Are we ready for E-23 on 1 May 2027?
For model risk leads, chief risk officers and chief data officers at federally regulated financial institutions. OSFI's Guideline E-23 on model risk management takes effect on 1 May 2027.
The question you are asked
iSystematic works with model risk leads, CROs and chief data officers who are asked whether the institution is ready for E-23 on 1 May 2027. OSFI's guideline applies to all models at every federally regulated financial institution, and its definition of a model includes AI and machine-learning methods.
Where most start
Most start with the free check, then the paid Review.
Take the free E-23 readiness check
The E-23 readiness check on nabeelkhan.com: twelve questions over six themes, about six minutes, free, with no form in front of it. It gives a profile per theme and names the weakest. It reads answers, not records, and states no conformance level.
Then the E-23 Readiness Review
The E-23 Readiness Review: three weeks, remote with one day on site. Your model risk framework is read against E-23, two or three of your own systems are tested, and every gap is placed on the four altitudes of the MESA Framework™, owned and dated.
What we deliver
Training and any further delivery follow a paid diagnosis, never a catalogue.
E-23 Readiness Review
Three weeks. A dated gap plan to 1 May 2027, artifact status for the sampled systems, a one-page board summary, and your own answers beside the evidence. Fixed fee, shared on a short call.
Read more →E-23 Practitioner Course
Two days, in house: the five artifacts produced on your own system, challenged by a validator and an engineer. Dates are set with each institution.
Read more →The E-23 handbook
The handbook behind the Review and the course, listed with Nabeel Khan's other books.
Read more →What the Review does not do
The Review does not attest conformance, approve any model, or substitute for your validation function.
What you hold at the end: a fictional sample
This fictional readiness summary is for a fictional federally regulated financial institution, set out by the six themes of the readiness check.
| Theme | Finding | Owner | Due |
|---|---|---|---|
| Scope and inventory | The inventory lists statistical models but not the AI tools used by operations teams | Head of model risk | Q4 2026 |
| Rating and approval | Risk ratings exist; approval records name a committee, not a person | Chief risk officer | Q1 2027 |
| Validation | The sampled AI system has no independent validation | Validation lead | Q1 2027 |
| Third-party models | A vendor model is in use with no third-party risk assessment on file | Third-party risk lead | Q4 2026 |
| Monitoring | Thresholds are set, but no trigger fires on a vendor model change | Model owner | Q1 2027 |
| Evidence and agents | An agent pilot runs without a record of what it may do | Chief data officer | Before go-live |
Fictional. A real summary is dated to 1 May 2027 and carries your own answers beside the evidence.
What it is built on
The Review reads your framework against E-23 using two parts of the published corpus; the frameworks behind every build are on How we build.
| Built on | In this work | You keep |
|---|---|---|
| MESA Framework | Every gap is placed on four altitudes: Regulatory Floor, Strategic Compass, Operational Machinery and Technical Substrate. | A gap plan, each gap owned and dated to 1 May 2027 |
| The E-23 handbook's five artifacts | Two or three of your systems, at least one AI system and one vendor model, are tested against them. | Artifact status for each sampled system |
Buying from us
You contract with iSystematic Inc., in Canada, and the Review is delivered personally by Nabeel Khan, not staffed to a bench.
Your institution will review iSystematic as a third party under OSFI's Guideline B-10, the third-party risk guideline in force. Start that review through the contact form.
Start
Start with the free check; it takes about six minutes.
Where to go next
E-23 Readiness Review
The E-23 Readiness Review reads your model risk framework against OSFI E-23 in three weeks and leaves a dated gap plan to 1 May 2027, delivered by Nabeel Khan.
Read more →Readiness
Two readiness routes from iSystematic: E-23 Readiness for OSFI E-23 on 1 May 2027, and AI Governance Readiness, each a free check then a paid diagnosis.
Read more →Training
iSystematic's enterprise training: the E-23 Practitioner Course, two days in house on your own systems, and board briefings delivered within an engagement.
Read more →How we build
How iSystematic builds: every solution uses the same deposited frameworks. See what each part decides, what the client keeps, and each specification's DOI.
Read more →GCC institutions
GCC boards and executives: iSystematic's two-week AI Governance Teardown examines how your institution governs AI and ends with a one-page board summary.
Read more →Conformance is self-declared; no regulator endorses this work.