OSFI E-23 is final. What it means for AI at Canadian insurers
Canada's model risk guideline now explicitly covers AI and machine learning, including third-party models. Teams have until May 2027, and an agent counts.
In September, OSFI published the final version of Guideline E-23, Model Risk Management. It takes effect on May 1, 2027 and applies to all federally regulated financial institutions (banks, insurers, trust and loan companies) on a risk-based, proportional basis.
Two things make it more than a refresh of an old banking guideline.
AI is explicitly in scope
The model definition explicitly includes AI and ML methods. E-23 expects an enterprise-wide model inventory, risk ratings and governance across the full lifecycle, and it names AI and ML considerations such as explainability, bias and drift. Third-party models are in scope too.
For anyone running a language model inside an underwriting or claims workflow, the practical reading is simple: an agent that influences a decision is a model, and it belongs in the inventory.
Quebec is moving as well
Quebec's AMF released a draft guideline on the use of AI on July 3, applying to authorised insurers, financial services cooperatives, trust companies and deposit-taking institutions. Comments are due November 7. Insurers operating across provinces should expect overlapping expectations rather than one rulebook.
What we would do now, not in 2027
Most of what E-23 asks for is cheaper to build in than to retrofit. For every AI component we deliver, we now produce:
- An inventory entry: purpose, owner, inputs, outputs, the decisions it influences, and the vendor model behind it.
- A risk rating that reflects how much the output can move a customer outcome.
- An evaluation pack: the test set, the metrics, the thresholds for go-live and the results.
- Monitoring: drift on inputs and outputs, and a sampled human review with an error rate.
- A change log that ties each prompt, model or tool change to a re-run of the evaluation.
None of this slows a project down if it starts on day one. All of it is painful if it starts eighteen months later, when the agent is already making thousands of decisions a week.
Sources
- Guideline E-23 – Model Risk Management (2027), OSFI, September 11, 2025.
- Quebec's Autorité des marchés financiers moves on AI oversight for financial institutions, including insurers, BLG, July 9, 2025.