Directive on Automated Decision-Making and the Algorithmic Impact Assessment

What it is

The Directive on Automated Decision-Making is a Treasury Board of Canada policy instrument under the Policy on Service and Digital. It took effect on 1 April 2019 and is mandatory for the federal institutions it covers. Its companion tool, the Algorithmic Impact Assessment (AIA), is a public questionnaire that determines a system’s impact level and therefore which requirements apply.

The directive is reviewed regularly. The third review, in effect from 25 April 2023, extended it to internal services such as hiring and performance management, required the AIA and peer review results to be published before a system goes live, strengthened bias testing, data governance and explanation, and moved the review cycle to every two years. The fourth review, in effect from 24 June 2025, aimed to increase transparency about systems and their impacts, strengthen senior-level accountability, enhance testing and monitoring, and make the directive more consistent with the rest of the policy suite. Systems developed or procured before 24 June 2025 had until 24 June 2026 to meet the new or updated requirements.

Who it applies to

The directive applies to federal departments as defined in the Financial Administration Act. Some bodies are excluded by their enabling legislation, and national security systems are outside it, although departments are encouraged to meet as many requirements as they can.

It covers any automated decision system used to make or support an administrative decision, meaning a decision that could affect a person’s legal rights, privileges or interests. Examples include benefit and permit assessments, admissibility decisions, public service appointments and investigations. A system is in scope whether it decides fully or partially, and whether it uses AI or rules, if it replaces or assists human judgement. Systems that only perform calculations or apply straightforward legislated criteria, research and testing that does not affect real clients, and non-decision uses such as drafting support are out of scope. It applies to systems developed or procured after 1 April 2020, and to older systems when they are significantly modified.

What it requires

Algorithmic Impact Assessment. The institution completes the AIA at the start of design and again before the system goes into production, reviews it on a schedule and whenever functionality or scope changes, and publishes the final results on the Open Government Portal in both official languages. The AIA has 65 risk questions and 41 mitigation questions and yields one of four impact levels.

• Level I. Little to no impact (score 0 to 25 percent)
• Level II. Moderate impact (26 to 50 percent)
• Level III. High impact (51 to 75 percent)
• Level IV. Very high impact (76 to 100 percent)

Transparency. Notice to clients that an automated system is involved in the decision, a meaningful explanation of how and why the decision was made, and publication of information about the system.

Quality assurance. Testing for unintended bias and data quality before production, ongoing monitoring of outcomes, Gender-based Analysis Plus, peer review by qualified experts with the findings published in full or in summary, legal consultation, and security and data governance measures.

Human involvement, training and contingency. Appropriate human involvement in the decision, training for staff who use or oversee the system, and contingency plans if the system becomes unavailable.

Recourse and reporting. Recourse options for people who want to challenge a decision, and reporting on the system’s effectiveness and efficiency.

Appendix C of the directive scales these requirements by impact level, so that peer review, notice, explanation, human involvement, training, contingency planning and approval for the system to operate all become more demanding at Levels III and IV.

Key dates

• 1 April 2019. Directive takes effect.
• 1 April 2020. Applies to systems developed or procured from this date.
• 25 April 2023. Third-review amendments take effect.
• 24 June 2025. Fourth-review amendments take effect.
• 24 June 2026. Deadline for existing systems to meet the 2025 requirements.

How it relates to other frameworks

The directive is one of the longest-running public-sector automated decision policies in force. The US OMB M-25-21 uses a single high-impact category instead of four levels, but its minimum practices cover similar ground, as does Australia’s public sector AI policy. The AIA is a ready-made impact assessment that organisations outside government also borrow, alongside ISO/IEC 42005 and the Council of Europe’s HUDERIA.

Canada has no federal AI law for the private sector. The Artificial Intelligence and Data Act (AIDA), part of Bill C-27, died when Parliament was prorogued in January 2025. Private organisations face provincial rules instead, such as Quebec’s notice and review duty for automated decisions and Ontario’s AI disclosure in job postings, and sector guidance such as OSFI Guideline E-23 for federally regulated financial institutions. Federal institutions using generative AI also follow the Treasury Board’s Guide on the use of generative AI.