OSFI and AI model risk: what Canadian financial firms should know
OSFI, Canada's federal financial regulator, expects federally regulated institutions to manage the risk of the models they rely on — including AI and machine-learning models — through sound model risk management: clear ownership, validation, ongoing monitoring, and documentation. As firms adopt AI, those expectations apply to the new models too.
What model risk management means
Model risk management is the discipline of ensuring the models a firm relies on are sound: owned by someone accountable, independently validated, monitored in production, and documented. OSFI has long expected this for traditional models — and the same principles extend to AI.
Why AI raises the stakes
AI models can be more complex and less transparent than traditional ones, which makes validation, explainability, and monitoring more important, not less. Governance has to keep pace with capability.
Getting ahead of it
Firms that build model governance in from the start — rather than retrofitting it — can adopt AI faster and with more confidence, because the controls that satisfy regulators are already in place.
Frequently asked questions
Does OSFI have specific AI rules?
OSFI's expectations centre on sound risk management and governance that apply to AI models as they do to others; guidance in this area continues to evolve, so firms should confirm current requirements.
How does ARCHR help?
We build AI systems with model governance, validation, and monitoring designed in, so they align with sound model risk management practice.