Enhancing Digital Security and Trust Act, 2024
Canada · Law · Ontario Legislature
Our summary
This Ontario statute establishes requirements for public sector bodies including government institutions, municipalities, school boards and children's aid societies regarding cybersecurity, AI system governance, and digital information handling affecting minors. It empowers the Minister to set technical standards and issue directives while enabling regulations to prescribe how entities must manage cyber risks, disclose AI deployments, establish oversight mechanisms, and safeguard children's digital information.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
5 sections
Jump to a chapter
Definitions
Defines key terms used throughout the act, including artificial intelligence system as a machine-based system that generates outputs to influence environments, cyber security as the protection of digital information and infrastructure, and public sector entity as certain institutions under freedom of information acts, children's aid societies, and school boards. The act applies to use of AI systems by public sector entities whether publicly available, developed by the entity, or developed by third parties on their behalf.
Cyber Security
Allows regulations requiring prescribed public sector entities to develop and implement cyber security programs with specified elements, such as defined roles and responsibilities, reporting on progress, education measures, and incident response procedures. The Minister may set technical standards for cyber security and issue directives to public sector entities that must be complied with and take precedence over conflicting regulations.
Use of Artificial Intelligence Systems
Requires prescribed public sector entities using AI systems in specified circumstances to inform the public about their use, develop an accountability framework, manage associated risks, and comply with prescribed requirements. Entities must also ensure individual oversight and disclosure of information about AI system use in certain contexts, and may not use AI systems in ways prohibited by regulations.
Regulations on AI Systems and Transparency
Details regulatory powers to govern AI system disclosure, accountability frameworks, risk management, oversight requirements, and prohibited uses. Regulations may specify the content and timing of public information about AI systems, documentation requirements, roles of individuals responsible for oversight, and technical standards that public sector entities must meet when deploying AI systems.
Regulations, directives and general provisions
The Minister may establish technical standards for children's aid societies and school boards regarding how they handle data about minors and provide digital tools to them. The Minister may also issue directives to these organizations about digital technology available to minors, which can be tailored to different circumstances or categories. Children's aid societies and school boards must follow any directives issued to them.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 9 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Record keeping and logging, not covered
Technical safeguards 2 of 4
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 1 of 4
- Automated decision-making rights, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 10 are shown.
Cyber Security 2 controls
- ObligationApplies to: Public authorityDrafted by the Index
Regulations may require prescribed public sector entities to establish and execute cyber security programs that include defined roles, responsibility assignments, progress reporting, educational initiatives, and incident response procedures.
- Applies to: Public authorityDrafted by the Index
The Minister may establish technical standards for cyber security and issue directives to public sector entities that must be followed and prevail over any conflicting regulations.
Use of Artificial Intelligence Systems 3 controls
- ObligationApplies to: Public authorityDrafted by the Index
Prescribed public sector entities using AI systems in specified circumstances must notify the public of their use, create an accountability framework, address associated risks, and meet prescribed requirements.
- ObligationApplies to: Public authorityDrafted by the Index
Public sector entities must establish individual oversight and disclose information about AI system use in designated contexts.
- ProhibitionApplies to: Public authorityDrafted by the Index
Public sector entities must not deploy AI systems in ways that regulations prohibit.
Regulations on AI Systems and Transparency 2 controls
- Applies to: Public authorityDrafted by the Index
Regulations may specify what information about AI systems must be disclosed to the public and when such disclosure must occur.
- Applies to: Public authorityDrafted by the Index
Regulations may define documentation requirements, designate individuals responsible for oversight, and establish technical standards that public sector entities must observe when using AI systems.
Regulations, directives and general provisions 3 controls
- Applies to: Public authorityDrafted by the Index
The Minister may establish technical standards for children's aid societies and school boards regarding how they manage data about minors and provide digital tools to them.
- Applies to: Public authorityDrafted by the Index
The Minister may issue directives to children's aid societies and school boards about digital technology made available to minors, which can be tailored to different circumstances or categories.
- ObligationApplies to: DeployerDrafted by the Index
Children's aid societies and school boards must comply with any directives issued to them by the Minister.
Change history
No changes recorded since we began monitoring this policy.