Schemas

E-23 Living Evidence File Schema

The machine-readable shape of the living evidence file: one record per model, seven evidence blocks, every legal claim carrying a source id. Versioned, so a file written today stays readable when the schema moves.

Current version

v0.2.0, published November 4, 2026.Download the JSON Schema (draft 2020-12).

Role-only signoff. The human_signoffblock records the accountable role (for example the privacy officer designated under Law 25 s. 3.1), never a person's name. Stamps carry roles, not names: a portable approval record is no place for a person's identity. This aligns the living file with the stamp spec's zero-PII design.

What v0.1.0 covers

Model inventory (E-23 Pr. 2.1): name, version, owner, developer, origin, lifecycle status, deployment date.
Inherent risk rating (Pr. 2.2): the institution's categorical tier, the measurable criteria behind it, and the rationale.
Independent validation (Pr. 3.4): reviewer, independence from development, review scope and dates, outcome, approver.
Pre-deployment cyber assurance (Pr. 3.5, B-13 s. 3.1.2): cybersecurity risk assessment date plus intelligence-led penetration testing and red teaming records.
Continuous drift monitoring (Pr. 3.6): frequency, drift detection method, thresholds, last check, exceptions.
Third-party audit rights (B-10 Principle 8 (s. 2.3.3)): vendor name, contractual audit rights, last audit. Technology and cyber-standards compliance is the separate B-10 s. 4.2 provision.
AMF AI system coverage (2026-PDG-0016): institution type, risk rating, validations, controls, including AI uses that never touch client records.

Source ids

Every legal claim in a living-file instance carries a source id from this registry:

OSFI-E23-2027: Guideline E-23, Model Risk Management (2027). Final, in force May 1, 2027.
OSFI-B13: Guideline B-13, Technology and Cyber Risk Management. In force since January 1, 2024.
OSFI-B10: Guideline B-10, Third-Party Risk Management (revised April 2023). In force May 1, 2024.
AMF-2026-PDG-0016: AMF Guideline for the Use of Artificial Intelligence. AMF decision 2026-PDG-0016 dated March 30, 2026, published April 2, 2026, in force May 1, 2027.

Version history

v0.2.0 (2026-11-04): role-only signoff. The human_signoff.name field is removed; signoff records the accountable role, never a person's name, per the stamp spec's zero-PII design. B-10 audit-rights citation unified to Principle 8 (s. 2.3.3).
v0.1.0 (2026-11-04): initial release. Seven evidence blocks, board export, human signoff, non-certification disclaimer.

Build a file

The E-23 Evidence Indexbuilds living-file instances in your browser and exports them as JSON and as a board-ready PDF. Nothing leaves your device.