Guide on the use of generative artificial intelligence
Canada · Guideline · Treasury Board of Canada Secretariat
Our summary
This guidance document helps Canadian federal institutions assess risks and plan responsible deployment of generative AI tools. It applies to all federal institutions and covers potential uses, ethical considerations, and policy best practices. The guidance emphasizes the FASTER principles, which require that generative AI use be fair, accountable, secure, transparent, educated, and relevant to organizational needs.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
24 sections
Jump to a chapter
Language selection
Overview
This guide directs federal institutions to explore potential applications of generative AI tools but evaluate risks before deployment and only use them where risks can be managed effectively. The guide covers an overview of generative AI, its challenges, principles for responsible use, and best practices, while emphasizing the importance of consulting stakeholders including legal counsel, privacy and security experts, and affected clients before public deployment.
What is generative AI?
Generative AI is a type of artificial intelligence that creates new content such as written documents, images, or computer code based on user instructions called prompts. These systems work by learning patterns from training data and generating statistically probable outputs, which can be refined through human feedback. Common applications include drafting and revising written materials, creating visual content, debugging code, summarizing data, and supporting customer service tasks.
Challenges and opportunities
Federal institutions must assess and mitigate risks before using generative AI, including inaccurate content generation, amplified biases, breaches of intellectual property and privacy laws, and potential non-compliance with privacy and security requirements. These tools have limited transparency, may rely on outdated or biased training data, and perform inconsistently across languages and for emotionally nuanced tasks. They could pose security and integrity risks to federal institutions through misuse by threat actors; however, they also offer potential benefits such as improved productivity in analytical and writing tasks, requiring further experimentation and analysis.
Recommended approach
1 section
Federal institutions should explore generative AI use cases while assessing and managing associated risks, using low-risk applications before attempting higher-risk uses like public-facing chatbots or summarizing client information. Public servants should refer to government ethical decision-making guidance when determining whether to deploy these tools.
Responsibilities for federal institutions
Federal institutions must provide training on responsible use, ensure access to secure tools meeting government requirements, implement oversight processes to verify compliance with laws and policies, and engage with employees and stakeholders before high-risk deployments. Institutions should evaluate generative AI as a tool to support rather than replace employees and develop organization-specific guidance aligned with this guide and the FASTER principles.
Policy considerations and best practices
4 sections
This section outlines major areas for institutional consideration when deploying generative AI, including the applicability of the Directive on Automated Decision-Making, privacy concerns, documentation requirements, and best practices addressing bias, quality assurance, employee autonomy, legal risks, distinguishability from humans, and environmental impacts.
Does the Directive on Automated Decision-Making apply?
Privacy considerations
Documentation requirements
Federal employees must document decisions and activities related to developing or deploying generative AI tools and steps taken to ensure appropriate outputs. Business value determines documentation scope, with routine uses like drafting emails typically generating transitory records, while decisions using generative AI for administrative purposes require additional documentation per automated decision-making rules. All documentation is subject to access and archives legislation.
Potential issues and best practices
This section outlines risk areas and best practices for responsible generative AI use in federal institutions, covering protection of information, bias, quality, public servant autonomy, legal risks, distinguishing humans from machines, and environmental impacts. It addresses both users of generative AI and institutions that develop or deploy these tools, recognizing that institutions should tailor their approach to each use case.
a. Protection of information
b. Bias
c. Quality
d. Public servant autonomy
e. Legal risks
f. Distinguishing humans from machines
g. Environmental impacts
Use of this guide
This guide is intended as a resource for federal institutions to consult when developing their own generative AI policies and procedures, and both the guide and supporting community are expected to evolve over time.
Additional support
3 sections
The guide provides access to information on specific generative AI applications, training opportunities, and additional resources to support federal institutions in their implementation and use.
Information and guidance on specific uses of generative AI
Federal institutions can access guidance from the Treasury Board Secretariat's Responsible Data and AI team, cyber security guidance from the Canadian Centre for Cyber Security, and summary guidance on daily work applications of generative AI.
Courses and events
The Canada School of Public Service offers courses and events on AI topics, including training specific to using generative AI within the Canadian government.
Additional resources
Federal institutions can contact the Communications Security Establishment and Statistics Canada for additional support with generative AI implementation.
Frequently asked questions
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 16 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Prohibited practices, not covered
Data and privacy 3 of 4
- Data subject rights and consent, not covered
Transparency and records 3 of 4
- Technical documentation, not covered
Technical safeguards 4 of 4
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 1 of 4
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 3 of 6
- General purpose and foundation models, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 40 are shown.
Overview 2 controls
- ObligationApplies to: Public authorityDrafted by the Index
Federal institutions should evaluate the risks of generative AI tools before deploying them.
- ObligationApplies to: Public authorityDrafted by the Index
Federal institutions should use generative AI tools only where they can effectively manage the associated risks.
