This Directive takes effect on , with compliance required by no later than .
This Directive applies to any Automated Decision System developed or procured after .
This Directive will have an automatic review process planned every 6 months after the date it comes into effect.
This Directive is issued under the authority of section 7 of the Financial Administration Act, and under section 6.4.9 of the Policy on Management of Information Technology;
This Directive supports the Policy on Information Management, the Policy on Service, the Policy on Privacy Protection, and the Policy on Government Security.
Definitions to be used in the interpretation of this Directive are listed in Appendix A.
The objective of this Directive is to ensure that Automated Decision Systems are deployed in a manner that reduces risks to Canadians and federal institutions, and leads to more efficient, accurate, consistent, and interpretable decisions made pursuant to Canadian law.
The expected results of this Directive are as follows:
Decisions made by federal government departments are data-driven, responsible, and complies with procedural fairness and due process requirements.
Impacts of algorithms on administrative decisions are assessed and negative outcomes are reduced, when encountered.
Data and information on the use of Automated Decision Systems in federal institutions are made available to the public, where appropriate.
This Directive applies only to systems that provide external services as defined in the Policy on Service.
This Directive applies to any system, tool, or statistical models used to recommend or make an administrative decision about a client.
This Directive applies only to systems in production, and excludes Automated Decision Systems operating in test environments.
As per the Policy on the Management of Information Technology, this Directive does not apply to any National Security Systems.
The Assistant Deputy Minister responsible for the program using the Automated Decision System, or any other person named by the Deputy Head, is responsible for:
Completing an Algorithmic Impact Assessment prior to the production of any Automated Decision System.
Applying the relevant requirements prescribed in Appendix C as determined by the Algorithmic Impact Assessment.
Updating the Algorithmic Impact Assessment when system functionality or the scope of the Automated Decision System changes.
Releasing the final results of Algorithmic Impact Assessments in an accessible format via Government of Canada websites and any other services designated by the Treasury Board of Canada Secretariat pursuant to the Directive on Open Government.
Providing notice on relevant websites that the decision rendered will be undertaken in whole or in part by an Automated Decision System as prescribed in Appendix C.
Providing notices prominently and in plain language, pursuant to the Canada.ca Content Style Guide.
Providing a meaningful explanation to affected individuals of how and why the decision was made as prescribed in Appendix C.
Determining the appropriate license for software components as per the requirements specified in section in C.2.3.8 of the Directive on Management of Information Technology.
If using a proprietary license, ensuring that:
All released versions of proprietary software components used for Automated Decision Systems are delivered to, and safeguarded by, the department.
The Government of Canada retains the right to access and test the Automated Decision System, including all released versions of proprietary software components, in case it is necessary for a specific audit, investigation, inspection, examination, enforcement action, or judicial proceeding, subject to safeguards against unauthorized disclosure.
As part of this access, the Government of Canada retains the right to authorize external parties to review and audit these components as necessary.
Releasing custom source code owned by the Government of Canada as per the requirements specified in section C.2.3.8 of the Directive on Management of Information Technology, unless:
The source code is processing data classified SECRET, TOP SECRET or PROTECTED C;
Disclosure would otherwise be exempted or excluded under the Access to Information Act, or
An exemption is provided by the Chief Information Officer of Canada.
Determining the appropriate access restrictions to the released source code.
Before launching into production, developing processes so that the data and information used by the Automated Decision Systems are tested for unintended data biases and other factors that may unfairly impact the outcomes.
Developing processes to monitor the outcomes of Automated Decision Systems to safeguard against unintentional outcomes and to verify compliance with institutional and program legislation, as well as this Directive, on a scheduled basis.
Validating that the data collected for, and used by, the Automated Decision System is relevant, accurate, up-to-date, and in accordance with the Policy on Information Management and the Privacy Act.
Consulting the appropriate qualified expert to review the Automated Decision System, as prescribed in Appendix C.
Providing adequate employee training in the design, function, and implementation of the Automated Decision System to be able to review, explain and oversee its operations, as prescribed in Appendix C.
Establishing contingency systems and/or processes as per Appendix C.
Conducting risk assessments during the development cycle of the system and establish appropriate safeguards to be applied, as per the Policy on Government Security.
Consulting with the institution’s legal services, to ensure that the use of the Automated Decision System is compliant with applicable legal requirements.
Ensuring that an Automated Decision System allows for human intervention, when appropriate, as per Appendix C.
Obtaining the appropriate level of approvals prior to the production of an Automated Decision System as per Appendix C.
