Ontario Responsible Use of Artificial Intelligence Directive

What it is

The Responsible Use of Artificial Intelligence Directive is a Management Board of Cabinet directive issued under Ontario’s Management Board of Cabinet Act. It took effect on 1 December 2024 and sets requirements for the transparent, responsible and accountable use of AI by the Government of Ontario. The Ministry of Public and Business Service Delivery and Procurement is responsible for it.

The directive is built on six principles. AI use should benefit Ontarians, be justified, proportionate, reliable and valid, be safe, secure and privacy-protective, affirm human rights and avoid discrimination, be transparent, and be accountable, with ongoing human oversight and a way to raise concerns.

Who it applies to

It applies to all ministries and provincial agencies that use AI systems, or services with AI functionality, in developing, delivering or making decisions about a government policy, program or service. AI that is procured, developed in-house or publicly available is all in scope.

An AI system is a machine-based system that infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions. The AI lifecycle runs through planning and design, data collection and processing, model building and use, verification and validation, deployment, and operation and monitoring.

Exemptions are possible only in exceptional circumstances, with Management Board of Cabinet approval on a business case.

What it requires

AI risk management. Ministries apply AI risk management aligned with the Ontario Public Service risk management process, in five steps.

• state the objectives and context, documenting the problem AI is meant to solve and whether using AI is justified
• identify the risks
• assess them to set the risk level, which drives proportionate controls
• plan and act, applying risk-based controls
• report and monitor, keeping assessments current and re-applying controls as things change

Validation runs through existing IT and digital governance processes, and the risk work is meant to sit alongside, not duplicate, privacy impact assessments and threat risk assessments.

Reporting and publication. Ministries report their AI use cases and risks to the responsible ministry every year, and coordinate with it to publish a list of AI use cases.

Public disclosure. Where the public interacts directly with AI, or AI affects decisions about them, the ministry discloses the use and provides an accessible way to seek information about it. The directive says this does not create a new appeal route.

Provincial agencies. Agencies apply the same risk management, with risk-based approval processes, keep records of their risk assessments and controls, publish their own list of AI use cases, report to their accountable ministry, and meet the same disclosure requirements.

Deputy ministers and agency heads are accountable for implementation. The Chief Information Security Officer advises on AI security controls, and the directive is reviewed at least every two years.

Key dates

• 1 December 2024. Directive takes effect.
• 7 January 2026. Most recent update to the published directive.

How it relates to other frameworks

The directive is Ontario’s counterpart to the federal Directive on Automated Decision-Making. The federal directive is narrower in scope, covering administrative decisions, but more prescriptive, with a published Algorithmic Impact Assessment and impact levels. Ontario’s covers any AI use in policies, programs and services and leaves the risk method to the ministry.

Its five risk management steps follow the same shape as the Map, Measure and Manage functions of the NIST AI RMF. Private employers in Ontario have a separate, narrow duty to disclose AI screening in job postings.

A note on this page

This is Aicura’s reading of the Responsible Use of Artificial Intelligence Directive. It is not legal advice and it is not the directive itself. Read the directive published by the Government of Ontario, and take advice on how it applies to your organisation.