Directive on Automated Decision-Making
Canada · Regulation · Treasury Board of Canada Secretariat
Our summary
This directive requires Canadian government departments to use automated decision systems in ways that comply with procedural fairness, transparency, and human rights protections. It applies to all automated systems used to make administrative decisions affecting clients, and mandates impact assessments, testing for bias, public notice, human review options, and performance reporting. The policy aims to ensure that machine learning and other algorithmic systems produce fair, accurate, and interpretable decisions.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
38 sections
Jump to a chapter
- Search and menus
- Supporting tools
- More information
- Hierarchy
- Archives
- 1 Effective date
- 2 Authorities
- 3 Definitions
- 4 Objectives and expected results
- 5 Scope
- 6 Requirements
- 7 Roles and responsibilities of Treasury Board of Canada Secretariat
- 8 Application
- 9 References
- 10 Enquiries
- Appendix A - Definitions
- Appendix B - Impact Assessment Levels
- Appendix C - Impact Level Requirements
Supporting tools
More information
Hierarchy
Archives
1 Effective date
The directive becomes effective April 1, 2019, with organizations required to comply by April 1, 2020. It applies to all intelligent decision systems created or obtained after April 1, 2020, though existing systems have until June 24, 2026 to meet new or changed requirements, as do Agents of Parliament. The directive undergoes review every two years or as determined by Canada's Chief Information Officer.
2 Authorities
This directive derives its authority from the same basis cited in the Policy on Service and Digital.
3 Definitions
Key terms used throughout this directive are explained in Appendix A.
4 Objectives and expected results
This directive aims to make intelligent decision systems safer for clients, organizations and society, and to produce judgments that are more reliable, precise, uniform and understandable under Canadian law. Expected outcomes include evidence-based and accountable choices that meet fairness and due process standards, assessment of harms with mitigation of adverse impacts, and public availability of information on system deployment while preserving privacy and other protected interests.
5 Scope
The directive covers operational intelligent decision systems that make or inform administrative decisions or evaluations concerning clients. It excludes systems used only for learning activities and development or those in trial phases.
6 Requirements
5 sections
Assistant deputy ministers overseeing programs using intelligent decision systems, or other designated senior officials, bear responsibility for impact assessment, openness, performance testing, complaint remedies and reporting.
6.1 Algorithmic impact assessment
Institutions must complete and publish algorithmic impact assessments in accessible format on the Open Government Portal before building automated decision systems, apply relevant requirements based on the assessment results, and regularly review and update assessments when system functionality or scope changes.
6.2 Transparency
This section establishes requirements for informing the public about automated decisions before and after they are made, providing access to system components, and documenting how decisions are reached.
Providing notice before decisions
Providing explanations after decisions
Access to components
Documenting decisions
6.3 Quality assurance
This section covers requirements for testing and monitoring system performance, managing data quality and governance, conducting peer review, applying gender-based analysis, training staff, maintaining security, addressing legal considerations, and preserving meaningful human involvement in decision-making.
Testing and monitoring outcomes
Data quality
Data governance
Peer review
Gender-based Analysis Plus
Employee training
Security
Legal
Ensuring human involvement
6.4 Recourse
Institutions must inform clients about how to challenge administrative decisions and ensure that recourse mechanisms are accessible, timely, and effective.
6.5 Reporting
Institutions must publicly report on the Open Government Portal about whether automated decision systems achieve program objectives effectively and operate fairly, transparently, and in compliance with human rights laws.
7 Roles and responsibilities of Treasury Board of Canada Secretariat
The Treasury Board Secretariat must provide guidance on automated decision systems across government, develop and maintain the assessment tool, coordinate approaches with other jurisdictions and sectors, address compliance issues, and support implementation to ensure systems are fair, effective, and transparent.
8 Application
This directive is mandatory for federal public administration bodies covered by the Policy on Service and Digital, while other government entities are encouraged to follow its requirements voluntarily. Agents of Parliament, including the Auditor General, Electoral Officer, and various commissioners, have specific obligations: their leaders must ensure compliance and manage non-compliance, certain provisions do not apply to them, and they are exempt from publishing algorithmic impact assessments and related open government reporting, though leadership must still approve high-risk automated decision systems.
9 References
2 sections
This section lists relevant federal legislation and related government policy instruments that institutions should consult when implementing automated decision systems.
9.1 Legislation
This section identifies eight federal laws that institutions must observe when implementing automated decision systems, including laws on financial administration, access to information, human rights, indigenous rights, privacy, security, and accessibility.
9.2 Related policy instruments
This section lists eleven federal policies and directives that institutions should refer to for guidance on access to information, digital services, security, privacy, personnel management, open government, ethics, and related matters.
