Public Sector Artificial Intelligence and Cybersecurity Governance Act, governance of public sector use of artificial intelligence systems

The Public Sector Artificial Intelligence and Cybersecurity Governance Act received Royal Assent on June 1, 2026. It comes into force on a day to be fixed by proclamation. An artificial intelligence system is a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments, or a prescribed system.

The Act applies to prescribed public sector entities, which are drawn from the government, government agencies, other reporting organizations under The Financial Administration Act, municipalities, incorporated communities and local government districts. It applies to an artificial intelligence system used by such an entity that is publicly available, developed or procured by the entity, or developed by a third party on behalf of the entity.

If required by and in accordance with the regulations, a prescribed entity that uses an artificial intelligence system must provide information to the public about its use, develop and implement an accountability framework and take steps to manage risks. The entity must use the system in accordance with the regulations. The entity must not use it for any use or purpose that the regulations prohibit.

In prescribed circumstances the entity must ensure that an individual exercises oversight of the use of the system and provides additional information about it, in accordance with the regulations. A prescribed entity that uses an artificial intelligence system must comply with the prescribed technical standards for that use. The regulations may prohibit the use of an artificial intelligence system, including for purposes such as the production of artistic or creative material.