Providing clients with any applicable recourse options that are available to them to challenge the administrative decision.
Publishing information on the effectiveness and efficiency of the Automated Decision Systems in meeting program objectives on a website or service designated by the Treasury Board of Canada.
Consequences of non-compliance with this policy can include any measure allowed by the Financial Administration Act that the Treasury Board would determine as appropriate and acceptable in the circumstances.
For an outline of the consequences of non‑compliance, refer to the Framework for the Management of Compliance, Appendix C: Consequences for Institutions and Appendix D: Consequences for Individuals.
Subject to the necessary delegations, the Chief Information Officer of Canada is responsible for:
Providing government-wide guidance on the use of Automated Decision Systems.
Granting exceptions under any of these provisions, in consultation with the Enterprise Architecture Review Board prior to making a decision.
Developing and maintaining the Algorithmic Impact Assessment and any supporting documentation.
Communicating and engaging government-wide and with partners in other jurisdictions and sectors to develop common strategies, approaches, and processes to support the responsible use of Automated Decision Systems.
This Directive applies to all institutions referenced in the Policy on the Management of Information Technology, unless excluded by specific acts, regulations or Orders-in-Council;
Agents of Parliament are excluded from this Directive, including the:
Agencies, Crown Corporations, or Agents of Parliament may enter into Specific Agreements with the Treasury Board of Canada Secretariat to adopt the requirements of this Directive and apply them to their organization, as required.
For information on this policy instrument, please contact the Treasury Board of Canada Secretariat Public Enquiries.
| Level | Description |
|---|---|
| I | The decision will likely have little to no impact on:
Level I decisions will often lead to impacts that are reversible and brief. |
| II | The decision will likely have moderate impacts on:
Level II decisions will often lead to impacts that are likely reversible and short-term. |
| III | The decision will likely have high impacts on:
Level III decisions will often lead to impacts that can be difficult to reverse, and are ongoing. |
| IV | The decision will likely have very high impacts on:
Level IV decisions will often lead to impacts that are irreversible, and are perpetual. |
| Requirement | Level I | Level II | Level III | Level IV |
|---|---|---|---|---|
| Peer Review | None | At least one of: Qualified expert from a federal, provincial, territorial or municipal government institution Qualified members of faculty of a post-secondary institution Qualified researchers from a relevant non- governmental organization Contracted third-party vendor with a related specialization Publishing specifications of the Automated Decision System in a peer-reviewed journal A data and automation advisory board specified by Treasury Board Secretariat | At least two of: Qualified experts from the National Research Council of Canada, Statistics Canada, or the Communications Security Establishment Qualified members of faculty of a post-secondary institution Qualified researchers from a relevant non- governmental organization Contracted third-party vendor with a related specialization A data and automation advisory board specified by Treasury Board Secretariat OR: Publishing specifications of the Automated Decision System in a peer-reviewed journal | |
| Notice | None | Plain language notice posted on the program or service website. | Publish documentation on relevant websites about the automated decision system, in plain language, describing:
| |
| Human-in-the-loop for decisions | Decisions may be rendered without direct human involvement. | Decisions cannot be made without having specific human intervention points during the decision-making process; and the final decision must be made by a human | ||
| Explanation Requirement | In addition to any applicable legislative requirement, ensuring that a meaningful explanation is provided for common decision results. This can include providing the explanation via a Frequently Asked Questions section on a website. | In addition to any applicable legislative requirement, ensuring that a meaningful explanation is provided upon request for any decision that resulted in the denial of a benefit, a service, or other regulatory action. | In addition to any applicable legislative requirement, ensuring that a meaningful explanation is provided with any decision that resulted in the denial of a benefit, a service, or other regulatory action. | |
| Testing | Before going into production, develop the appropriate processes to ensure that training data is tested for unintended data biases and other factors that may unfairly impact the outcomes. Ensure that data being used by the Automated Decision System is routinely tested to ensure that it is still relevant, accurate, and up-to-date. | |||
| Monitoring | Monitor the outcomes of Automated Decision Systems on an ongoing basis to safeguard against unintentional outcomes and to ensure compliance with institutional and program legislation, as well as this Directive | |||
| Training | None | Documentation on the design and functionality of the system | Documentation on the design and functionality of the system. Training courses must be completed. | Documentation on the design and functionality of the system. Re-occurring training courses. A means to verify that training has been completed. |
| Contingency Planning | None | Ensure that contingency plans and/or backup systems are available should the Automated Decision System be unavailable. | ||
| Approval for the system to operate | None | None | Deputy Head | Treasury Board |