OSFI E-23: are banks ready to merge AI governance and model risk?

TL;DR: OSFI Guideline E-23 is collapsing the divide between model risk management and AI governance, pushing banks toward clearer accountability, scalable validation, and governance that can keep pace with GenAI adoption, according to ValidMind. The compliance question is now whether oversight can operate as one enterprise discipline without creating fragility or fragmentation.

Editorial analysis by NHI Mgmt Group, based on content published by ValidMind: “OSFI E-23: The Guideline That Brings AI and Model Risk Together”.

Key questions

Q: How should financial institutions implement AI governance for model risk management under OSFI E-23?

A: Financial institutions should treat OSFI E-23 as an enterprise model risk management requirement, not a narrow compliance task.

Q: What breaks when AI governance and model risk management stay separate?

A: The main failure is fragmentation.

Q: How do teams know whether AI governance is actually working?

A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement.

Practitioner guidance

• Define a single accountable inventory for models and AI use cases Create one source of truth that ties each model or AI use case to an owner, validation status, and review cadence so governance does not split across parallel trackers.
• Modernise validation workflows for GenAI pace Replace manual review bottlenecks with repeatable validation steps, standard evidence packs, and clear escalation paths so MRM does not slow AI adoption.
• Map where AI governance inherits MRM controls Document which controls remain in the existing model risk process and which require separate oversight for GenAI-specific risk, especially where accountability is shared.

Bottom line: E-23 effectively removes the wall between AI governance and model risk management, so institutions need a single operating logic for oversight.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →