Canada - Generative AI Guidance

Overview

The Treasury Board of Canada Secretariat (TBS) published the Guide on the use of generative AI to provide preliminary, practical guidance to federal institutions that are exploring or deploying generative artificial intelligence tools. The Guide distinguishes between low‑risk uses (for example internal drafting, brainstorming, research assistance) and higher‑risk uses such as public‑facing chatbots or systems that summarize client data or inform administrative decisions. It promotes a risk‑based approach, encourages experimentation within controlled environments, and advises institutions to limit use to contexts where risks can be effectively managed. The document is available as official government guidance on Canada.ca and as a Government of Canada Publications entry; the Guide has been updated to a second version to incorporate internal and external feedback. For the official HTML guide see Guide on the use of generative artificial intelligence (Canada.ca).

Definitions

The Guide defines generative AI as systems that produce content (text, audio, code, video, images) in response to a user's prompt, often by predicting likely continuations based on training data. It references the Directive on Automated Decision‑Making definition of artificial intelligence for scope. Key operational distinctions include: (1) tools hosted and controlled by the Government of Canada vs. publicly hosted third‑party tools; (2) transient, non‑business‑value uses (e.g., quick brainstorming) vs. uses that create records or inform administrative decisions; and (3) proprietary vs. open‑source models with differing transparency, data‑provenance and contractual considerations.

Governance and Institutional Framework

TBS places responsibility on federal institutions to govern generative AI uses through existing institutional roles and policy instruments. Public servants must consult legal counsel, privacy and security experts, the institutional Chief Information Officer and Chief Data Officer, diversity and inclusion specialists (including GBA+), and bargaining agents where appropriate. The Guide integrates with the Directive on Automated Decision‑Making, the Policy on Service and Digital and the Directive on Security Management, requiring algorithmic impact assessments, documentation standards, and approvals where institutional risk thresholds are met. TBS’s Office of the Chief Information Officer and the Responsible Data and AI team provide advice and point resources; the Guide also references the Canadian Centre for Cyber Security for technical security guidance (Generative Artificial Intelligence (AI) - ITSAP.00.041).

Key Focus Areas

The Guide’s principal operational focus areas include: risk assessment and mitigation, privacy and data protection, bias and fairness testing, documentation and record management, security and resilience, transparency and user notification, procurement and supplier contract due diligence, environmental considerations, and workforce training. The FASTER principles (Fair, Accountable, Secure, Transparent, Educated, Relevant) act as an organizing framework for these focus areas. Specific expectations include: not entering personal or sensitive information into public third‑party tools; using GC‑managed instances for sensitive processing; incorporating opt‑out or non‑training contractual terms where feasible; and testing models across languages and population groups to assess differential performance. The Guide places special emphasis on scenarios that could affect legal rights or procedural fairness (for example, eligibility assessments or case summaries) and therefore may fall under the Directive on Automated Decision‑Making.

Implementation Framework

Implementation is guided by a staged, risk‑based methodology: (1) identify the purpose and risk profile of the proposed use; (2) consult stakeholders (legal, privacy, security, GBA+ and client groups); (3) conduct pre‑deployment testing including bias, accuracy, robustness and security testing; (4) document decisions, retention and approval steps in line with information management rules; (5) procure or configure tools with contractual protections (data residency, non‑training, IP clarity); (6) deploy with monitoring and user notification; and (7) maintain continuous evaluation and audits. The Guide advises completing an Algorithmic Impact Assessment where the system might inform administrative decisions and recommends planning for independent audits and red‑teaming for systems made publicly accessible. It also points to training modules and a concise do’s/don’ts summary to support day‑to‑day use.

Monitoring and Evaluation

The Guide requires institutions to monitor deployed systems for accuracy, bias, accessibility, security incidents and unintended impacts on clients and employees. Monitoring should include periodic re‑testing of model outputs, performance across official languages, analysis of adverse incident reports, and metrics for user satisfaction and error rates. Where the Directive on Automated Decision‑Making applies, additional reporting, logging and transparency obligations follow. The Guide also encourages institutions to schedule periodic reviews aligned with technology updates and to plan for independent audits and third‑party evaluations when risk levels are high.

Penalties, Liability, and Appeals

The Guide itself is a policy instrument and not a statute that creates formal criminal penalties; however, federal institutions remain subject to the Privacy Act, Access to Information Act, labour and employment rules, and other legal obligations. Non‑compliance with Treasury Board policies can lead to administrative or disciplinary measures, privacy complaints to the Office of the Privacy Commissioner (Office of the Privacy Commissioner of Canada), orders or findings, reputational harm, and civil liability where statutory or common‑law duties are breached. The Guide notes that institutions should design grievance and redress procedures for individuals affected by AI‑informed administrative outcomes and ensure procedural fairness mechanisms are available where decisions could deprive rights or benefits.

Relationship to Other Instruments

The Guide explicitly complements and does not replace the Directive on Automated Decision‑Making, the Policy on Service and Digital, the Directive on Security Management and existing information‑management and records retention obligations. It references the Algorithmic Impact Assessment tool, the Guideline on Service and Digital (Appendix E) for documentation and business value determination, and procurement rules for third‑party services. Institutions are advised to use the Guide alongside sector‑specific rules and to update internal policies to maintain consistency with TBS guidance.

International Alignment

The Guide references international policy considerations and draws on best practices and research, aligning Canada’s approach with OECD and EU policy themes such as transparency, human‑centric AI and risk‑based governance. TBS positions the Guide as part of the Government of Canada’s broader AI strategy and ongoing international engagement; it encourages institutions to monitor global regulatory developments and to adopt interoperability and transparency measures that facilitate cross‑border data governance and procurement compliance.

Implementation Timeline

Sources and References

Primary official sources include the official Government of Canada guidance page on Canada.ca and official catalog entries from Government of Canada Publications (2023 and 2024 editions). Technical cybersecurity guidance is provided by the Canadian Centre for Cyber Security (ITSAP.00.041).