Answers Updated 6 November 2026
The questions people ask about OSFI, model risk and AI governance.
Each page answers one question: the short answer first, then the detail, read from OSFI’s and other regulators’ own pages, with the sources listed. For the longer reads, see the guides. New answers are posted on MINERVA on LinkedIn.
OSFI and its guidelines
- What is OSFI, and what does it do?OSFI is the Office of the Superintendent of Financial Institutions, the federal agency that regulates and supervises Canada’s banks, federally regulated insurers, trust and loan companies and federal pension plans. What it does, what it does not, and how it works.
- Who does OSFI regulate?OSFI regulates every bank in Canada, federally regulated insurers, trust and loan companies, federal credit unions and federally regulated pension plans. Which credit unions, insurers and fintechs it does not regulate, and how to check an institution.
- What are OSFI guidelines, and are they binding?OSFI guidelines set out what OSFI expects of banks and insurers. Whether they are legally binding, how OSFI enforces them, and the guidelines that matter most for risk teams: E-23, B-10, B-13, E-21, E-13, B-15, B-20 and the capital rules.
- Are OSFI guidelines binding?OSFI guidelines aren't laws, but banks and insurers are expected to follow them. How OSFI enforces them, when a guideline has statutory force, and the fines.
- Who regulates financial services in Canada?Canada splits financial regulation between federal and provincial bodies. Who oversees banks, insurers, credit unions and dealers, and where to complain.
- What is OSFI Guideline E-13?OSFI Guideline E-13 sets out how federally regulated financial institutions manage regulatory compliance risk: the eight elements of a compliance framework, the Chief Compliance Officer’s independence, annual opinions and board reporting.
- What is OSFI Guideline E-21?OSFI Guideline E-21 on operational risk management and resilience: its three outcomes and eight principles, critical operations, tolerances for disruption, scenario testing, the 1 September 2026 and 2027 deadlines, and where AI fits.
- What is OSFI Guideline B-15?OSFI Guideline B-15, Climate Risk Management: its three outcomes, the five governance and risk principles, climate scenario analysis, capital and liquidity, the disclosure chapter aligned with the CSSB standards, and which year each disclosure is due.
- What is OSFI Guideline B-20?OSFI Guideline B-20 on residential mortgage underwriting: its five principles, the minimum qualifying rate (the stress test), the 65% HELOC limit, loan-to-income limits since 2025, the straight-switch exemption, and the 2026 plan to fold B-20 into a credit risk guideline.
- What is OSFI Guideline B-12?OSFI Guideline B-12 sets how Canadian banks manage interest rate risk in the banking book (IRRBB). What the 2027 version changed, the eleven principles, the six shock scenarios and Canada’s shock sizes, the 15% outlier test, and why B-12 models fall under E-23.
- What is OSFI’s CAR guideline?OSFI’s Capital Adequacy Requirements (CAR) guideline sets how much capital Canadian banks, trust and loan companies must hold against their risks. The nine chapters, the minimum ratios and buffers, the output floor, what CAR 2027 changed, and where models come in.
- What is OSFI’s Integrity and Security Guideline?OSFI’s Integrity and Security Guideline of 31 January 2024: why OSFI wrote it, its two outcomes and ten principles, background checks, foreign interference, reporting to CSIS and the RCMP, and the 2025 deadlines.
- How do you report a cyber incident to OSFI?Federally regulated banks, insurers and trust companies must report a technology or cyber incident to OSFI within 24 hours. What counts as reportable, who to send it to, the updates and post-incident review OSFI expects, and what happens if you don't report.
- What is OSFI’s cyber security self-assessment?OSFI’s technology and cyber risk management self-assessment is a voluntary workbook, updated on 3 November 2025 to follow Guideline B-13. Its 57 expectations in three domains, the 0 to 5 maturity scale, how to fill it in, and what to do with the gaps.
Model risk management
- What is model risk?Model risk is the risk of loss or harm from a model that is wrong or used wrongly. Where it comes from, how banks measure it, and what JPMorgan’s London Whale, Zillow Offers and the UK’s 2020 exam algorithm teach about it.
