At a glance. Canada’s Directive on Automated Decision-Making is the main federal rule for systems that make or support administrative decisions. Its Algorithmic Impact Assessment places each system at one of four impact levels, and the obligations grow with the level. Leaders get the most from it when they treat the assessment as a delivery plan, not a form completed at go-live.
What the Directive is
The Treasury Board of Canada Secretariat (TBS) issued the Directive on Automated Decision-Making under the Policy on Service and Digital. It took effect on April 1, 2019, with compliance required by April 1, 2020 [1]. Its aim is to reduce risks to clients, federal institutions and Canadian society, and to make decisions more efficient, accurate, consistent and interpretable [1].
The Directive is a policy instrument, not a statute. Bill C-27, which would have enacted the proposed Artificial Intelligence and Data Act, was still in committee when the parliamentary session ended on January 6, 2025, and did not become law [2]. For federal institutions, the Directive remains the operative rule set for automated decisions.
It is reviewed every two years [1]. Amendments from the third review took effect on April 25, 2023. They extended the Directive to internal services such as hiring, and required the impact assessment and peer review findings to be published before launch [3]. A fourth review consulted on proposals from November 19, 2024 to January 8, 2025, including defined unacceptable uses of artificial intelligence (AI) and alignment with the definition of AI used by the Organisation for Economic Co-operation and Development (OECD) [4]. Until amended text takes effect, the 2023 version applies.
What triggers the Directive
Four questions decide scope. If all four answers are yes, the Directive applies.
- Is there an administrative decision? The Directive defines this as a decision made by an authorized official under powers conferred by an Act of Parliament, or by an order made under a prerogative of the Crown, that affects legal rights, privileges or interests [1].
- Does the system make the decision or a related assessment? Final decisions are not the only trigger. TBS lists systems that present information, flag unusual conditions, match data, generate scores or classifications, recommend options, or make partial decisions [4].
- Is the system in production? Systems operating only in test environments are excluded [1].
- Is the institution covered? The Directive applies to institutions subject to the Policy on Service and Digital. Agents of Parliament, such as the Office of the Auditor General of Canada, are excluded [1].
The test is about function, not technique. An automated decision system is any technology that assists or replaces the judgment of human decision-makers, from rules-based systems and regression to machine learning and neural networks [1]. A simple scoring rule that triages applications can fall in scope.
How the impact level is set
The Algorithmic Impact Assessment (AIA) is a TBS questionnaire with 51 risk questions and 34 mitigation questions. Risk questions cover the system, algorithm, decision, data and impacts; mitigation questions cover consultations, data quality, procedural fairness and privacy [4].
The result is one of four impact levels, defined in Appendix B of the Directive [1]:
| Level | Expected impact | Typical duration |
|---|---|---|
| I | Little to none | Reversible and brief |
| II | Moderate | Likely reversible, short-term |
| III | High | Difficult to reverse, ongoing |
| IV | Very high | Irreversible, perpetual |
The impacts assessed are on rights; equality, dignity, privacy and autonomy; health and well-being; economic interests; and the sustainability of an ecosystem [1]. AIA results must be released before production and updated when the system’s functionality or scope changes [1].
What each level requires
Obligations accumulate as the level rises. The two tables below summarize Appendix C of the Directive [1].
| Level | Human involvement | Peer review | Approval to operate |
|---|---|---|---|
| I | System may decide without direct human involvement | None | None |
| II | System may decide without direct human involvement | At least one qualified expert | None |
| III | Defined intervention points; a human makes the final decision | At least one qualified expert | Deputy head |
| IV | Defined intervention points; a human makes the final decision | At least two qualified experts | Treasury Board |
| Level | Notice to clients | Staff training | Continuity planning |
|---|---|---|---|
| I | None | None | None |
| II | Plain-language notice on all service channels | Documentation of design and function | None |
| III | Notice plus published documentation on the system | Documentation and completed courses | Required |
| IV | Notice plus published documentation on the system | Recurring courses, with verification | Required |
Two further obligations scale with the level. A Gender-based Analysis Plus (GBA Plus) is required from Level II upward [1]. Explanation requirements also rise. At Level I, a plain-language explanation of common decision results must be made available. At Levels III and IV, clients must receive a meaningful explanation with any decision that denies a benefit or service or involves a regulatory action [1].
Some obligations apply at every level. Before production, departments must test data and models for unintended biases. In operation, they must monitor outcomes on a scheduled basis, validate data quality, give clients recourse options to challenge the decision, and publish information on the system’s effectiveness and efficiency in meeting program objectives [1]. Legal services must be consulted from the concept stage [1].
