Banks and model risk: AI hiring tools under OSFI E-23 and SR 26-2

What it is

Banks do not only ask whether a hiring tool is lawful. They ask whether it is a model, because a model has to go through the bank’s model risk management framework: inventory, risk rating, independent review or validation, approval and monitoring. Two supervisory documents set the expectations for that framework:

• OSFI Guideline E-23, Model Risk Management (2027), for Canadian federally regulated financial institutions. OSFI published the final guideline on 11 September 2025, and it takes effect on 1 May 2027.
• SR 26-2, Revised Guidance on Model Risk Management, issued on 17 April 2026 by the Federal Reserve, the OCC (as Bulletin 2026-13) and the FDIC. It supersedes and replaces SR 11-7, issued on 4 April 2011, and SR 21-8.

Neither document mentions hiring or human resources. Whether an AI hiring tool is a model is answered by the definitions, and the answer differs between the two.

OSFI E-23: an AI hiring tool is in scope

E-23 applies to all models at all federally regulated financial institutions, including foreign bank branches and foreign insurance company branches (section A.2). It defines a model as "an application of theoretical, empirical, judgmental assumptions or statistical techniques, including AI/ML methods, which processes input data to generate results", with an input component, a processing component and a result component (section A.4). A tool that uses machine learning to score, rank or screen candidates fits that definition on its terms.

Three features of E-23 matter for a hiring tool:

• Vendor models are covered. The framework covers models sourced from third-party vendors, alongside OSFI’s Guideline B-10 on third-party risk (Principle 1.2), and institutions should identify models used across the enterprise, "including vendor and third-party models" (Principle 2.1). OSFI’s cover letter adds that it is up to each institution to ensure vendors provide adequate documentation.
• Model risk is not only financial. E-23 defines model risk to include operational and reputational consequences. Its qualitative risk-rating factors include business use, complexity or level of autonomy, reliability of data inputs, customer impacts and regulatory risk (Principle 2.2).
• Bias is named. E-23 asks institutions to consider "the potential for unwanted bias within the data which can translate into unfair model outputs" (Principle 3.2), and, for AI/ML models, the potential for biased outcomes, negative social and ethical implications or privacy risks, and the level of explainability required.

E-23 applies on a risk basis, proportional to the institution’s size, strategy, risk profile and complexity (section A.3). Institutions keep in their model inventory every model whose inherent risk is non-negligible, and may define a negligible tier exempt from full lifecycle governance. A hiring tool’s place in that scheme is the bank’s call. E-23’s autonomy and regulatory-risk factors, and the employment, human rights and privacy law that applies to hiring, are the arguments against rating a candidate-screening tool as negligible.

SR 26-2: narrower, and not binding

SR 26-2 defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates", and excludes simple arithmetic and "deterministic rule-based processes and software" with no such theory behind them. For a hiring tool, two parts of the guidance matter most:

• Generative and agentic AI are out of scope. "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." Its principles apply to traditional statistical and quantitative models and to "non-generative, non-agentic AI models." A bank’s own governance should still guide the controls for tools outside it. Many hiring platforms now combine a scoring model with generative features, and under SR 26-2 the two parts sit differently.
• Purpose drives materiality. Models developed to meet regulatory requirements or manage financial risk "are generally considered to be of greater risk than models that are not used for such purposes", and a bank may deem some models immaterial. The guidance expects to be most useful for models supporting significant business lines, operations, services and functions.

SR 26-2 is expected to be most relevant to banking organizations with over $30 billion in total assets. It "does not set forth enforceable standards or prescriptive requirements", and non-compliance with it "will not result in supervisory criticism", though supervisory action may still follow violations of law or unsafe or unsound practices stemming from insufficient management of model risk.

On vendor products, SR 26-2 says the principles of model risk management "remain applicable" even where the vendor withholds code, data or methodology. Sound practice includes validating vendor products "either by internal or outside parties", understanding the vendor model’s conceptual soundness, design, development data and performance, and ongoing monitoring and outcomes analysis to check that it remains fit for purpose.

What the bank’s validators need from the deployer side

A model reviewer at a bank asks what the tool is for, what goes into it, how it was tested, where it is weak, who acts on its output, and how it is watched in production. A vendor’s documentation answers part of that. The rest is about deployment, and it is the deployer’s to write.