- What is model risk management in banking?Model risk management (MRM) is how a bank or insurer controls the risk that a model is wrong or misused. What model risk is, why it matters, the parts of an MRM framework, the three lines of defence, and what OSFI E-23 and SR 26-2 expect.
- How do you build a model risk management framework?A practical order for building an MRM framework: the definition, the policy, the inventory, tiering, validation, approval and monitoring, with what OSFI E-23 asks at each step.
- What is model risk governance?Model risk governance is who decides what about models: the board, senior management, model owners, developers, reviewers and approvers, the policy that binds them, and the committees and reports that keep it honest. The roles OSFI E-23 names, and how to set it up.
- What is model risk tiering?Model risk tiering sorts models by how much harm they could do if they were wrong, so the strictest review goes where it matters. The factors OSFI E-23 names, a worked scoring example, what a tier should change, and the mistakes that make tiering meaningless.
- What is model risk management software?Model risk management software keeps a bank's model inventory, ratings, validations, approvals and monitoring in one place. What it should do, the kinds of tool, the platforms banks look at (SAS, IBM OpenPages, ValidMind, Yields and others), and how to choose.
- What counts as a model in model risk management?How OSFI E-23 and US guidance define a model, with a practical test and examples: credit scores, IFRS 9, AML monitoring, spreadsheets, vendor scores, rules engines and large language models. What is in scope and what usually is not.
- What is a model inventory, and what must it contain?A model inventory is the register of every model an institution uses or recently retired. The fields OSFI E-23 asks for, how to find the models nobody listed, spreadsheet versus software, and a free inventory template.
- What is model validation in banking?Model validation is the independent check that a model works as intended and is fit for its use. What validators review, the tests they run (backtesting, benchmarking, PSI, Gini, calibration, fairness, LLM evaluation), how often, and what OSFI E-23 expects.
- How do you validate an AI model?How to validate machine learning and generative AI models: what changes from traditional model validation, the tests for each kind of model, vendor and foundation models, independence, and what OSFI E-23, SR 26-2 and the PRA's SS1/23 expect.
- What is model monitoring?Model monitoring is the ongoing check that a model in production still works as intended. What to monitor (performance, stability, data quality, usage, overrides), the metrics, how to set thresholds, monitoring generative AI, and what OSFI E-23 Principle 3.6 expects.
- What is model drift?Model drift is a model getting worse over time because the world it was built for has changed. Data drift vs concept drift, how to measure drift (PSI, KS, Jensen-Shannon), the usual thresholds, a worked example, and what OSFI E-23 expects for AI models.
- What is AI model risk management?AI model risk management applies model risk controls to machine learning, generative AI and AI agents. What makes AI models riskier, what to add to inventory, validation and monitoring, and how OSFI E-23 and SR 26-2 treat AI.
- What are common model risk management interview questions?The questions model risk and validation interviews usually ask, from what a model is to PSI, AUC and effective challenge, with short answers and what the interviewer wants to hear.
AI governance
- What is AI governance?AI governance is the set of roles, policies and controls that decide how an organization builds, buys and uses AI. What it covers, what an AI governance framework looks like, the main frameworks (NIST AI RMF, ISO 42001, EU AI Act, OSFI E-23) and where to start.
- How do you implement an AI governance framework?A step-by-step plan for putting AI governance in place: owners, an AI inventory, risk tiers, controls, monitoring and reporting, mapped to NIST AI RMF, ISO 42001 and OSFI E-23.
- What are AI governance tools?AI governance tools help an organization know what AI it uses, decide who may use it for what, check it against policy and regulation, and keep the evidence. The kinds of tool on the market, the capabilities to look for, questions to ask a vendor, and when a spreadsheet is still enough.
- What is AI compliance?AI compliance means making sure the AI an organisation builds, buys and uses meets the laws, regulations and standards that apply to it, and being able to prove it. The rules for a Canadian financial institution, the EU and US pieces, what a program contains, and the AI compliance officer’s job.