How other jurisdictions compare
Ontario’s Responsible Use of Artificial Intelligence Directive has applied to ministries and provincial agencies since December 1, 2024 [5]. Bill 194, which received Royal Assent in November 2024, also lets the province set AI rules for prescribed public sector entities by regulation, including public disclosure and an accountability framework [6].
In the United States, Office of Management and Budget (OMB) Memorandum M-25-21, issued on April 3, 2025, gives agencies 365 days to apply minimum practices to high-impact AI: AI whose output is a principal basis for decisions with a legal, material, binding or significant effect on rights or safety. The practices include pre-deployment testing, an impact assessment, ongoing monitoring and appeals [7].
The United Kingdom’s Algorithmic Transparency Recording Standard (ATRS) requires central government departments and some arm’s-length bodies to publish records for tools that significantly influence decisions with public effect or interact directly with the public [8]. The European Union (EU) Artificial Intelligence Act (AI Act) entered into force on August 1, 2024. Most high-risk obligations apply from August 2, 2026, and public bodies must complete a fundamental rights impact assessment before deploying certain high-risk systems [9].
| Jurisdiction | Instrument | Who it covers | Core mechanism |
|---|---|---|---|
| Canada (federal) | Directive on Automated Decision-Making (2019) | Institutions under the Policy on Service and Digital | AIA sets one of four levels |
| Ontario | Responsible Use of AI Directive (2024) | Ministries and provincial agencies | Risk management and disclosure |
| United States | OMB Memorandum M-25-21 (2025) | Federal agencies | Minimum practices for high-impact AI |
| United Kingdom | ATRS mandatory scope policy (2024) | Departments and some arm’s-length bodies | Public records of algorithmic tools |
| European Union | AI Act (2024) | Providers and deployers | Rights impact assessment by public bodies |
The common thread is proportionality. The difference is the trigger: Canada starts from the administrative decision, the United States from effects on rights or safety, the United Kingdom from public transparency and the EU from a list of high-risk uses. Each reflects the transparency and accountability principles of the OECD AI Principles, which Canada, the United States and the United Kingdom have adopted [10].
What this means for delivery teams
My own work is delivering digital transformation programs in manufacturing, including industrial Internet of Things (IIoT) and manufacturing execution system (MES) programs. The setting differs, but one lesson carries over: a governance requirement found late becomes schedule risk, while one found early becomes an ordinary task with an owner and a date.
- Run the AIA at design, then again before production. A Level III result found in the final month leaves no room for peer review or deputy head approval.
- Put level-driven work in the plan. Peer review, GBA Plus, training and approvals each need an owner, a lead time and a budget.
- Design human intervention points as process steps. Name the role, the trigger and the evidence the person sees.
- Build monitoring and recourse before launch. Outcome reporting and challenge routes are part of the service, not add-ons.
- Treat scope change as a trigger. A new data source, client group or decision type means updating the AIA [1].
The bottom line
The Directive asks a practical question: how much could this decision affect a person, and which controls match that risk? Answered early, it works as a delivery framework. Answered at go-live, it works as a delay.
References
- Treasury Board of Canada Secretariat, “Directive on Automated Decision-Making,” Government of Canada, 2019, amended Apr. 2023.
- Parliament of Canada, “Bill C-27, Digital Charter Implementation Act, 2022,” LEGISinfo, 44th Parliament, 1st Session, introduced Jun. 16, 2022.
- Treasury Board of Canada Secretariat, “Amendments to the Directive on Automated Decision-Making,” Government of Canada, Apr. 2023.
- Treasury Board of Canada Secretariat, “4th review of the Directive on Automated Decision-Making: Overview and proposed modifications,” Fall 2024.
- Government of Ontario, “Responsible Use of Artificial Intelligence Directive,” Management Board of Cabinet, effective Dec. 1, 2024.
- Legislative Assembly of Ontario, “Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024,” S.O. 2024, c. 24.
- Office of Management and Budget, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” Memorandum M-25-21, Executive Office of the President, Washington, DC, USA, Apr. 3, 2025.
- Government Digital Service, “Algorithmic Transparency Recording Standard (ATRS) Mandatory Scope and Exemptions Policy,” GOV.UK, Dec. 17, 2024.
- European Parliament and Council of the European Union, “Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act),” Official Journal of the European Union, Jul. 12, 2024.
- OECD, “OECD AI Principles” (Recommendation of the Council on Artificial Intelligence, OECD/LEGAL/0449), adopted May 2019, updated May 2024.