Canada · OSFI

AI models come into OSFI's model risk scope on 1 May 2027. Including the ones your providers run.

Guideline E-23 takes effect for all federally regulated financial institutions on 1 May 2027, with guidance for AI and machine learning and for third-party models. Guideline B-10 already expects you to manage risk from third parties and their subcontractors. No federal AI act is in force, so these are the texts that set the evidence question.

The AI Use Assessment →Book a conversation

What applies

Model risk, third-party risk and provincial privacy law.

The texts below are OSFI's and Quebec's. What each requires of your institution is for your counsel to grade.

Instrument	What it asks	What it means for evidence
OSFI Guideline E-23, Model Risk Management, effective 1 May 2027	Applies to all federally regulated financial institutions. Adds guidance for AI and machine learning models, including explainability and changes to self-learning models, and for third-party models, which should receive validation and monitoring commensurate to their risk.	A model inventory that reaches models inside providers, and validation and monitoring records for each third-party model.
OSFI Guideline B-10, Third-Party Risk Management	You identify, monitor and manage risk from third parties and from their subcontracting arrangements. Contracts should give timely access to information and the right to conduct or commission an independent audit (section 2.3.3).	Information and audit rights that reach the AI in a provider's supply chain.
Quebec, Law 25	Where a decision is based exclusively on automated processing, the individual is informed; on request, the personal information used and the principal factors and parameters are disclosed; and the individual can submit observations to a staff member who can review the decision. In force since September 2023.	A register of where AI decides on its own, and who reviews it.
Federal AI legislation	No federal AI act is in force. The proposed Artificial Intelligence and Data Act died with Bill C-27 on prorogation in January 2025.	OSFI's guidelines and provincial privacy law set the evidence question.

The seven questions, in OSFI terms

Four your third-party risk work already asks. Three it does not.

1Is the model developed in-house, by your group, or by a third party?E-23 brings third-party models into the model inventory

2Is the provider a third party under B-10, or a subcontractor in its supply chain?A direct service to you, or part of a chain supporting one

3What rights do you hold?Timely access to information · right to conduct or commission an independent audit · none

4Where is each party, and does location change what can be obtained?Enforceability, data access and audit rights; offshoring

5What authority has been delegated to the AI?Productivity · analytical · decision · transactional · agentic · actuating

6What could failure do?Immaterial · contract breach · financial loss · customer harm · critical-operation disruption

7What evidence can reasonably be required?None · disclosure · attestation · event notification · audit · continuous telemetry · deterministic control

"No reasonable reach" is a documented conclusion, not a gap. The determination at each step is yours and your counsel's.

One register

A model inventory that reaches into your providers.

The AI Use Assessment extends your existing inventory down the chain, so E-23 and B-10 are answered from the same entries.

One entry

The register as the E-23 model inventory

Each entry carries the model, the provider that runs it and the platform behind that, the authority delegated to it, the consequence of failure, the rights you hold, and the evidence obtainable.

Before 1 May 2027

What to have in place

Third-party AI models identified, including those inside providers
Validation and monitoring proportionate to each model's risk
B-10 information and audit terms reaching AI at each renewal

Who it is for

Federally regulated financial institutions.

Banks and foreign bank branches

Credit decisioning, fraud and AML models, often inside a platform provider.

Life and P&C insurers

Pricing, underwriting and claims models, including those run by distributors.

Trust and loan companies

Origination and servicing platforms with AI embedded by the vendor.

Regulatory position as at 26 October 2026. Not legal advice: every legal determination is yours and your counsel's.

This page summarises published texts for orientation. Your counsel grades what is a requirement and what is an expectation for your institution.