- What is responsible AI?Responsible AI means building and using AI in ways that are fair, safe, transparent and accountable. The OECD principles, Canada’s and the big tech companies’ versions, how principles become practice, and the gap between a principles page and evidence a regulator accepts.
- What is AI risk?AI risk is the chance that an AI system causes harm or loss: wrong answers, bias, privacy leaks, security holes, vendor failures. The main types, NIST’s twelve generative AI risks, what OSFI and FCAC found at Canadian banks, and how to run an AI risk assessment.
- What are the risks of generative AI?The risks of generative AI as NIST names them in its Generative AI Profile (NIST AI 600-1): twelve risks from confabulation and data privacy to information security and the value chain, what each looks like in a bank or insurer, and the controls that reduce them.
- What is AI data governance?AI data governance is how an organisation controls the data its AI is built on and fed: where it came from, whether it may be used, its quality and representativeness, and who can see it. What it covers, what E-23, the EU AI Act and ISO/IEC 42001 ask, and a practical framework.
- What is an AI risk register?An AI risk register lists the risks of each AI system an organization uses, with a rating, an owner, controls and a review date. The columns to include, a filled-in example row, how it differs from an AI inventory, and where the MIT AI Risk Repository and NIST fit.
- What is an AI impact assessment?An AI impact assessment looks at who an AI system could affect and how, before it goes live. How it differs from a risk assessment and a privacy impact assessment, Canada's Algorithmic Impact Assessment, the EU AI Act's fundamental rights impact assessment, ISO/IEC 42005, and a template.
- What is an AI use case inventory?An AI use case inventory lists every place an organization uses AI, one row per use: what it does, who owns it, what model or vendor powers it, who it affects and its risk. The fields to record, how to find the uses, the US federal inventories under OMB M-25-21, and OSFI E-23's model inventory.
- What are the risks of agentic AI?Agentic AI acts on its own: it calls tools, moves data and takes steps nobody approved one by one. The main risks, the OWASP Top 10 for Agentic Applications (ASI01 to ASI10) in plain words, a worked example, and the controls that keep an agent inside its lane.
- How do you secure AI agents?AI agent security is protecting systems where an AI can call tools and take actions. The main threats (goal hijacking through prompt injection, tool misuse, privilege abuse, poisoned memory, supply chain), the controls that work, and what NIST, OWASP and Singapore's framework say.
- What is the OWASP Top 10 for LLM applications?The OWASP Top 10 for LLM Applications lists the ten most important security risks in software built on large language models. The 2025 list in plain English with an example of each, what changed from the first edition, how it relates to the agentic top 10, and how to use it.
- What is AI red teaming?AI red teaming is deliberately trying to make an AI system fail: leak data, ignore its rules, produce harmful output or take unsafe actions, so the flaws are found before customers or attackers do. What testers try, how a red team exercise runs, open-source tools, and what to do with the findings.
- What are AI guardrails?AI guardrails are the controls around an AI system that check what goes in, what comes out and what it’s allowed to do. Input, output and action guardrails with examples, the tools that provide them, how agent guardrails differ, and why a guardrail isn’t a governance program on its own.
- What is explainable AI?Explainable AI (XAI) is the set of methods that show why a model produced a result. Global versus local explanations, how SHAP and LIME work, NIST’s four principles, what lenders owe a declined applicant, and what OSFI E-23 and Quebec’s Law 25 expect.
- What is AI bias?AI bias is when an AI system’s results are systematically unfair to some people or groups. NIST’s three categories, well-documented examples from hiring, health care, face analysis and credit, how bias is measured, why it can’t be fully removed, and how to manage it in a bank or insurer.
- What should an AI acceptable use policy include?An AI acceptable use policy tells staff which AI tools they may use, for what, and with which data. The sections every policy needs, a short template you can adapt, worked examples of allowed and banned uses, and how a bank fits it with OSFI E-23 and B-10.
- What is shadow AI?Shadow AI is AI used at work without the organization knowing or approving it: personal chatbot accounts, AI features switched on inside software, browser extensions. Why it happens, what it puts at risk, how to find it, and how to bring it into the light without banning everything.
