is used as intended.
Decommissioning. Owners must know when and how to retire an agent, and what happens to work in flight.
How do you meet E-23 and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Inventory and risk rating | Each agent and its models inventoried; rated by highest-impact capability | Model inventory with ratings |
| Clear accountability | Named owner per agent, trained before appointment | Owner register; training records |
| Lifecycle management | Brief, source and depth changes go through model change process | Change records with approvals |
| Independent validation | Validators review certification evidence and challenge the owner | Validation reports; findings |
| Ongoing monitoring | Drift and gate results reviewed on a set cycle; recertification planned | Monitoring reports; certification history |
| Third-party models | Provider changes assessed before use | Change impact assessments |
| Senior oversight | Model risk reporting includes agents | Committee packs and minutes |
What will OSFI or an auditor ask?
- Which agents are in your model inventory, and how are they rated?
- Who owns this agent, and what training did they receive?
- What evidence supports its current depth?
- How do you detect drift, and what happened the last time you found it?
- How do you handle changes to the provider's model?
- When did validators last challenge this agent?
The broader point, made in regulators will ask who was trained, not which model you used, is that the owner's competence is now part of the evidence.
What does E-23 not cover?
It does not regulate privacy; PIPEDA governs private-sector personal information federally. It does not cover conduct towards consumers, where the FCAC has a role. It does not prescribe training content or certification. And it does not by itself require any agent to have a person in every decision; it requires risk-based controls the owner can defend. The guide to AI literacy and certification covers the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Model owners and the people who design agents fit Pryme Intelligence Academy's Builder track, about 24 hours plus a capstone agent certified in Attest to depth 2 or higher, with a proctored exam. Those leading regulated, multi-agent deployments go on to the Architect track, which ends with a board review by two Pryme assessors and a certificate valid for 24 months.
Questions people ask
Is an AI agent a model under E-23?
Where it produces estimates, scores, classifications or decisions from data, it is likely to fall within the guideline's broad view. Its underlying models certainly do.
Who should own an agent: business or technology?
Usually the business line that uses it, supported by technology. The owner must answer for its fitness and use.
Does every agent need independent validation?
Validation should be proportionate to risk. Low-impact agents may need light review; agents that act at higher depths need more.