Challenges and opportunities 2 controls
- ObligationApplies to: Public authorityDrafted by the Index
Federal institutions must assess and mitigate ethical, legal and other risks before starting to use generative AI tools, including risks of inaccurate content, amplified biases, and violations of intellectual property, privacy and other laws.
- ObligationApplies to: Public authorityDrafted by the Index
Federal institutions must protect personal information and sensitive data when using generative AI tools.
Documentation requirements 4 controls
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should document decisions, activities and measures taken to establish that generative AI tools produce appropriate outputs.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should determine the scope of documentation based on whether the use involves business value, with routine tasks such as drafting emails producing transitory records.
- ObligationApplies to: DeployerDrafted by the Index
The chief information officer should oversee strategic management and documentation of information and data life cycle practices in collaboration with institutional officials.
- ObligationApplies to: DeployerDrafted by the Index
All documentation on generative AI systems developed or deployed by government institutions must be kept and disposed of in accordance with access to information and archives legislation.
a. Protection of information 8 controls
- ProhibitionApplies to: DeployerDrafted by the Index
Federal employees should not enter sensitive or personal information into generative AI tools not operated by the government.
- ProhibitionApplies to: DeployerDrafted by the Index
Federal employees should not submit queries to non-government-managed tools when the content could harm public trust if disclosed.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should understand how a generative AI system handles input data, including whether it uses data for model training and whether suppliers can access it.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should ask legal services and security and privacy officials to review a supplier's legal documents before using the system for sensitive or proprietary information.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should use infrastructure and tools that match the security classification of the information, in line with security management rules.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should seek approval from the chief security officer before using, purchasing or deploying generative AI for protected or sensitive information.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should consider information and data residency requirements when selecting generative AI systems.
- Applies to: DeployerDrafted by the Index
Federal employees should use opt-out features where available to prevent input prompts from being used to train or develop AI models.
b. Bias 7 controls
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should learn about bias, diversity, inclusion and anti-racism to improve their ability to detect biased or discriminatory generated content.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should review generated content to ensure it aligns with government principles and legal duties, including assessment for biases and stereotypes.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should design prompts to generate content offering diverse viewpoints and reducing bias.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should seek to understand the source, content and preparation of data used to train generative AI tools.
- ObligationApplies to: DeployerDrafted by the Index
Federal institutions deploying a generative AI tool should assess potential biases and mitigation approaches from the planning stage, including gender-based analysis.
- ProhibitionApplies to: DeployerDrafted by the Index
Federal institutions should not deploy a generative AI tool if they cannot manage the risk of biased outputs.
- ObligationApplies to: DeployerDrafted by the Index
Federal institutions should consult experts and affected populations during planning, design, evaluation and auditing of generative AI tool deployments to identify bias risks.
c. Quality 7 controls
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should clearly indicate that generative AI was used to develop content.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should not treat generated content as authoritative; they should verify it for accuracy by checking against trusted sources or having an expert review it.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should verify that personal information created using generative AI is accurate, current and complete.
- ProhibitionApplies to: DeployerDrafted by the Index
Federal employees should assess the risk of inaccurate outputs and refrain from using generative AI when precision or data integrity is essential.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should seek to understand the quality and provenance of training data used in generative AI tools.
- ObligationApplies to: DeployerDrafted by the Index
Federal employees should assess their ability to identify inaccurate content before using generative AI; if unable to confirm content quality, they should not use it.
- ProhibitionApplies to: DeployerDrafted by the Index
Federal employees should not use generative AI as a search tool unless sources are provided to verify results.
d. Public servant autonomy 8 controls
- Applies to: DeployerDrafted by the Index
Users should evaluate whether tasks genuinely require generative AI to meet their needs.
- Applies to: DeployerDrafted by the Index
Users should understand the capabilities and limitations of generative AI before delegating work and assessing its results.
- Applies to: DeployerDrafted by the Index
Users should develop their knowledge of AI so they can make informed judgments about these systems and their outputs.
- Applies to: DeployerDrafted by the Index
Users should employ generative AI as decision-support tools, not replacements for human expertise.
- ProhibitionApplies to: DeployerDrafted by the Index
Users should not delegate work that they do not comprehend or have not developed competence in.
- Applies to: DeployerDrafted by the Index
Users should form independent judgments before consulting AI systems for advice or suggestions.
- Applies to: DeployerDrafted by the Index
Users should use generic language in prompts to reduce biased system responses.
- Applies to: DeployerDrafted by the Index
Users should examine all AI-generated content before relying on it, regardless of the system's track record.
e. Legal risks 2 controls
- Applies to: DeployerDrafted by the Index
Users should seek guidance from their organization's legal advisors regarding the risks of implementing generative AI tools or integrating them into service delivery.
- ObligationApplies to: DeployerDrafted by the Index
Users must follow the Directive on Automated Decision-Making when deploying generative AI.
Change history
No changes recorded since we began monitoring this policy.