AI regulation in Canada ‎–‎ What’s happening now?‎

Global authorities continue to grapple with AI regulation. Here in Canada, we continue to monitor the progress of Bill C-27. As previously discussed here and here, Bill C-27, the Digital Charter Implementation Act, 2022 (the “DCIA”) is Canada’s second attempt towards the long-awaited reform of privacy law. Several months after the House finally agreed to move the Bill to the Standing Committee on Industry and Technology, the Committee had its first meeting on September 26, 2023.

After the meeting, the Honourable François-Philippe Champagne, M.P‎, on behalf of the government, wrote to the Chair of the Standing Committee proposing amendments to the DCIA, including amendments to the Artificial Intelligence and Data Act (“AIDA”) and the Consumer Privacy Protection Act. The letter sets out generally proposed amendments but not the specific text of the amendments.

Artificial Intelligence and Data Act

AIDA introduces the notion of “high-impact systems” where these systems are subjected to significantly more restrictive requirements, particularly relating to harm reduction and transparency. 

The last version of AIDA left the determination of what is a “high impact system” to the individual developers, maintainers and operators of the AI system, based on a number of criteria. The newly proposed amendments would remove that internal assessment process and instead would classify high-impact systems by intended use:

• for employment and hiring decisions;
• to determine (a) whether to provide services to an individual; (b) the type or cost of services to be provided to an individual; or (c) the prioritization of the services;
• for the use of an artificial intelligence system to process biometric information in matters relating to (a) the identification of an individual, other than if the biometric information is processed with the individual’s consent to authenticate their identity; or (b) an individual’s behaviour or state of mind;
• to moderate content in online communication platforms, including a search engine and a social media service; or (b) the prioritization of the presentation of such content;
• for health care and emergency services;
• when used by courts or administrative bodies to make decisions; and
• to assist law enforcement.

Likely in response to the inherent limitations of the enumerated list approach, the government also proposes to allow the above list to be amended by regulation, meaning that we may still see more as the use of AI systems becomes more prevalent and widespread. For example, will educational, credit, insurance, or environmental systems be considered high impact as well?

Alignment with the EU AI Act and other advanced economies

The government proposes aligning the AIDA with the EU Artificial Intelligence Act ‎and frameworks under the Organization for Economic Co-operation and Development. This is aimed at ensuring that Canada's legislation is interoperable and ‎consistent with international best practices.‎ The changes lay out the responsibilities of and accountability frameworks required to be created by personnel involved in the various stages of the AI system. Businesses would be required to provide this framework to the Commissioner upon request and would need to include:

• the roles and responsibilities and reporting structure for all personnel who support making the system available for use or who support the management of its operations;
• policies and procedures respecting the management of risks relating to the system;
• policies and procedures on how the personnel are to advise the person referred to of serious incidents related to the system;
• policies and procedures respecting the data used by the system;
• the training that the personnel must receive in relation to the system and the training materials they are to be provided with; and
• any other elements prescribed by regulation.

Clarification of roles and obligations in the AI value chain‎

The newly proposed amendments aim to differentiate the roles and duties of different actors in the ‎AI value chain in line with the AIDA Companion Document, including establishing data governance measures, performing an impact assessment and ensuring “appropriate human oversight”.

Specific obligations for general-purpose AI systems

In response to the general reaction to the previous iteration of AIDA basically missing the rise of generative AI entirely, the proposed amendments would create distinct (yet, very similar) requirements for AI chat systems that are designed ‎to be used for many different tasks in many different contexts. ‎ Specifically:

• developers of such systems would, among other things:
  • perform an impact assessment;
  • establish measures to assess and mitigate risks of biased output;
  • conduct testing of the effectiveness of mitigation measure; and
  • prepare a plain-language description of the capabilities and limitations of the system, as well as the risks and mitigation measures taken;
• persons making such systems available would provide, or make publicly available, the plain-language description of the system to its users;
• managers of the operations of such systems would:
  • monitor for any use of the system that could result in a risk of harm or biased output;
  • take measures necessary to mitigate the risks; and
  • report serious incidents to the developer and the Commissioner.

Given the similarity with “high impact” systems and the frameworks proposed for other AI systems, one wonders why the government wants to create yet another set of obligations as opposed to a harmonious ruleset for all AI technologies.

Additionally, the government proposes requiring companies to take some efforts to ensure that the Canadian users can identify AI-generated content (both text and audio-visual content) if there is a reasonably foreseeable risk that an individual communicating with a system could believe that it is human. Whether those efforts are even feasible remains to be seen.

Strengthening the role of the AI and Data Commissioner‎

The government aims to provide clarity about the AI and Data Commissioner's role, build confidence in the Commissioner’s ability to carry out their mandate ‎independently, and enable the Commissioner to play a strong coordinating role across the AI regulatory system to ‎ensure coherence and avoid duplication.‎

Bill C-27 has been in progress for a long time. While the Bill is finally at committee stage, there is a long road before AIDA becomes law.

In the meantime, Innovation, Science and Economic Development Canada have issued a Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems.

Signatories to the code commit to achieving the outcomes of accountability, safety, fairness and equity, transparency, human oversight and monitoring, validity and robustness. Signatories also commit to develop and deploy AI systems in a manner that will drive inclusive and sustainable growth in Canada, “including by prioritizing human rights, accessibility and environmental sustainability”.

Conclusion

Organizations looking to formalize their AI governance approach in Canada will want to monitor these ongoing developments. Please stay tuned for more updates from DLA Piper as new information becomes available.