If you have read about OSFI Guideline E-23, you have probably read something written for model risk practitioners: lifecycle diagrams, control taxonomies, forty-page gap assessments. That material is useful to the people who will run the program. It is not much help to the people who have to approve it.
This post is for the second group: board members, executives, and the risk and compliance leaders who have to decide what to do about E-23 before May 1, 2027, and how much to spend doing it.
What E-23 actually asks of you
OSFI Guideline E-23, Model Risk Management, takes effect on May 1, 2027 for every federally regulated financial institution: banks and other deposit-taking institutions, federally regulated insurers, and foreign bank branches. It applies to every model, whether your institution built it or bought it, and its definition of a model explicitly includes artificial intelligence and machine learning. A credit scoring model, a fraud model, a generative AI assistant from a vendor, and a pricing tool built in a spreadsheet are all inside the same conversation.
Stripped of the practitioner language, E-23 asks five things of an institution:
- Know what you have. Keep a current inventory of your models, with a minimum set of facts about each one. Appendix 1 of the guideline lists those facts: six for every model you identify, and eleven more for the models you decide carry real risk.
- Rate the risk. Decide, and record, how much risk each model carries, so that a high-risk model gets more scrutiny than a low-risk one.
- Name the people. Every model needs an accountable owner, and the ones that matter need a developer, a reviewer, and an approver who are not the same person wearing four hats.
- Review and watch. Review models before they go live and again when they change, and watch how they perform once they are in use, in proportion to their risk.
- Be able to prove it. When OSFI asks, or your auditor asks, show the records, not a reconstruction.
That is the whole guideline, as it lands on a decision maker’s desk. Two things it does not ask for are worth saying out loud, because the market will try to sell them to you. E-23 does not mandate any software product, and there is no E-23 certification. It is principles-based and proportional: a mid-sized institution with thirty models is not expected to run the program of a bank with three thousand.
Why the usual approach is slow and expensive
The traditional model risk program grew up in large banks under earlier regulation. It assumes a dedicated model risk function, a consulting engagement to design the framework, a long implementation of a governance platform, and a year or more before the first useful report. Those programs cost millions and were built for institutions that already had hundreds of quantitative models and a team to match.
Most federally regulated institutions are not that. They have a compliance lead, a risk lead, a handful of people who know where the models are, and a growing list of AI tools that arrived through procurement, a vendor’s product update, or an employee’s browser. For them, the big-bank program is the wrong shape. It spends the first two quarters on documents about the program, and the inventory, the thing E-23 is most explicit about, is still a spreadsheet when the deadline arrives.
There is also a quieter problem. Evidence cannot be backfilled. A review record dated the week before an examination is not the same as a review record from the month the model went live. If the program does not start producing records until late 2026, the first examination after May 2027 will be looking at a few months of history, however good the framework document is.
How PulseAI simplifies it
We built PulseAI for the second kind of institution, and we designed the E-23 support around three simplifications.
One record per model, laid out the way OSFI wrote it. Each model in PulseAI carries a single governance record with the fields E-23 Appendix 1 names: owner, developer, reviewer and approver; internal or vendor origin; production, last-review and next-review dates; dependencies, data sources, limitations, and approved uses. Risk ratings record who assessed them, when, and why, and a rating with no assessment behind it is labeled exactly that. You do not translate your inventory into OSFI’s language before an examination. It is already in that language.
Gaps are named, not hidden. The compliance export includes an E-23 model inventory appendix that lists, for each model, what is captured and what is missing, instead of quietly leaving the blank lines out. The readiness view on Reports takes each of E-23’s twelve principles and shows whether the records it depends on exist: evidence present, partial, no evidence recorded, performed outside PulseAI, or could not be determined. There is deliberately no total and no percentage. A single score is what a reader would quote to a board, and a count of records cannot honestly produce one. What it can do is turn “are we ready?” into a list of specific things to go and do.
Evidence is sealed as it happens. Certified attestations, approved impact assessments, decisions about discovered AI tools, and weekly governance health reports are written into the Evidence Vault at the moment they happen, into write-once storage hosted in Canada and encrypted under your institution’s own key. A signed bundle for an auditor verifies offline with standard tools. The record of your program accumulates from the first week, which is the only way to have history when the examination comes.