A deployer-side conformity file supplies:

• Intended use and scope: which roles, which hiring stages, which decisions the output feeds. E-23’s review asks whether a model is "fit-for-purpose", and SR 26-2 warns that using a model beyond its intended purpose adds risk.
• Inputs and data sources: what candidate data the tool receives and from where, which E-23 treats as a factor of model risk.
• Known limitations and the vendor’s own testing, as disclosed under the contract.
• Bias and adverse-impact testing of outcomes in your own candidate pool, which feeds the bank’s outcomes analysis and answers E-23’s bias considerations.
• The human-decision boundary: where the tool’s output stops and a person decides, which bears on E-23’s autonomy factor and on the bank’s employment-law exposure.
• A monitoring plan and change log: version, what is measured, how often, and what triggers review.

Several of those map onto the inventory fields E-23 lists in Appendix 1: model owner, developer, origin, version, data sources and limitations.

What the file cannot do is validate the model. E-23 expects model review to be "independent from model development", performed by internal reviewers or objective third parties, with an extent and frequency set by the risk rating, and holds that "institutions are accountable for their use of models." SR 26-2 expects effective challenge from objective experts with "sufficient independence to maintain objectivity". A file written with the business owner who deployed the tool is evidence for that review, not the review. The bank’s model risk function still assigns the rating, challenges the evidence, approves the model and sets the next review date.

Timeline

• 4 April 2011: SR 11-7 issued.
• 11 September 2025: OSFI publishes the final Guideline E-23.
• 17 April 2026: SR 26-2 and OCC Bulletin 2026-13 replace SR 11-7 and OCC Bulletin 2011-12.
• 1 May 2027: E-23 takes effect for all federally regulated financial institutions.

What this means in practice

For a Canadian bank, an AI screening or assessment tool that meets E-23’s definition will need to be identified and rated under the bank’s framework by May 2027, whoever in the business bought it. For a US bank, SR 26-2 leaves more to the bank’s own judgment, and its generative-AI carve-out means a platform’s newer features may fall under the bank’s wider AI governance rather than model risk guidance.

Model risk is one review. The hiring tool is also subject to the employment and privacy law where the bank hires: the EU AI Act for EU hiring, NYC Local Law 144 for New York roles, Ontario and Quebec in Canada, and the UK GDPR and Equality Act in the UK.

The deployer-side file Casework builds is written to be handed to a bank’s model risk team as well as to counsel: one description of the system, its data, its testing and its oversight, on a fixed methodology. Casework is not a law firm and does not perform the bank’s independent validation.

Frequently asked questions

Is an AI hiring tool a model under OSFI Guideline E-23?

It can be. E-23 defines a model as an application of theoretical, empirical or judgmental assumptions or statistical techniques, including AI/ML methods, that processes input data to generate results, and it applies to all models at federally regulated financial institutions, including vendor and third-party models. Neither E-23 nor its cover letter mentions hiring or HR models; a screening or ranking tool that uses machine learning to score candidates meets the definition on its terms.

When does OSFI Guideline E-23 take effect?

On 1 May 2027. OSFI published the final guideline on 11 September 2025. It applies to all federally regulated financial institutions, including foreign bank branches and foreign insurance company branches, on a risk basis proportional to each institution's size, risk profile and complexity.

Is SR 11-7 still in force?

No. On 17 April 2026 the Federal Reserve, OCC and FDIC issued revised interagency guidance on model risk management. The Federal Reserve's SR 26-2 supersedes and replaces SR 11-7 (2011) and SR 21-8 (2021), and the OCC's Bulletin 2026-13 rescinded its 2011 model risk bulletin and the Model Risk Management booklet of the Comptroller's Handbook.

Does SR 26-2 cover AI hiring tools?

Partly. SR 26-2 defines a model as a complex quantitative method, system or approach that applies statistical, economic or financial theories to process input data into quantitative estimates, and excludes simple arithmetic and deterministic rule-based software. Its principles apply to traditional statistical models and non-generative, non-agentic AI models; generative and agentic AI models are outside its scope. It is expected to be most relevant to banking organizations with over $30 billion in total assets, and it says models used to meet regulatory requirements or manage financial risk are generally of greater risk than models that are not.

Is SR 26-2 binding on banks?

No. SR 26-2 says it does not set forth enforceable standards or prescriptive requirements, and that non-compliance with it will not result in supervisory criticism. It adds that supervisory action may still result for violations of law or unsafe or unsound practices stemming from insufficient management of model risk.

Can a vendor's or consultant's documentation replace a bank's model validation?

No. E-23 expects model review to be independent from model development, and allows institutions to use internal reviewers or objective third parties; the institution remains accountable for its use of models. SR 26-2 calls for effective challenge by objective experts with sufficient independence, and for validation of vendor products by internal or outside parties. A deployer-side conformity file is evidence the validator uses: intended use, inputs, limitations, bias testing, oversight and monitoring. The bank's model risk function still rates, reviews and approves the model.

---

Looking at this regulation from the vendor side instead? HireAIScore covers vendor compliance posture against this regulation.