10 Enquiries
Departments can contact the Treasury Board of Canada Secretariat Public Enquiries for clarification on the directive, and departmental staff may reach out to ai-ia@tbs-sct.gc.ca for questions about the directive and the Algorithmic Impact Assessment tool.
Appendix A - Definitions
This section defines key terms used in the directive, including administrative decision (action by an authorized official affecting legal rights), algorithmic impact assessment (framework for understanding and reducing risks), automated decision system (technology assisting or replacing human judgment), human rights (inherent entitlements protected by Canadian and international law), production (system in active use with real-world impacts), proprietary (closed-source systems owned by entities), and test environment (sandbox for testing without real impacts).
Appendix B - Impact Assessment Levels
Impact assessment is categorized into four levels based on risk context and data type. Level I covers low-risk systems with easily reversible impacts and low-risk data such as non-personal or structured information; Level II covers moderate-risk systems with reversible, short-term impacts and moderate-risk data including personal or unstructured information; Level III covers high-risk systems with difficult-to-reverse, potentially ongoing impacts and high-risk data including personal information and unstructured data; Level IV covers systems using very high-risk data such as personal, protected, or classified information, unstructured or incomplete data, and concerning data collection approaches.
Appendix C - Impact Level Requirements
Levels I-IV require plain language notice through all service channels and published explanations on discoverable websites describing how systems work, with Levels III-IV also directing clients to those explanations; Levels II-III require explanations to denied benefit clients detailing reasoning. Human involvement escalates from quality assurance and intervention capability at Level I, to human review of decisions at Levels II-III, to human final decision-making at Levels III-IV, with approval authority from assistant deputy minister at Level I to deputy head at Level II to Treasury Board at Levels III-IV.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 18 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 3 of 4
- Prohibited practices, not covered
Data and privacy 1 of 4
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 3 of 4
- Labelling of synthetic content, not covered
Technical safeguards 4 of 4
Assurance and lifecycle 1 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
Rights and protected groups 1 of 4
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 4 of 6
- General purpose and foundation models, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 1 of 5
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 40 are shown.
Search and menus 1 control
- ObligationApplies to: Public authorityDrafted by the Index
The government will use artificial intelligence to make or inform administrative decisions while complying with administrative law principles of transparency, accountability, legality and procedural fairness.
1 3 controls
- ObligationApplies to: Public authorityDeadline was Drafted by the Index
Public authorities must comply with this directive requirements by April 1, 2020.
- ObligationApplies to: Public authorityDeadline was Drafted by the Index
This directive applies only to intelligent decision systems that public authorities develop or acquire on or after April 1, 2020.
- ObligationApplies to: Public authorityDrafted by the Index
The Chief Information Officer of Canada will review this directive every two years or as otherwise determined.
4 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
Public authorities must use intelligent decision systems in ways that minimize threats to clients, departments and society and produce decisions that are more efficient, accurate, consistent and interpretable under Canadian law.
- ObligationApplies to: Public authorityDrafted by the Index
Decisions by public authorities must be founded on evidence and be accountable while meeting procedural fairness and due process standards.
- ObligationApplies to: Public authorityDrafted by the Index
Public authorities must evaluate the consequences of administrative decisions and work to lessen negative outcomes.
- ObligationApplies to: Public authorityDrafted by the Index
Public authorities must publish data and information concerning intelligent decision system deployment in their organizations to the public while safeguarding privacy, security and intellectual property.
6.1 3 controls
- ObligationApplies to: Public authorityDrafted by the Index
Public authorities must finish, sign off on and release the results of an algorithmic impact assessment in a format accessible to the public on the Open Government Portal before constructing any intelligent decision system.
- ObligationApplies to: Public authorityDrafted by the Index
Public authorities must implement the applicable requirements listed in Appendix C as indicated by the algorithmic impact assessment outcomes.
- ObligationApplies to: Public authorityDrafted by the Index
Public authorities must periodically evaluate, sign off on and refresh the published algorithmic impact assessment, especially when the intelligent decision system's capabilities or reach expands.
Providing notice before decisions 3 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers must inform users through all available service channels that their decision will be made using or supported by an automated system, as detailed in Appendix C.
- ObligationApplies to: DeployerDrafted by the Index
Deployers must present notices in a prominent and easily understandable manner.
- ObligationApplies to: DeployerDrafted by the Index
Deployers must provide notices in accordance with the Canada.ca Content Style Guide.
Providing explanations after decisions 1 control
- ObligationApplies to: DeployerDrafted by the Index
Institutions must provide clients with a meaningful explanation of how and why the automated decision was made, as required in Appendix C.
