THE ENTERPRISE AI SIGNAL · BANKING SERIES 1 OF 5 · 2026-11-03
By Roman Bodnarchuk, Founder, WisdomTwin, Inc.
+ mckinsey calls time on the copilot era, osfi puts ai inside model risk, and the eu fixes the credit scoring deadline
Cold open. AI in banks is moving from tools that draft to coworkers that execute. The obvious read is a productivity story, but the real story is that a wrong answer now changes a system instead of a draft.
Signal 1. The copilot era is closing
McKinsey's Tech & AI group published a banking CIO guide on 2026-10-26. Its argument: banks spent the last few years optimizing copilots, and that phase is ending.
What replaces it is the agentic coworker. It is not a single agent answering a prompt. It is a coordinated system of agents, skills and tools commissioned to a business role, keeping context across cases and running persistently.
The failure mode changes with it. A copilot error costs rework. A coworker error can change a production system, expose client data or trigger a compliance event before anyone looks.
Signal 2. Canada already put AI inside model risk
OSFI published the final Guideline E-23, Model Risk Management, on 2025-09-11. It takes effect for every federally regulated financial institution on 2027-05-01.
The final text adds clarity on AI and machine learning models. Institutions are expected to identify models and manage model risk in proportion to each model's risk rating.
Third-party models fall under Guideline B-10, and OSFI chose not to grant a grace period for third-party model risk. A vendor's agent is still your model risk.
Signal 3. Europe fixed the credit scoring date
On 2026-05-07 the European Parliament and Council reached political agreement on the Digital Omnibus on AI. Rules for stand-alone high-risk AI systems now apply from 2027-12-02, and from 2028-08-02 for AI built into regulated products.
Creditworthiness assessment and credit scoring of individuals is a listed high-risk use under Annex III of the AI Act. Article 14 requires that high-risk systems can be effectively overseen by people while in use.
The delay moves the date, not the duty. An agent that drafts a credit memo on an EU borrower inherits the oversight requirement.
SOURCE: European Commission, 2026-05-07 · EUR-Lex, Regulation (EU) 2024/1689, consolidated 2026-07-27
EXECUTIVE NOTE. Govern every agent that can act the way you govern a new hire: a badge, a manager and a limit.
Control Signals
▲ 179 days from this issue until OSFI E-23 applies to every federally regulated financial institution in Canada (2027-05-01). SOURCE: OSFI
■ 394 days from this issue until EU high-risk obligations apply to stand-alone systems, including credit scoring (2027-12-02). SOURCE: European Commission
● 40 to 50 percent less manual review effort, reported by McKinsey for one North American bank's architecture review coworker, with architects keeping sign-off. SOURCE: McKinsey
The Enterprise Move
List every AI tool in production and flag each one that can write, send, close or approve anything. Those are coworkers, not copilots.
Add every flagged tool to the model inventory you are building for E-23, vendor agents included.
Name one accountable executive per agent before the next pilot reaches production.
Go further
WisdomTwin, Inc. AI Judgment Twins that turn the judgment trapped in critical enterprise roles into governed, auditable agents. https://www.wisdomtwin.ai
Watch on YouTube: https://www.youtube.com/@WisdomTwin
Forwarded this? Get The Enterprise AI Signal every Tuesday: www.10xai.news/subscribe
Know a CRO, CIO or head of model risk who should read this? Forward it. That is how this briefing grows.