Bank supervisors in Canada and the United States do not regulate "artificial intelligence" as a category. They regulate models, and AI sits inside that word. Canada's Guideline E-23, published on September 11, 2025 and effective May 1, 2027, defines a model as an application of theoretical, empirical, judgmental, or statistical techniques, including AI and machine learning methods, that turns input data into results. The US guidance SR 26-2, issued on April 17, 2026, uses a narrower definition and states that generative and agentic AI models fall outside its scope.
Key takeaways
- OSFI's E-23 names AI and machine learning inside its definition of a model and applies to all federally regulated financial institutions, on a risk-proportional basis.
- SR 26-2, a joint Federal Reserve, OCC, and FDIC document, defines a model as a complex quantitative method and excludes simple arithmetic, deterministic rule-based software, and generative or agentic AI.
- E-23 takes effect on May 1, 2027, so as of October 24, 2026 it is published but not yet in force.
- SR 26-2 says it sets no enforceable standards, and it is expected to matter most to banking organizations with more than USD 30 billion in assets.
Why bank rulebooks say "model" and not "AI"
The word AI has no single technical boundary, so supervisors use a functional test: does a method take data and produce an estimate or result that people then act on? If it does, the method carries model risk, whatever technique sits inside. SR 26-2 describes model risk as the potential for adverse financial consequences from decisions made on model output. It lists loss, errors in financial statements and reporting, and flawed risk management decisions as examples of what can follow.
That framing explains why neither document opens with a definition of intelligence. A credit scorecard built with logistic regression, a fraud classifier built with a neural network, and a capital forecast built in a spreadsheet all raise the same question: how wrong can the output be, and who checks it? AI and machine learning enter the rules as one more way of building a model, with extra attention to opacity, bias, and change over time.
Canada: Guideline E-23
The Office of the Superintendent of Financial Institutions (OSFI) published the final Guideline E-23 on model risk management on September 11, 2025, with an effective date of May 1, 2027. It applies to all federally regulated financial institutions: banks, foreign bank branches, life insurance and fraternal companies, property and casualty insurers, and trust and loan companies. The guideline states that it applies on a risk basis, in proportion to an institution's size, strategy, and risk profile.
Several provisions deal with AI features directly. Model rationale is to consider the level of transparency and explainability required, and data used to build a model is to be checked for unwanted bias. Autonomy is listed as a qualitative factor in rating a model's risk, and monitoring is to address autonomous re-parametrization, where a model adjusts its own settings. External models and data are covered, and an institution is to track vendor and third-party models in its inventory. Senior management is expected to make sure staff have suitable skills, with novel technologies such as AI named as an example. The guideline also says more advanced AI and machine learning use should come with correspondingly mature governance and oversight.
United States: SR 26-2
On April 17, 2026, the Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation issued revised model risk management guidance, circulated by the Fed as SR letter 26-2. It supersedes SR 11-7, the 2011 guidance, and SR 21-8, a 2021 statement on models used for Bank Secrecy Act and anti-money laundering compliance.
The attached guidance defines a model as a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates. Simple arithmetic such as spreadsheet calculations is excluded, and so are deterministic rule-based processes and software with no such theories behind them. A footnote states that generative AI and agentic AI models are novel and rapidly evolving and are not within the scope, while the principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models. The text also says it does not set enforceable standards or prescriptive requirements, and that non-compliance will not by itself bring supervisory criticism, though supervisory action may still follow from violations of law or unsafe or unsound practices.
The two definitions side by side
| Question | Canada, Guideline E-23 | United States, SR 26-2 |
|---|---|---|
| Issued by | OSFI | Federal Reserve, OCC, and FDIC |
| Date and status | Published September 11, 2025; effective May 1, 2027 | Issued April 17, 2026; replaces SR 11-7 and SR 21-8 |
| What counts as a model | Theoretical, empirical, judgmental, or statistical techniques, including AI and machine learning, that process input data into results | Complex quantitative method applying statistical, economic, or financial theories to produce quantitative estimates |
| Simple tools | Scope set by risk; inventory covers models with non-negligible inherent risk | Spreadsheet arithmetic and deterministic rule-based software excluded |
| Generative AI | No separate carve-out found in the text reviewed | Generative and agentic AI outside the scope |
| Who it reaches | All federally regulated financial institutions | Most relevant to banking organizations above USD 30 billion in assets |
| Enforceability | Guideline; intensity of requirements follows each model's risk rating | States no enforceable standards |
What the gap means in practice
The same tool can fall on different sides of the line. A rules-based eligibility check with no statistical foundation is outside the US definition, while a large language model used to draft customer messages is outside SR 26-2 by the footnote and is left to the institution's general governance. Under E-23, whether such a tool is treated as a model depends on how it processes data and on the institution's own risk rating, which the guideline ties to factors including complexity and autonomy. These are readings of the published text, not supervisory rulings, and institutions interpret them with their regulators.
Neither document is a consumer protection statute. Both govern how an institution manages its own model risk. Questions about fair lending, privacy, or disclosure to customers sit under other laws.
Questions to ask when a bank describes a product as AI-driven
- Is the output produced by a statistical or machine learning method, or by fixed rules?
- Who inside the institution is accountable for the model, and who reviews it independently?
- Is the model built in-house or supplied by a vendor, and how is the vendor's model tracked?
- What happens when the model's inputs or the customer population change?
- Can the institution explain, at the level the use requires, why a result came out as it did?
This article is general information about supervisory guidance and is not financial, investment, or legal advice. It does not recommend any institution, product, or security, and it makes no prediction about prices or returns. Decisions about money belong with the individual and, where useful, a licensed professional.
FAQ
Is Guideline E-23 already in force?
Not yet. OSFI published it on September 11, 2025, and it takes effect on May 1, 2027. Until then, institutions are preparing rather than complying with a binding date.
Does SR 26-2 regulate chatbots at banks?
Generative AI models are stated to be outside the guidance. The text adds that an institution's own risk management and governance practices should decide the controls for tools it does not cover.
Is SR 26-2 legally binding?
The guidance says it sets no enforceable standards and that non-compliance alone will not draw supervisory criticism. It adds that supervisory action may still arise from violations of law or unsafe or unsound practices.
Does either document define AI itself?
In the portions reviewed, neither sets a stand-alone definition of AI. E-23 names AI and machine learning methods within its definition of a model, and SR 26-2 distinguishes generative and agentic AI from other AI models.
Related reading
- Narrow AI definitions with finance examples
- Why AI systems produce confident errors
- Ethical dilemmas that AI raises
- AI and modern society
More in AI in finance.
Last verified: October 2026
Sources
- Guideline E-23, Model Risk Management (2027), Office of the Superintendent of Financial Institutions, September 11, 2025
- SR 26-2, Revised Guidance on Model Risk Management, Board of Governors of the Federal Reserve System, April 17, 2026
- Supervisory Guidance on Model Risk Management (attachment to SR 26-2), Federal Reserve, OCC, and FDIC, April 17, 2026