OpenAI launched ChatGPT for Financial Services on September 10, 2026. For a federally regulated Canadian institution, the product page is the easy read; OSFI’s Guideline E-23 on model risk, in force May 1, 2027, decides what the purchase file needs.
- OpenAI says the product bundles financial data from providers such as PitchBook, Daloopa, LSEG News and Crunchbase, indexed and hosted on OpenAI infrastructure, with GPT-6 Astra as the model.
- OSFI’s E-23 expressly covers vendor and third-party models, and asks institutions to inventory, rate, review and monitor them.
- A bank or insurer that pilots the product this autumn will want its model inventory entry written before E-23 takes effect, not after.
OpenAI’s announcement of ChatGPT for Financial Services, dated September 10, 2026, promises bankers “granular citations” that trace figures back to their sources, and firm-wide controls over access and data connections. The document that governs how a Canadian bank may use it was published a year earlier: the Office of the Superintendent of Financial Institutions’ Guideline E-23, Model Risk Management (2027), which takes effect on May 1, 2027. Our view is that the guideline, not the feature list, should set the terms of any pilot.
What OpenAI is selling
The product is a version of ChatGPT Work for “eligible financial institutions,” built with design partners Morgan Stanley and Evercore and aimed first at investment banking and equity research. OpenAI says it includes premium datasets that it indexes and hosts itself, shared sign-in with subscriptions such as S&P Capital IQ, LSEG, MSCI, Factiva and Moody’s, more than 50 connectors, and administrator-published Excel, Word and PowerPoint templates.
On governance, the page lists SAML single sign-on, SCIM provisioning, role-based access, configurable retention, log export through the OpenAI Compliance Platform, and separate workspaces “to enforce information barriers.” It also states that business data “is not used to train our models by default.” Those are vendor statements; we have not seen the contract terms that would bind them, and the page says nothing about where Canadian data is stored.
What E-23 says about a vendor model
E-23 applies to every federally regulated financial institution, including foreign bank branches, and its definition of a model includes AI and machine-learning methods. It asks institutions to identify “all models in use,” explicitly “including vendor and third-party models,” and to rate each one on a standalone basis when it is externally developed. A research assistant that drafts valuation models and client materials sits comfortably inside that definition.
Three provisions matter most for this purchase:
- Inventory. Appendix 1 lists what each model record should hold, including model version, owner, approver, dependencies, data sources, approved uses and limitations.
- Review triggers. A model review is prompted by “model modifications,” and monitoring must track “external dependencies (for example, version updates).” OpenAI’s page says newer models will be “available out of the box as they are released.” Each such release is, on E-23’s terms, a change the institution has to notice.
- Data. Data used must be “traceable (that is, having documented lineage and provenance).” Vendor-hosted third-party datasets satisfy that only if the institution can document which dataset fed which output.
The citation feature helps with the third point. It does not answer the second.
The other reading
A reasonable compliance officer could argue that a drafting assistant is a tool, not a model: a banker checks every figure, and the human judgment is the decision. E-23 itself allows a “negligible” risk tier that exempts some models from full lifecycle governance, through “a robust process to approve and track such exemptions.” We accept that some uses will land there. We still read the guideline as requiring the institution to make and record that call, and a tool that produces valuation models for client advice is a poor candidate for the exemption.
Fine Print
- Instrument: OSFI Guideline E-23, Model Risk Management (2027), published September 11, 2025.
- Status and effective date: final guideline, effective May 1, 2027.
- Who decides or enforces: the Office of the Superintendent of Financial Institutions, through supervision.
- Who it applies to: federally regulated banks, foreign bank branches, life, fraternal and property and casualty insurers, and trust and loan companies.
- What changes: vendor AI models need an inventory entry, a risk rating, review triggers for version changes, and documented data lineage.
- What is still undecided: whether ChatGPT for Financial Services is offered to Canadian institutions, and on what data-residency terms. Unknown as of September 11, 2026.
Provincially regulated credit unions and caisses are outside E-23, though their own regulators publish comparable expectations. Readers outside finance may find the same logic in our column on the privacy commissioner’s AI vendor checklist, and the key-handling points in AI API key security apply to any connector this product would use. More policy analysis is in AI Policy in Canada and our AI for business guide.
This is general information, not legal or regulatory advice.
What to do before May 1, 2027
Before any pilot starts, have the model risk function draft the E-23 inventory entry for the product, with an owner, an approver, the model version in use, and a written rule for what happens when OpenAI changes that version. If the vendor cannot tell you when the version changes, write that limitation into the entry.
A related case: what happens under E-23 when a vendor swaps the model behind a pinned name.
FAQ
What is ChatGPT for Financial Services?
It is a version of ChatGPT Work that OpenAI launched on September 10, 2026, combining GPT-6 Astra with built-in financial datasets, connectors and firm templates for eligible financial institutions.
Does OSFI Guideline E-23 cover AI tools from vendors?
Yes. E-23 asks federally regulated institutions to identify all models in use, including vendor and third-party models, and its definition of a model includes AI and machine-learning methods.
When does OSFI Guideline E-23 take effect?
May 1, 2027. OSFI published the final guideline on September 11, 2025.