Access to components 4 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers must select the appropriate licence for all software components, including evaluation of open source options.
- ObligationApplies to: DeployerDrafted by the Index
Deployers must obtain and maintain all released versions of software components that comprise the automated decision system.
- RightApplies to: DeployerDrafted by the Index
Where a proprietary licence applies, the deployer must retain the ability to examine, test and oversee the automated decision system and all versions of proprietary software within it for audits, investigations, inspections, examinations, enforcement actions or legal proceedings, with protections against improper access.
Applies when: proprietary licence
- Applies to: DeployerDrafted by the Index
Where a proprietary licence applies, the deployer may authorize outside reviewers, testers, monitors and auditors to examine and assess proprietary software components as required.
Applies when: proprietary licence
Documenting decisions 1 control
- ObligationApplies to: DeployerDrafted by the Index
Deployers must document decisions and assessments made or assisted by the automated decision system to support testing, monitoring, data governance and reporting.
Testing and monitoring outcomes 4 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers must test the data, information and model before the system goes live to confirm accuracy, identify unintended biases and detect all factors that may inadvertently or improperly affect results or breach people's rights.
- ObligationApplies to: DeployerDrafted by the Index
Deployers must continuously track how the automated decision system performs to prevent unintended or unfair outcomes and to confirm it respects human rights commitments, applicable laws and this directive.
- ObligationApplies to: DeployerDrafted by the Index
Deployers must record user feedback, unanticipated consequences, instances where people override system recommendations and other operational problems.
- ObligationApplies to: DeployerDrafted by the Index
Deployers must use data from ongoing monitoring and documented user feedback, unanticipated consequences and overrides to pinpoint problems and implement fixes.
Data governance 1 control
- ObligationApplies to: DeployerDrafted by the Index
Deployers must establish measures so that data used by and produced from the automated decision system is traceable, protected, and accessed in accordance with law, including collection, use, retention, disclosure and disposal rules under related directives.
Peer review 1 control
- ObligationApplies to: DeployerDrafted by the Index
Deployers must consult with appropriately qualified experts to review the system, its algorithmic impact assessment and supporting documentation, and must publish the full review or a summary before the system goes into production as prescribed in Appendix C.
Gender-based Analysis Plus 1 control
- ObligationApplies to: Public authorityDrafted by the Index
Public authorities must complete a Gender-based Analysis Plus when developing or modifying an automated decision system.
Employee training 1 control
- ObligationApplies to: DeployerDrafted by the Index
Deployers must provide training to every employee involved in developing, using or managing the automated decision system as prescribed in Appendix C.
Security 1 control
- ObligationApplies to: DeployerDrafted by the Index
Deployers must implement measures to protect data and model integrity against tampering and unauthorized changes, in line with guidance, standards and industry best practices prescribed by Treasury Board of Canada Secretariat.
Legal 1 control
- ObligationApplies to: DeployerDrafted by the Index
Deployers must consult with their legal services department from the outset of an automation project to confirm that the automated decision system meets applicable legal requirements.
Ensuring human involvement 2 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers must build automated decision systems to allow for human involvement as specified in the policy appendices.
- ObligationApplies to: DeployerDrafted by the Index
Deployers must secure the appropriate level of approvals before putting an automated decision system into production, as specified in the policy appendices.
6.4 2 controls
- ObligationApplies to: DeployerDrafted by the Index
Deployers must tell clients what options are available to challenge administrative decisions made by automated systems.
- ObligationApplies to: DeployerDrafted by the Index
Deployers must ensure that recourse options for challenging decisions are timely, effective and straightforward to access.
6.5 2 controls
- ObligationApplies to: DeployerDrafted by the Index
Institutions must publish information on the Open Government Portal about whether automated decision systems meet program objectives effectively.
- ObligationApplies to: DeployerDrafted by the Index
Institutions must publish information on the Open Government Portal demonstrating that automated decision systems operate fairly and transparently and do not violate human rights and freedoms.
7 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
The Treasury Board of Canada Secretariat must create and maintain the Algorithmic Impact Assessment tool and its supporting documents.
- ObligationApplies to: Public authorityDrafted by the Index
The Treasury Board of Canada Secretariat must engage with government bodies and external partners across different regions and industries to establish shared methods for promoting responsible automated decision systems.
- ObligationApplies to: Public authorityDrafted by the Index
The Treasury Board of Canada Secretariat must notify relevant senior officials when compliance concerns surface regarding this directive.
- ObligationApplies to: Public authorityDrafted by the Index
The Treasury Board of Canada Secretariat must help departments execute this directive by collaborating with them to make sure automated decision systems are equitable, perform effectively, and operate openly.
Change history
No changes recorded since we began monitoring this policy.