Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems
Canada · Guideline · Innovation, Science and Economic Development Canada
Our summary
This voluntary code of conduct establishes principles and measures for organizations developing or managing advanced generative AI systems with general-purpose capabilities. Signatories commit to accountability, safety, fairness, transparency, human oversight, and robustness through risk management frameworks, testing, assessment of impacts, and disclosure practices. The code applies to all such systems, with enhanced requirements for those made widely available to the public.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
5 sections
Jump to a chapter
Language selection
WxT Search form
This code applies to organizations developing or managing advanced generative AI systems with general-purpose capabilities, and imposes additional requirements on those making such systems widely available to the public. The code acknowledges that while these systems offer significant innovation benefits, their broad training data, diverse uses, and wide deployment create distinct risks including deception at scale, privacy harms, and potential damage to democratic and justice systems, particularly when misused. Signatories commit to achieving outcomes across seven areas: accountability through understanding their role and sharing information; safety through risk assessments and mitigations before deployment; fairness and equity assessment; publishing sufficient information for informed consumer decisions and expert evaluation; monitoring system use post-deployment and implementing updates; ensuring systems operate as intended and are secure; and supporting Canada's AI ecosystem through standards development, knowledge sharing, researcher collaboration, and prioritizing human rights, accessibility, and environmental sustainability.
Resources
Signatories to the code of conduct
Measures to be undertaken pursuant to the Code of Conduct
This table specifies actions required across six principles: developers and managers of all advanced generative systems must implement risk management and conduct safety assessments, while developers must also test for bias and robustness; developers and managers of systems available for public use face additional obligations including transparency measures, content detection methods, and incident monitoring.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.