Summary
- Applies to any automated decision system in production used to make an administrative decision, or a related assessment, about a client (s.5.1). Research, experimentation and test environments are excluded (s.5.2).
- Before a system goes live, the department must complete, approve and publish an Algorithmic Impact Assessment (AIA) on the Open Government Portal (s.6.1.1). The AIA gives an impact level from I (low) to IV (very high) (Appendix B).
- The impact level sets the duties (Appendix C): plain-language notice, explanations (detailed explanations for any refusal of a benefit or service from Level II up), peer review (from Level II), GBA Plus, staff training, and human involvement. At Levels III and IV a human must make the final decision.
- Other duties: test data and models for bias before production and monitor outcomes (s.6.3.1 to 6.3.3), validate data quality (s.6.3.5), secure the model against tampering (s.6.3.11), consult legal services from concept stage (s.6.3.12), tell clients how to challenge a decision (s.6.4.1), and publish effectiveness and fairness information (s.6.5).
- Vendor hook: if software is proprietary, the department must keep the right to access, test and monitor it, and to let outside parties audit it (s.6.2.6).
- Status: in force. Current version dated 2025-06-24; it replaced the 2021-03-24 and 2023-04-24 versions. Reviewed every two years (s.1.3).
Who it applies to
- Federal institutions subject to the Policy on Service and Digital (s.8.1). Others are encouraged to follow it (s.8.2). Agents of Parliament have a modified regime (s.8.3).
- TBS scope guide (canada.ca) adds: Canada Revenue Agency is excluded by its own legislation; National Security Systems are scoped out.
- Since the 2023 amendments, internal services such as hiring, performance management and security screening of employees are in scope.
- Not extraterritorial. Private companies are reached only as vendors through contracts.
Key dates
- Directive takes effect (s.1.1)
- Compliance required; applies to systems developed or procured after this date (s.1.1, s.1.2)
- Third-review amendments take effect (internal services in scope, AIA and peer review published before launch)
- Current version takes effect (TBS page dated 2025-06-24)
- Deadline for pre-existing systems and Agents of Parliament to meet new or updated requirements (s.1.2.1, s.1.2.2)
Full date record
| Date | Event |
|---|---|
| 2019-04-01 | Directive takes effect |
| 2020-04-01 | Compliance required for systems developed or procured after this date |
| 2023-04-25 | Third-review amendments take effect (existing systems had until 2024-04-25) |
| 2025-06-24 | Current version takes effect |
| 2026-06-24 | Pre-existing systems and Agents of Parliament must meet the new or updated requirements |
Penalties and enforcement
- No monetary penalties. It is an internal government policy instrument.
- TBS can raise compliance issues with the relevant deputy head (s.7.4). Agents of Parliament police themselves (s.8.3.2).
- Approval to operate: assistant deputy minister for Levels I and II, deputy head for Level III, Treasury Board for Level IV (Appendix C).
What it means for an Indian company
- Relevant mainly to Indian IT services and AI vendors bidding for Canadian federal contracts. Expect clauses granting the department access to your model, versions and code for audits (s.6.2.6).
- Be ready to supply what the department needs for its AIA and peer review: data sources, model logic, bias test results, security measures. Map this to SC-AI-006 AI impact assessment (people and society), SC-AI-014 Model documentation (model cards, system cards) and SC-AI-017 Fairness and discrimination testing of outputs.
- Build in human review and override features for Level III and IV use cases (SC-AI-026 Human oversight and override) and decision explanations that name the main factors (SC-AI-024 Explain AI-assisted decisions).
- Useful template even outside Canada: the AIA questionnaire is public and is a practical model for an Indian company's own impact assessment.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when Canada Directive on Automated Decision-Making is done.
Glossary
- TBS: Treasury Board of Canada Secretariat, the central agency that sets management policy for federal departments.
- Automated decision system: any technology that assists or replaces a human decision-maker, from rules engines to deep learning.
- AIA (Algorithmic Impact Assessment): the TBS questionnaire that scores a system's risk and sets its impact level.
- Administrative decision: a decision by an official under legal powers that affects someone's rights, privileges or interests.
- GBA Plus: Gender-based Analysis Plus, Canada's method for checking effects on diverse groups.
- Agents of Parliament: independent offices such as the Auditor General and Privacy Commissioner.
Key takeaways
- Binding on Canadian federal departments; no fines, but approvals and publication are mandatory.
- The AIA impact level (I to IV) drives every other duty, including mandatory human final decisions at III and IV.
- Vendors must accept audit and access rights over proprietary models.
Official sources
- Directive on Automated Decision-Making (TBS), accessed 2026-10-19
- Amendments to the Directive on Automated Decision-Making (canada.ca), accessed 2026-10-19
- Guide on the Scope of the Directive (canada.ca), accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.