Automated Decision Making in Canada: The Rules That Matter

If you run a clinic in Burnaby or a contracting business in New Westminster and you've put an AI agent in front of your customers, you've probably wondered who checks your work. Nobody is mailing you a compliance checklist. There's no dedicated federal AI statute in force for private business in Canada right now.

There is, however, a document that spells out what the Canadian government thinks a responsible automated decision looks like. It's the Treasury Board of Canada Secretariat's Directive on Automated Decision-Making, in effect since April 1, 2019 and last amended June 24, 2025. It binds federal departments, not you. Read it anyway. It's the clearest published answer in the country to the question of what good looks like.

What the Directive covers

The Directive applies to "any automated decision system in production used to make an administrative decision or a related assessment about a client" (section 5.1). Systems used only for research, experimentation or test environments are excluded (section 5.2). Its definition of an automated decision system is deliberately broad: "Any technology that either assists or replaces the judgment of human decision makers," including rules-based systems and regression, not just neural networks. A scoring spreadsheet counts.

Before a system goes live, the department completes and publishes an Algorithmic Impact Assessment that scores it Level I through Level IV. Level I covers decisions with "little to no, easily reversible, and brief impacts." Level IV covers decisions with "very high, irreversible and perpetual impacts." The requirements scale with the score.

Departments running systems built before June 24, 2025 have until June 24, 2026 to meet the updated requirements (section 1.2.1). This is live work inside government right now, not a filing-cabinet exercise.

The five obligations worth copying

Strip out the parts that only make sense for a federal department and what's left is a workable operating manual for any business automating customer-facing decisions:

• Notice before the decision. Plain language notice "through all service delivery channels in use (Internet, in person, mail or telephone)" that a decision will be made or assisted by an automated system. At Level III and above the notice must point people to the published explanation.
• A real explanation after the decision. At every level, a published plain language explanation of how the system works, covering the role of the system in the decision, the input data and its source, the criteria used, and "the principal factors behind a decision." From Level II up, anyone denied a benefit or service gets a specific explanation of why.
• Testing before launch, monitoring after. Section 6.3.1 requires testing "the data, information, and underlying model for accuracy, unintended biases" before production. Section 6.3.2 requires monitoring outcomes on a scheduled basis afterward.
• Human involvement that scales with stakes. At Levels I and II the system "may make decisions and assessments without direct human involvement." At Levels III and IV, "the final decision must be made by a human."
• Recourse. Clients must be told how to challenge the decision, and section 6.4.1.1 requires those options to be "timely, effective, and easy to access."

There's a sixth one your vendor will not volunteer. Section 6.2.6.1 says that when a department buys a proprietary system, it keeps the right to access, test and monitor it, including all released versions, in case an audit or investigation needs it. Put the equivalent clause in your contract with whoever builds your AI. If you can't inspect it, you can't defend it.

The part that actually binds you

The Directive is guidance you're borrowing. PIPEDA and BC's Personal Information Protection Act are law.

Two sections matter most. Under PIPA section 4, an organization may collect, use or disclose personal information only "for purposes that a reasonable person would consider appropriate in the circumstances." Under section 23, on request you must give an individual their personal information plus "information about the ways in which the personal information ... has been and is being used by the organization." If an AI agent scored a customer, that scoring is a use, and you need to be able to describe it in words.

Canada's privacy regulators, federal and provincial together, published Principles for responsible, trustworthy and privacy-protective generative AI technologies on December 7, 2023. The line worth taping to your monitor: "Accountability for decisions rests with the organization, and not with any kind of automated system used to support the decision-making process." The same guidance flags "highly impactful contexts" deserving extra care, including health care, employment, education, housing and access to finance.

This isn't theoretical. In PIPEDA Findings #2026-002, released May 6, 2026, the federal Privacy Commissioner, Quebec's Commission d'accès à l'information, and the Information and Privacy Commissioners of British Columbia and Alberta found that OpenAI "failed to meet its accountability requirements," in part because it deployed ChatGPT without establishing accuracy levels or finalizing retention policies beforehand. The offices also found it "failed to obtain valid consent" and was "not sufficiently transparent with respect to the categories and sources of personal information." BC's regulator was at that table. And notice what the accountability finding was about. Not the model. Shipping without deciding, in advance, how accurate is accurate enough.

Where this doesn't apply

Most of what a small business automates isn't a decision at all, and dragging the full Directive over it wastes money you could spend on the thing that pays.

An AI receptionist that books an appointment and texts a confirmation isn't denying anyone anything. Neither is a bot that answers questions about store hours, or a tool that drafts a social post for a human to approve. The Directive itself carves out test environments and research. Save the heavy process for places where an automated output determines whether someone gets a service, a price, a job interview or credit.

The adoption data argues for restraint too. Statistics Canada reported on June 11, 2026 that 19.2% of businesses used AI to produce goods or deliver services over the previous 12 months, roughly triple the 6.1% recorded in the second quarter of 2024. But 40.0% of businesses said AI "is not relevant to the business," and among businesses with 1 to 4 employees that figure rose to 41.4%. Cybersecurity or privacy concerns were the leading reported barrier at 13.4%, ahead of cost at 10.6%. Plenty of firms looked closely and said no, and some of them were right.

There's also a mismatch of scale. The Directive assumes a department with in-house legal services and a deputy head who signs off. Section 6.3.7 asks for external peer review at Level II and above. A ten person shop in Metro Vancouver is not hiring an academic to review a booking bot. Copy the shape of the requirements, not the org chart.

What to do this quarter

Write one page for each automated workflow you run. What decision does it make or influence, what data goes in, what happens when it's wrong, who reviews it, and how does a customer challenge it. That's it. If you can't fill the page, the system isn't ready for customers yet. If you can, you're ahead of most of your competitors and you have something real to hand a regulator, an insurer or a nervous client.

Sources

• Treasury Board of Canada Secretariat. *Directive on Automated Decision-Making*. Effective April 1, 2019, last amended June 24, 2025. https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592
• Office of the Privacy Commissioner of Canada, with provincial and territorial privacy regulators. *Principles for responsible, trustworthy and privacy-protective generative AI technologies*. 2023. https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/
• Office of the Privacy Commissioner of Canada, Commission d'accès à l'information du Québec, Office of the Information and Privacy Commissioner for British Columbia, Office of the Information and Privacy Commissioner of Alberta. *PIPEDA Findings #2026-002: Overview of the Joint Investigation of OpenAI OpCo, LLC*. 2026. https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002-overview/
• Statistics Canada. *Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026*. Catalogue no. 11-621-M, released June 11, 2026. https://www150.statcan.gc.ca/n1/pub/11-621-m/11-621-m2026010-eng.htm
• Province of British Columbia. *Personal Information Protection Act*, SBC 2003, c 63. https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/03063_01

If you'd like a second set of eyes on where your automations sit on that scale, book a free call with Autana Solutions. We build AI employees for businesses across Metro Vancouver, and we'd much rather scope the guardrails with you before launch than retrofit them after a customer asks a question you can't answer.