- Which AI governance certification is best?The AI governance and AI risk certifications worth knowing in 2026: IAPP AIGP, ISACA AAIA and AAISM, GARP RAI, ISO/IEC 42001 lead implementer and lead auditor, and third-party risk credentials. Who each is for, the prerequisites, and why NIST AI RMF has no certification.
- Will AI replace risk management jobs?Can AI do risk management, and will it replace risk jobs? What AI already does well in risk, what regulators still require a person to do, the new AI governance and AI risk roles, and the skills that make a risk career hold up.
Third-party and vendor risk
- What is OSFI Guideline B-10?OSFI Guideline B-10 on third-party risk management, in effect since 1 May 2024: its six outcomes and eleven principles, risk and criticality, due diligence, contract provisions, subcontracting, concentration, cloud and exit plans, and how it reaches AI vendors.
- What is third-party risk management (vendor risk management)?Third-party risk management (TPRM), or vendor risk management, is how an organization controls the risks of its suppliers. The lifecycle, the vendor risk assessment, fourth parties and concentration, TPRM in banking under OSFI B-10, and AI vendors.
- What is the OCC's third-party risk management guidance?The US banking agencies' 2023 interagency guidance on third-party relationships, issued by the OCC as Bulletin 2023-17: who it applies to, the five life-cycle stages, the three governance practices, critical activities, the community bank guide, and how it compares with OSFI B-10.
- What is a vendor risk assessment?A vendor risk assessment checks what could go wrong with a supplier before and while you rely on it. The steps, how tiering works, the questionnaires (SIG, CAIQ), the evidence to ask for, the extra questions for AI vendors, and what OSFI B-10 expects.
- What is third-party AI, and what is an AI vendor?Third-party AI is AI a company uses but did not build: foundation model APIs, AI features inside software it buys, and AI services from vendors. The kinds of AI vendor, the risks they bring, and how banks govern them under OSFI B-10 and E-23.
Standards and other regulators
- Who regulates AI in Canada?Canada has no general AI law: the Artificial Intelligence and Data Act died in January 2025. Who regulates AI instead, sector by sector: OSFI and the AMF for financial institutions, privacy commissioners, Quebec’s Law 25, Ontario’s rules, and federal policy.
- What is the EU AI Act, and does it apply to Canadian companies?The EU AI Act is the European Union’s law on artificial intelligence. Its risk tiers, when each obligation applies after the 2026 Digital Omnibus, who it reaches outside the EU, what it means for credit scoring and insurance, and penalties.
- What is the NIST AI Risk Management Framework, and is it mandatory?The NIST AI RMF is a voluntary US framework for managing AI risk, released in January 2023. Its four functions, the seven characteristics of trustworthy AI, the Playbook and the Generative AI Profile, whether it is mandatory, and how a Canadian bank can use it.
- What is Singapore’s Model AI Governance Framework?Singapore’s Model AI Governance Framework is voluntary guidance from IMDA on deploying AI responsibly. The 2019 and 2020 editions, the 2024 framework for generative AI, and the 2026 framework for agentic AI with its four dimensions, plus what a Canadian bank can borrow from it.
- What is NIST doing about agentic AI?What NIST has done on AI agents so far: CAISI's request for information on agent security (January 2026), the AI Agent Standards Initiative (February 2026) and its three workstreams, the concept paper on agent identity and authorization, and what is not published yet.
- What is ISO/IEC 42001, and is it worth getting certified?ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS). What it requires, its Annex A controls, how certification works, its companion standards, how it relates to the NIST AI RMF and OSFI E-23, and when certification is worth it.
- What is SR 11-7, and what replaced it?SR 11-7 was the US banking agencies’ model risk management guidance from 2011. What it required, its definition of a model and effective challenge, how SR 26-2 replaced it on 17 April 2026, and how both compare with OSFI E-23.
- What is PRA SS1/23?SS1/23 is the Bank of England PRA’s supervisory statement on model risk management for banks. Who it applies to, its five principles and model definition, what the April 2026 update clarified, and how it compares with OSFI E-23 and the US SR 26-2.