OSFI published the revised Guideline E-23 on Model Risk Management on 11 September 2025. It takes effect on 1 May 2027 after an 18-month transposition window. The final text pulls advanced machine learning, large language models, and agentic workflows into a single enterprise governance regime for all Federally Regulated Financial Institutions, including life and P&C insurers and foreign bank branches.
What changes for insurers
Three practical shifts:
- Inventory breadth - generative assistants and vendor models join actuarial and credit-style models under a technology-neutral definition of a model
- Lifecycle evidence - data lineage, explainability, opacity management, and drift monitoring must be reconstructible
- Board visibility - material AI outcomes become risk-committee language, not IT experiments
Track FIFAI II (OSFI / FCAC, March 2026) for retail consumer boundaries, and AMF Quebec’s Model Risk Management Guideline for provincial parallel scope.
Claims and pricing as the proving ground
The systems that decide premiums and claim outcomes are where supervisors will look first. Fairness, explainability, and override behaviour are not optional narratives. They are operating records.
How we encode Canada
The Canada pack remains Scoped in our roadmap. Revised E-23, FIFAI II, AMF Quebec MRM, and B-13 are the seed instruments. See the Canada Jurisdiction Pack.
Insurers that wait for a perfect inventory before observing production traffic will spend the transition rebuilding last quarter’s decisions from email.