Vendor AI gets the same discipline. A vendor API model cannot be activated in PulseAI until a data processing agreement is confirmed on its record, and Google Workspace discovery brings the AI tools employees have connected on their own into the same review as the approved ones.
The full principle-by-principle crosswalk, with what each one expects, how PulseAI supports it, and what remains yours, is on the OSFI E-23 page, along with a readiness kit you can circulate without filling in a form.
From zero to a working program in weeks
The part decision makers ask about most is time. A program on paper is not a program, and a program that takes a year to produce its first record has given away a year of evidence.
We onboard new institutions against a written onboarding runbook: a fixed sequence of steps, with pass criteria for each, that a PulseAI person works through alongside your team. It exists because we had to build it for ourselves. Every walkthrough environment we show prospects, including a fictional mid-sized bank with eight users, six AI tools, nine use cases and seven models, was stood up by following it, and that environment went from an empty workspace to its first sealed, verifiable evidence records in a single evening. A real institution takes longer, because the facts have to be gathered from real people. The software is never the slow part.
In practice the sequence looks like this:
| Week | What gets done | What you have at the end |
|---|---|---|
| 1 | Workspace set up, hosted in Canada, E-23 activated, your people invited. Models identified from procurement, vendor contracts, and the teams that use them. | An inventory, with the Appendix 1 gaps named. |
| 2 | Owners, developers, reviewers and approvers named on every model. Risk ratings assessed and recorded with their rationale. | Named accountability and rated risk, with provenance. |
| 3 | Impact assessments run on the models that matter. Owners certify their first attestations. Vendor models checked for data processing agreements. | The first sealed evidence records, and a readiness view you can read. |
| 4 and after | Review dates set by risk tier. Your monitoring results filed against thresholds. The weekly health report running. | A program that produces records on its own schedule, with a work list of what is still open. |
Weeks, not quarters. The institutions that do this in the fall of 2026 enter May 2027 with half a year of records their process produced, and a work list instead of a question.
Built and priced for the new AI reality
The programs that cost millions were priced for the institutions that could afford them, and the price was mostly people: consultants to design the framework, integrators to install the platform, and a bench to keep it running.
PulseAI is an AI-native company, built by a small team on a serverless cloud platform, hosted in Canada and the United States. There is no hardware to procure, no integrator to engage, and no twelve-month implementation to fund. Spend connections are read-only and need no agents on employee machines. We did not build a consulting practice to pay for, so you do not pay for one.
The fee is published: the E-23 Founding Cohort is CAD 29,000 or CAD 59,000 for ninety days to evidence and the first twelve months, sized to the institution rather than to a large bank’s budget. PulseAI is live in Canada and the United States and onboarding a limited founding cohort. Institutions that join as design partners lock in their pricing and shape how E-23 readiness works in a real operating environment. The value of building this way goes to the customer, which is the point.
What stays yours
An honest guide to E-23 has to say what software does not do, because the guideline is clear that accountability does not transfer.
PulseAI does not decide whether a model carries non-negligible risk. It does not measure model performance; the results of your own monitoring are what get filed and checked against the thresholds you set. It does not test your data, prove conceptual soundness, or run your change control. And an E-23 mapping, readiness view, or report is not a regulator’s approval and not proof of compliance on its own.
What it does is hold the records, name the gaps, seal the evidence, and show you where you stand, so that the judgment your institution has to exercise is exercised on facts.
Where to start
Three things, in order:
- Read the crosswalk. The OSFI E-23 page lays out all twelve principles in one table: what each expects, how PulseAI supports it, and what remains yours. Circulate the readiness kit to your model risk, compliance, and vendor teams.
- Count your models. Not formally. Ask the people who would know, and write down what comes back. The length of that list is the first honest fact about your program.
- Talk to us. Twenty minutes on a call, and we will show you what your inventory looks like mapped to E-23, and what the first four weeks would be for your institution.
E-23 takes effect on May 1, 2027. The institutions that are ready will be the ones whose process has already been running for months, not the ones with the thickest framework document.