What E-23 asks you to show.
For Canadian banks, insurers, trust and loan companies and foreign branches whose AI systems fall inside OSFI Guideline E-23, which takes effect on 1 May 2027 and names artificial intelligence and machine learning inside its definition of a model. Generative assistants, retrieval systems and vendor scores included: systems whose output is never the same twice.
Three things are here, all free: a twelve-question check, seven templates, and the route to a dated plan. They come from the handbook OSFI E-23 for AI Systems, an independent practitioner’s book released 5 November 2026, and stand on their own before it ships.
Six minutes, then one template.
The E-23 readiness check asks twelve questions across six themes and names your weakest theme, with the template that addresses it. It scores in your browser, with no form in front of it. Start there if you do not yet know which template you need.
Three terms recur on these pages. The handbook calls its method the discipline, and where a rule is the discipline’s choice rather than E-23’s requirement, the page says so. A gate is one of five points at which one named person is accountable for a system: G1 Data and Design, G2 Validation, G3 Approval, G4 Deployment, G5 Operation. A BOE Declaration states, for one control, the Boundary it fixes, the Optimizer it frees and the Evidence that the boundary held.
Seven templates, one per chapter.
The handbook prints one download line at the end of each chapter that uses a template. Every template’s field list is in the text of its chapter, so the file is a convenience and the method is in the book. Each page below shows the fields before it asks for anything.
| Ch. | Download | What it produces |
|---|---|---|
| 1 | The E-23 scope self-check | Which of your AI systems sit inside the guideline, and which exemptions need a record. |
| 5 | The gate record template, G1 to G5 | Five gate records, each naming one accountable person. |
| 6 | The BOE Declaration template and the Coldbrook worked example | One BOE Declaration: the boundary a control fixes, the optimizer it frees and the evidence that the boundary held. |
| 7 | The PEVG and PARA review question set | The questions a validator puts to the engineer who built an agent. |
| 9 | The AVRF questionnaire, scoring sheet and the Pellbrook worked example | One vendor scored, with a gate decision. |
| 10 | The trigger register template and the Thornbury worked example | A trigger register with its triggers armed and owned. |
| 11 | The gap plan template | A dated gap plan with an owner per gap. |
What the work adds up to.
Work through the book with one of your own systems in hand, and by the last chapter the writing adds up to five artifacts, each produced in a named chapter. Five of the seven templates produce them; the other two, the scope self-check and the agent question set, are working tools used on the way.
The method is in the text.
OSFI E-23 for AI Systems, by Dr. Nabeel A. Khan, released 5 November 2026. An implementation and operating handbook, not a compliance guide: the guideline sets expectations, and the discipline in the book is one way of meeting them. Ebook and paperback.
When you want it tested.
The Office of the Superintendent of Financial Institutions (OSFI) does not endorse, approve or recommend this book, its author or any framework in it. Conformance with any framework named here is self-declared, by the institution, on its own record. Coldbrook, Thornbury and Pellbrook are fictional institutions, invented for the book.
Twelve questions, six themes, and the weakest one named.
Ask your AI assistant instead.
This page is a snapshot, accurate at the release it cites. The same corpus is callable, publicly and without a key, so an assistant can query it live and return an answer carrying the source it came from. For this page that is get_framework, which returns the Defensible AI Framework Registry entry for any framework these templates are built on (the Five-Gate Deployment Model, the AVRF, PEVG, PARA), with its version and the concept DOI of its deposited specification. It does not yet hold the E-23 handbook or the guideline itself; for those, this page and the book are the source.
claude mcp add --transport http concylium https://mcp.nabeelkhan.com/api/mcpClaude Desktop, ChatGPT, Cursor, VS Code and Gemini CLI take the endpoint on its own: https://mcp.nabeelkhan.com/api/mcp. No key, no account, nothing to sign. Setup for every client.
“Using Concylium, get the Five-Gate Deployment Model and the AVRF from the framework registry, with their versions and DOIs, and tell me which gate a vendor model decision belongs to.”
A framework quoted from memory drifts. One returned from its registry, with the DOI of the deposited specification, does not.