Are you ready for E-23?

E-23 requires named, documented accountability for model risk at the board level and below. Has your institution assigned and documented who owns model risk — including AI/ML models?

E-23 requires a complete inventory of all models in use, with each model classified by risk tier. The expanded scope explicitly captures AI, ML, and qualitative models — not only traditional credit/capital models.

E-23 requires a documented methodology for rating each model's materiality and risk — driving the depth of validation, review frequency, and governance attention each model receives.

E-23 requires effective challenge through validation — including conceptual soundness review, outcomes analysis, and ongoing performance monitoring. AI/ML models need validation approaches that handle non-deterministic outputs.

E-23 emphasises effective challenge from a function independent of the model developers and users — with sufficient AI/ML technical capability to provide meaningful scrutiny, not just procedural compliance.

E-23 requires continuous monitoring of model performance, drift detection, and disciplined change management. For AI/ML models, monitoring must capture performance drift, data drift, and behavioural change between versions.

E-23 requires documentation sufficient for an independent reviewer to understand each model's purpose, design, data, limitations, and use. For AI/ML, this includes data lineage, training methodology, and limitation statements.

E-23's revisions are particularly attentive to AI/ML risk: explainability, bias and fairness assessment, generative AI controls, and the boundary between human judgment and model output. This is the dimension institutions most often underestimate.