Canadian financial institutions can now activate OSFI Guideline E-23 in PulseAI, hold Appendix 1-aligned model records with assessed risk ratings, and export an inventory appendix that shows what is captured and what is still missing.
OSFI Guideline E-23, Model Risk Management, takes effect on May 1, 2027. It applies to federally regulated financial institutions, and its definition of a model explicitly includes artificial intelligence and machine learning methods. That places predictive systems, generative AI applications, vendor APIs, and AI-enabled decision processes inside the model risk conversation.
An accurate model inventory, calibrated risk ratings, named accountable owners, tested independent review, and reliable monitoring evidence cannot be produced on the day a guideline takes effect. They have to be practiced first. PulseAI now supports that work.
Canadian institutions can switch on OSFI E-23 alongside the frameworks they already run. E-23 expectations plug into the AI Impact Assessment workflow teams use today, with completeness checks on the relevant evidence questions, so readiness becomes part of everyday governance rather than a separate project.
Activation is deliberate. E-23 binds federally regulated financial institutions, not every Canadian organization, so PulseAI does not enable it by default when a tenant sets its jurisdiction.
Each model in the Model Registry now carries a single governance record: the accountable owner, developer, reviewer, and approver; whether the model originated internally or with a vendor; its production deployment date, last review date, and when the next review is due; monitoring status; dependencies, data sources, and documented limitations; and the approved use cases it serves.
A vendor API model cannot be activated until a data processing agreement is confirmed on its record, and an active vendor model without that confirmation is raised as a health finding.
Every risk rating records who assessed it, when, and the rationale behind it. A rating that sits on a record with no assessment behind it is labeled as exactly that, so an unexamined tier is never mistaken for a reviewed one.
The compliance export now includes an OSFI E-23 Model Inventory Appendix: a model-by-model view of the Appendix 1 information held for each registered model, with anything not yet captured named explicitly instead of quietly omitted. E-23 framework completeness in the report crosswalk is recomputed from recorded assessment answers rather than read from a stale field.
PulseAI organizes the evidence and makes the gaps visible. Whether a model carries non-negligible risk for the institution remains the institution’s judgment, and an E-23 mapping or report is not a regulator’s approval or proof of compliance on its own.
At a glance
partnerships@pulseai.now