Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems

What it is

The Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems was launched by Innovation, Science and Economic Development Canada (ISED) in September 2023. It was designed as an interim set of commitments for organisations working with generative AI while the Artificial Intelligence and Data Act (AIDA) was before Parliament. AIDA lapsed with Bill C-27 when Parliament was prorogued in January 2025, so the code is now the main federal statement of expectations for private sector generative AI in Canada.

It is short. It sets six principles, each with specific measures, and assigns each measure to developers, managers or both, with extra measures for systems made available to the public.

Who it applies to

The code is for organisations that develop or manage advanced generative AI systems with general-purpose capabilities. A developer builds the system. A manager puts it into operation, controls how it is used and monitors it. Some measures apply only where a system is made widely available for public use.

It binds only those who sign. ISED’s page lists 46 signatories, among them AI developers such as Cohere, research institutes such as Mila and the Vector Institute, technology companies such as IBM and TELUS, and financial institutions such as CIBC.

What it asks for

Accountability. Implement a comprehensive risk management framework proportionate to the nature and risk profile of the activities, and share information and best practices on risk management with firms playing complementary roles. Developers of public systems use multiple lines of defence, including third-party audits before release.

Safety. Perform a comprehensive assessment of reasonably foreseeable potential adverse impacts, including risks from inappropriate or malicious use. Developers implement proportionate mitigations, including safeguards against malicious use, and give downstream developers and managers guidance on appropriate use.

Fairness and equity. Developers assess and curate training datasets to manage data quality and potential biases, and implement diverse testing methods to assess and mitigate the risk of biased output before release.

Transparency. Developers of public systems publish information on capabilities and limitations, describe the types of training data, and provide a reliable and freely available method to detect content generated by the system, such as watermarking. Managers make sure systems that could be mistaken for humans are clearly and prominently identified as AI.

Human oversight and monitoring. Managers monitor the operation of the system for harmful uses or impacts after it is available, including through third-party feedback, and apply usage controls as needed. Developers maintain a database of reported incidents after deployment and provide updates as needed to ensure effective mitigation.

Validity and robustness. Developers use a wide variety of testing methods across a spectrum of tasks and contexts before deployment, including adversarial testing such as red-teaming, and benchmark against recognised standards. Developers and managers assess cybersecurity risk and implement proportionate measures.

ISED also publishes an FAQ and an implementation guide for managers of AI systems.

Using it without signing

Most organisations that use the code never sign it. They use it as a checklist when they adopt a generative AI product, and as a set of questions for the vendor. The developer measures translate directly into due diligence. Has the vendor assessed foreseeable misuse, tested for biased output, red-teamed the model and published its capabilities and limitations? Does it keep a record of incidents after deployment and issue updates? A vendor that has signed the code has committed to those things publicly, which makes the questions easier to ask and the answers easier to check.

Key dates

• September 2023. Code launched and opened for signature.
• January 2025. AIDA lapses with Bill C-27, leaving the code in place as a voluntary instrument.

How it relates to other frameworks

The code draws on the same ideas as the G7 Hiroshima Code of Conduct, which Canada helped develop, and the OECD AI Principles. Its measures are close to the actions in the NIST AI RMF Generative AI Profile, and an organisation already working to that profile or to ISO/IEC 42001 will meet most of them.

For many Canadian organisations the useful part is the manager measures. They describe, in a page, what a deployer of a generative AI product should do. Identify the system as AI where it could be mistaken for a person, monitor for harmful uses, take user feedback and apply usage controls. Regulated institutions should read it alongside sector rules such as OSFI Guideline E-23, and federal institutions follow the Treasury Board’s Directive on Automated Decision-Making and its generative AI guide.