Governance, risk & compliance

Ontario public sector AI rules (EDSTA and the OPS AI Directive) EDSTA Sch. 1 ss. 1 to 16 in force 29 Jan 2025; Directive 1 Dec 2024

Two instruments.

(1) The Enhancing Digital Security and Trust Act, 2024 (EDSTA), Schedule 1 of the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (Bill 194, S. O.

2024, c. 24, Royal Assent 25 November 2024).

Order in Council 361/2025, approved 28 January 2025, brought Schedule 1 sections 1 to 16 into force on 29 January 2025. Sections 5 to 8 are the AI provisions.

A prescribed public sector entity that uses or intends to use an AI system in prescribed circumstances must give the public information about the use, develop and implement an accountability framework, take prescribed risk management steps, follow prescribed use requirements and avoid uses the regulations prohibit (s. 5).

In prescribed circumstances it must disclose information and have an individual oversee the system (s. 6).

Section 7 lets cabinet make regulations and section 8 lets the Minister set technical standards. These duties apply only to the entities and circumstances a regulation names.

Two regulations were reported in force on 1 July 2026 (O. Reg.

51/26 Cyber Security and O. Reg.

52/26 Digital Technology Affecting Individuals Under Age 18) and neither deals with AI (a law firm summary; e-Laws could not be read). No regulation prescribing entities for the AI sections was found, so no named body is yet bound by sections 5 and 6: plan for them, do not claim compliance with them.

(2) The Responsible Use of Artificial Intelligence Directive, issued under the Management Board of Cabinet Act, effective 1 December 2024 (page last updated 7 January 2026). It binds Ontario ministries and provincial agencies: apply AI risk management, report each year on AI use cases and risks, publish a list of use cases, and disclose AI use where the public deals with it directly or its outputs affect their decisions.

Municipal bodies are under ON_MFIPPA, and this framework does not repeat the Bill 194 privacy amendments. The Schedule 2 amendments to the Freedom of Information and Protection of Privacy Act came into force on 29 January 2025 and 1 July 2025 (Order in Council 361/2025); their text was not read here.

Private employers in Ontario should see the Ontario tier of CA_PROV_AI for the job posting rule. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Ontario public sector AI rules (EDSTA and the OPS AI Directive) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Ontario public sector AI rules (EDSTA and the OPS AI Directive) compliance

Most of Ontario public sector AI rules (EDSTA and the OPS AI Directive) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Ontario public sector AI rules (EDSTA and the OPS AI Directive), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Ontario public sector AI rules (EDSTA and the OPS AI Directive) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Ontario public sector AI rules (EDSTA and the OPS AI Directive) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.