Know, Show, Go: the 5-Day E-23 Readiness Sprint

OSFI Guideline E-23 · For Canadian federally regulated financial institutions

Know, Show, Go: the 5-Day E-23 Readiness Sprint

E-23 readiness starts with one date. OSFI Guideline E-23 takes effect for every federally regulated financial institution on May 1, 2027, and AI and machine learning models are in scope.

Your board will ask three things. What AI do we run? Who owns it? What is enough for a firm our size? In five working days you get written answers, and a plan your team can start the following Monday.

Book a 30-Minute Know, Show, Go Call

Who it is for

Built for

  • Small and mid-sized banks, and foreign bank branches
  • Life insurance and fraternal companies
  • Property and casualty insurers, and foreign insurance company branches
  • Trust and loan companies
  • Sponsors: the Chief Risk Officer, the Chief Compliance Officer or the head of model risk. Risk and technology leads do the work with us.

Not built for

  • Pension plans. OSFI excludes them from E-23 because they sit under a separate supervisory framework.
  • Organizations outside federal financial regulation. The AISM Diagnostic Sprint is the better fit for you.
  • Teams that want a legal opinion or a certification. This is advisory work.

What you get in five working days

Three phases. Each one ends in a document your team can use without us in the room.

Know

A defensible AI inventory baseline

  • An inventory of the AI and models in use, including AI inside the tools your vendors supply, checked with up to four stakeholders
  • E-23 gap scorecard, with your AISM Health Score on a 0 to 100 scale
  • Proportionality memo: what “enough” looks like at your size and risk profile

Show

Proof a board can act on

  • Top-3 risk register: each risk with an owner, a control and the decision required
  • A two-page board decision paper
  • Evidence template pack: use-case record, impact assessment, go-live gate, monitoring plan and incident escalation

Go

A 90-day plan with names on it

  • A roadmap sequenced toward May 1, 2027, with owners and dates
  • A 45-minute executive readout. The slides are yours to keep.
  • Thirty days of follow-up questions by email

How the week runs

The preparation happens before the clock starts. That keeps the five days for the work.

E-23 readiness sprint timeline from Week 0 intake to the Friday executive readout

Week 0

On signing you receive the intake form, a one-page sheet that defines what counts as a model, and an interview request. We agree in writing on what the readout must contain. Kickoff is set once the intake form is back and four interview times are booked.

Monday and Tuesday

Monday is kickoff plus a one-hour intake review, where we confirm the scope of the inventory. Tuesday you receive a preliminary Health Score built from the completed intake.

Wednesday and Thursday

Stakeholder interviews and evidence review. Each person checks the inventory entries for their own area during the interview, so no extra meeting is needed.

Friday

The executive readout. You leave with the scorecard, the board paper, the evidence pack and the 90-day plan.

Your team’s time is kept small across the week. Boxwood does the drafting.

Investment

Fixed fee. Scope confirmed on the discovery call. No hourly billing.

What it does not do

The Sprint gives you evidence and a decision-ready plan. It is not legal advice or a certification, and it does not promise a regulatory outcome. Your institution and OSFI make those calls.

Why Boxwood

  • One accountable principal. Campbell Robertson scopes the work and delivers it. There is no hand-off after the sale.
  • Close to 20 years at IBM, including National AI Market Lead for Canada and Global Public Sector Executive.
  • Independent. Boxwood takes no referral fees and no commissions on partner products, and any partner recommendation passes a written conflict-of-interest check.
  • Past work: executive AI advisory and a Shadow AI workshop for a U.S. professional services firm and government contractor, where pooled participant confidence rose 46.9%.

Common questions on E-23 readiness

Does E-23 cover AI?

Yes. The guideline defines a model to include AI and machine learning methods, and OSFI added guidance on explainability and self-learning models in the final version.

What about AI inside vendor products?

Third-party models are in scope. OSFI expects institutions to follow Guideline B-10 on third-party risk and to validate and monitor vendor models in line with the risk they carry.

Does every model need full governance?

No. OSFI says models that carry risk to the institution go on the inventory and get full lifecycle governance. The intensity scales with the model’s risk rating, and the guideline applies in proportion to your size, strategy and risk profile.

Is E-23 a law?

No. It is an OSFI guideline that sets out supervisory expectations for sound business and financial practice.

What do we need to prepare?

The Week 0 intake form, four interview times and a named sponsor. We send everything else.

Start with a 30-minute call

The call confirms fit, timing and scope. If E-23 readiness is not the right lens for you, we will say so.

Book a 30-Minute Know, Show, Go Call

Or start with the free AI Reality Check.

Sources