Canada - Automated Decision-Making Directive

Overview

The Treasury Board of Canada Secretariat (TBS) Directive on Automated Decision-Making (launched 4 March 2019 and put into force 1 April 2019) establishes mandatory requirements for federal departments that use automated decision systems (ADS) to make or assist administrative decisions. It sets a proportional, impact-based approach organized around the Algorithmic Impact Assessment (AIA) that determines four impact levels (Level I to Level IV) and maps those to mitigation steps. The Directive’s objective is to ensure transparency, fairness, accountability and quality of government automated decisions while preserving citizen rights and public trust. For the primary policy text and official publication see the Government of Canada publications entry and the TBS policy page: Directive on automated decision-making (Publications GC) and the TBS portal for responsible use of AI: Responsible use of AI (Canada.ca).

Definitions

The Directive defines key terms used across the instrument. "Automated decision system (ADS)" refers to any system (including AI and machine learning, rule-based systems, or other technologies) used to make, assist, or inform an administrative decision. "Administrative decision" means decisions that affect the rights, interests or privileges of clients. "Impact level" is the result of the AIA, expressed as Level I (little/no impact) to Level IV (very high impact). "Full automation" occurs when the system makes the final decision; "partial automation" applies when the system contributes to or augments human judgment. The Directive distinguishes production systems from research/experimental systems (the latter are generally out of scope).

Governance and Institutional Framework

The Directive is owned by the Treasury Board of Canada Secretariat and operationalized by the Office of the Chief Information Officer (OCIO) within TBS. Departmental governance must assign senior accountability: deputy-head-level awareness, an Assistant Deputy Minister or equivalent sponsor, and designated project leads responsible for completing the AIA, implementing mitigations, and publishing results. The OCIO provides the AIA tool, guidance and oversight. Departments must consult their legal services and privacy officers early in the project lifecycle. See TBS guidance for roles and responsibilities: Algorithmic Impact Assessment (AIA) tool page and peer review guidance: Guide to Peer Review.

Key Focus Areas

The Directive concentrates on a set of interrelated obligations: (1) Risk assessment and impact scoring through the AIA, (2) Proportionate mitigation mapping (Appendix C) tied to impact level, including testing, bias and fairness evaluation, and peer review, (3) Transparency obligations — publishing the AIA and peer review results (or summary) before launch for systems at impact Level II and above, (4) Human oversight — ensuring appropriate human roles and ability to override or review automated outputs, (5) Data governance and privacy — conducting privacy impact assessments and ensuring secure handling of training and operational data, (6) Monitoring and measurement — post-deployment monitoring of accuracy, fairness and adverse outcomes, (7) Documentation, reproducibility and recordkeeping to support audits and accountability, and (8) Remediation and recourse — providing appeal or challenge mechanisms for affected individuals. The Directive also requires departmental legal and privacy consultations during concept and design stages to ensure compatibility with statutory obligations and administrative law principles.

Implementation Framework

Implementation is operationalized through the AIA which is mandatory and publicly available; it contains risk and mitigation questions that produce an impact-level score. For each impact level, the Directive prescribes baseline and additional measures (peer review, increased testing, monitoring frequency, human-in-the-loop rules). Departments must publish the final AIA on the Open Government Portal in accessible formats and in both official languages. The 2023 amendments tightened timing and publication requirements: AIAs should be published prior to launch, peer review findings (full or summary) should be published pre-production for higher impact systems, and internal compliance timelines were introduced to allow transition for existing systems. The OCIO offers departmental support and maintains the AIA tool. For scope and applicability guidance see TBS’s scope guide: Guide on the Scope of the Directive.

Monitoring and Evaluation

Monitoring requirements include routine operational performance checks, bias and fairness testing, outcome monitoring for adverse events, and scheduled AIA reviews (frequency determined by impact level and system change). Departments must validate mitigation effectiveness and update the AIA following changes to system functionality or scope. Reporting obligations to TBS and public reporting via the Open Government Portal enable centralized monitoring of uptake and outcomes across government. The OCIO may request information and conduct compliance assessments; departments should align monitoring schedules with reporting and review cycles identified in the Directive.

Penalties, Liability, and Appeals

As a Treasury Board policy instrument, the Directive does not create criminal penalties; enforcement is administrative and internal. Non-compliance can trigger escalation to deputy heads, mandated remediation plans, suspension or blocking of procurement or deployment, and reputational and political consequences. Departments remain subject to statutory obligations (Privacy Act, Access to Information Act) and potential review by the Office of the Privacy Commissioner. The Directive requires departments to provide procedural recourse or appeals mechanisms for affected individuals when automated decisions materially affect rights or interests.

Relationship to Other Instruments

The Directive complements existing federal instruments including the Policy on Service and Digital, Directive on Service and Digital, Privacy Act and related privacy and information management policies, and the government’s digital standards. It aligns departmental technology procurement processes with modernized procurement practices and qualified supplier lists. Guidance materials (AIA tool, peer review guidance, scope guide) and publications by TBS provide interpretive support. See the policy collection and associated documents on the Government of Canada AI pages: Responsible use of AI collection.

International Alignment

The Directive reflects international trends toward impact-based regulation of AI in the public sector and aligns with principles from OECD and other jurisdictions’ public-sector AI guidance (transparency, fairness, accountability). Canada’s approach emphasizes administrative law compatibility and public accountability and has informed, and been informed by, peer governments and international standards bodies. The Directive’s impact-tier model and the mandatory public risk assessment align with global best practices for public-sector AI governance and facilitate international interoperability on responsible AI approaches.

Implementation Timeline

Sources and References