Governance, risk & compliance

Canada: Treasury Board Directive on Automated Decision-Making and AI guidance Directive amended 24 Jun 2025; Guide modified 24 Sep 2026

In force for federal institutions, not for private companies.

The Treasury Board Directive on Automated Decision-Making binds federal institutions that use automated systems to make or support administrative decisions about clients (members of the public, businesses and, in some cases, employees). A private company is bound only if a contract or funding condition says so, but the Directive is the clearest written Canadian standard for automated decisions and a strong baseline for anyone who builds or buys such a system.

What was verified for this pack (24 October 2026): the Directive took effect in April 2019 and applied to systems developed or procured after April 2020; the third review amendment was 25 April 2023 (it added measures on explanation, bias testing, data governance, gender-based analysis plus and peer review); the fourth review amendment was 24 June 2025 (aimed at transparency, senior-level accountability, testing and monitoring). The Treasury Board policy site rejected our automated requests, so the amended text, the subsection numbers inside section 6 and the Appendix C requirements for each impact level were NOT read.

The Algorithmic Impact Assessment (AIA) tool (page modified 15 September 2026) has 106 questions (65 risk, 41 mitigation) and four impact levels: I (0 to 25 per cent), II (26 to 50), III (51 to 75) and IV (76 to 100). A federal institution completes the AIA at the start of design and again before production, consults legal services from the concept stage, works with its ATIP office, meets the baseline requirements (testing, monitoring outcomes, recourse) and publishes the final AIA in both official languages on the Open Government Portal.

Peer review is tied to subsection 6. 3.

5 in the TBS Guide to Peer Review of Automated Decision Systems (7 January 2025); whether the numbering survived the 2025 amendment was not confirmed. Tier DIRECTIVE covers the Directive.

Tier GENAI_GUIDE covers the Guide on the use of generative artificial intelligence (issued 30 May 2024, modified 24 September 2026): guidance for federal institutions built on the FASTER principles (Fair, Accountable, Secure, Transparent, Educated, Relevant), not a binding rule. There is no federal AI statute: the Artificial Intelligence and Data Act died with Bill C-27 on 6 January 2025, and law firm summaries of the AI for All strategy (4 June 2026) say it does not revive a comprehensive AI act.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Canada: Treasury Board Directive on Automated Decision-Making and AI guidance at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Canada: Treasury Board Directive on Automated Decision-Making and AI guidance compliance

Most of Canada: Treasury Board Directive on Automated Decision-Making and AI guidance comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Canada: Treasury Board Directive on Automated Decision-Making and AI guidance, and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Canada: Treasury Board Directive on Automated Decision-Making and AI guidance in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Canada: Treasury Board Directive on Automated Decision-Making and AI guidance as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.