Tie decisions to the inventory
The application reports model identifiers with each decision, so a reviewer can relate live activity to the entry in your inventory.
OSFI Guideline E-23
Keep your lending agent in production through model review
Under E-23, an AI model in lending goes through the same model risk review as a scorecard, and the reviewers will ask how it behaves in use. When your team can show them, the agent stays in the approval flow instead of going back to validation.
A small-business loan, referred
A lending agent receives an application for a $180,000 line of credit. The applicant's debt service coverage sits below the bank's automatic-approval threshold, so the rule refers it instead of approving.
A credit officer with the authority for that amount gets the case. It shows the facts the agent submitted, the model identifier and version, the rule version, and the options open to them. They approve with a lower limit and record why. The application reports the facility it booked.
Six months later, a model reviewer asks how often the agent's recommendations were overridden. They filter by model version and see this case among the rest, with the reasons.
What E-23 covers, from May 1, 2027
OSFI published the final guideline on September 11, 2025. It applies to federally regulated financial institutions, and its definition of a model includes AI and machine learning. Review depth follows each model's risk rating, and the rating criteria include complexity and autonomy, so an agent that acts on its own is likely to rate higher.
Read OSFI's guideline. The date is also on the regulatory timeline.
Evidence for the model inventory and the review
See overrides and referrals
Which cases went to a person, what they decided, and why. Patterns show where the model and your policy disagree.
Compare before and after a change
A new model or rule version changes the question. Compare referrals and outcomes across versions, and see the Shadow results that came before a rule change was approved.
For US banks: SR 26-2
The Federal Reserve's SR 26-2 guidance replaced SR 11-7. It calls generative and agentic AI "novel and rapidly evolving" and applies its principles to "non-generative, non-agentic AI models." Agents are left to your own governance. US banks running lending agents can use the same records to show their boards and examiners how those agents are controlled.
E-23 questions
No. Validation, documentation, and the inventory stay with your model risk team. VeriProof adds evidence of how the model behaves in production.
No. The application calls VeriProof before it acts and reports the outcome afterward. The decision itself stays in your system.
Yes. They work in an engagement scoped to the agents and dates under review. They can also verify exported records on their own, without relying on VeriProof. See how.