AI Audit & Compliance
OSFI Guideline E-23 takes effect on 1 May 2027 and counts AI and machine-learning systems as models. We build the inventory, the control evidence and the regulatory crosswalk a review will ask for.
The question we answer
Can you show a supervisor which AI systems you run, who owns them, and which controls actually operate?
AuthoritativeOSFI Guideline E-23 takes effect on 1 May 2027 for all federally regulated financial institutions, and its definition of a model explicitly includes AI and machine-learning systems.
AuthoritativeIn the United States, SR 26-2 replaced SR 11-7 on 17 April 2026, and its footnote 3 places generative and agentic AI outside its scope — so the institution, not the supervisor, now owns that determination.
InterpretationMost institutions can describe their AI policy. Far fewer can produce an inventory and the control evidence that ties each system back to it.
What we assess
- AI system inventory against the E-23 minimum standard
- Control design and operating effectiveness, by tier
- Third-party AI exposure under OSFI B-10
- Gap register with severity and remediation effort
What we implement
- Inventory and tiering process your teams own
- Control library mapped to your existing framework
- Evidence collection built into the delivery path
Evidence you keep
- Populated AI system inventory
- Control gap register
- Regulatory crosswalk for your estate
Maps to
Resources for this practice
Our thinking, published.
Sourced notes and open working material. Use them in your own programme — you do not need to engage us to benefit from them.
Note
Governance is not the fifth layer
NVIDIA and Red Hat describe the AI factory as a five-layer cake, with governance at the top. In a regulated or sovereign environment, that is precisely where AI programmes go to die.
Read · 9 minPublished method
OSFI E-23 regulatory crosswalk
Twelve E-23 principles mapped to NIST AI RMF, ISO/IEC 42001, SR 26-2 and the EU AI Act
OpenPublished method
AI system inventory schema
The Appendix 1 minimum tracking standard as a working schema
OpenOther practice areas
Labels show what is traceable to a regulator or standards body (Authoritative) and what is our professional reading of it (Interpretation). Where an engagement involves technology from a vendor Aegis holds a commercial relationship with, we disclose that interest in writing before recommending it.