Are we ready for E-23 on 1 May 2027?
For model risk leads, chief risk officers and chief data officers at federally regulated financial institutions. OSFI's Guideline E-23 on model risk management takes effect on 1 May 2027.
The question you are asked
iSystematic works with model risk leads, CROs and chief data officers who are asked whether the institution is ready for E-23 on 1 May 2027. OSFI's guideline applies to all models at every federally regulated financial institution, and its definition of a model includes AI and machine-learning methods.
Where most start
Most start with the free check, then the paid Review.
Take the free E-23 readiness check
The E-23 readiness check on nabeelkhan.com: twelve questions over six themes, about six minutes, free, with no form in front of it. It gives a profile per theme and names the weakest. It reads answers, not records, and states no conformance level.
Then the E-23 Readiness Review
The E-23 Readiness Review: three weeks, remote with one day on site. Your model risk framework is read against E-23, two or three of your own systems are tested, and every gap is placed on the four altitudes of the MESA Framework™, owned and dated.
What we deliver
Training and any further delivery follow a paid diagnosis, never a catalogue.
E-23 Readiness Review
Three weeks. A dated gap plan to 1 May 2027, artifact status for the sampled systems, a one-page board summary, and your own answers beside the evidence. Fixed fee, shared on a short call.
E-23 Practitioner Course
Two days, in house: the five artifacts produced on your own system, challenged by a validator and an engineer. Dates are set with each institution.
The E-23 handbook
The handbook behind the Review and the course, listed with Nabeel Khan's other books.
What the Review does not do
The Review does not attest conformance, approve any model, or substitute for your validation function.
What you hold at the end: a fictional sample
This fictional readiness summary is for a fictional federally regulated financial institution, set out by the six themes of the readiness check.
| Theme | Finding | Owner | Due |
|---|---|---|---|
| Scope and inventory | The inventory lists statistical models but not the AI tools used by operations teams | Head of model risk | Q4 2026 |
| Rating and approval | Risk ratings exist; approval records name a committee, not a person | Chief risk officer | Q1 2027 |
| Validation | The sampled AI system has no independent validation | Validation lead | Q1 2027 |
| Third-party models | A vendor model is in use with no third-party risk assessment on file | Third-party risk lead | Q4 2026 |
| Monitoring | Thresholds are set, but no trigger fires on a vendor model change | Model owner | Q1 2027 |
| Evidence and agents | An agent pilot runs without a record of what it may do | Chief data officer | Before go-live |
Fictional. A real summary is dated to 1 May 2027 and carries your own answers beside the evidence.
What it is built on
The Review reads your framework against E-23 using two parts of the published corpus; the frameworks behind every build are on How we build.
| Built on | In this work | You keep |
|---|---|---|
| MESA Framework | Every gap is placed on four altitudes: Regulatory Floor, Strategic Compass, Operational Machinery and Technical Substrate. | A gap plan, each gap owned and dated to 1 May 2027 |
| The E-23 handbook's five artifacts | Two or three of your systems, at least one AI system and one vendor model, are tested against them. | Artifact status for each sampled system |
Buying from us
You contract with iSystematic Inc., in Canada, and the Review is delivered personally by Nabeel Khan, not staffed to a bench.
Your institution will review iSystematic as a third party under OSFI's Guideline B-10, the third-party risk guideline in force. Start that review through the contact form.
Start
Start with the free check; it takes about six minutes.
Where to go next
E-23 Readiness Review
The E-23 Readiness Review reads your model risk framework against OSFI E-23 in three weeks and leaves a dated gap plan to 1 May 2027, delivered by Nabeel Khan.
Readiness
Two readiness routes from iSystematic: AI Governance Readiness and E-23 Readiness, each a free check on nabeelkhan.com followed by one fixed-fee paid diagnosis.
Training
iSystematic's enterprise training: the E-23 Practitioner Course, two days in house on your own systems, and board briefings delivered within an engagement.
How we build
How iSystematic builds: every solution uses the same deposited frameworks. See what each part decides, what the client keeps, and each specification's DOI.
GCC institutions
GCC boards and executives: iSystematic's two-week AI Governance Teardown examines how your institution governs AI and ends with a one-page board summary.
Conformance is self-declared; no regulator endorses this work.