Enhancing Digital Security and Trust Act, 2024, use of artificial intelligence systems by public sector entities
Enhancing Digital Security and Trust Act, 2024, S.O. 2024, c. 24, Sched. 1, ss. 1, 5 to 8
In force since .
An AI risk obligations rule binding government bodies.
- Private right of action
- No
- Obligation class
- Disclosure, Governance
As of .
What it requires
- These duties bind only a public sector entity that a regulation prescribes for section 5 or 6: an institution under Ontario's Freedom of Information and Protection of Privacy Act (other than the Assembly) or Municipal Freedom of Information and Protection of Privacy Act, a children's aid society or a school board. Ontario Regulations 51/26 and 52/26 prescribe entities for sections 2 and 9 of the Act, not for section 5 or 6.
- If you are a public sector entity prescribed for section 5 and you use or intend to use an artificial intelligence system in the circumstances the regulations prescribe, provide information to the public about your use of the system, in accordance with the regulations.
- Develop and implement an accountability framework respecting your use of the system, in accordance with the regulations.
- Take such steps as may be prescribed to manage the risks associated with your use of the system, use the system in accordance with any prescribed requirements, and do not use it where the regulations prohibit the use.
- If you are a public sector entity prescribed for section 6 and you use an artificial intelligence system in prescribed circumstances, disclose information about the use in accordance with the regulations, and ensure that an individual exercises oversight of the use and provides additional information, in accordance with the regulations.
- Count a system that is publicly available, developed or procured by you, or developed by a third party on your behalf, as your use of an artificial intelligence system.
- If the Minister prescribes you, conform to the technical standards the Minister sets by regulation for your use of artificial intelligence systems.
These lines are LexLint's reading of the law's text, as of .
What this law does
In the Enhancing Digital Security and Trust Act, 2024, a public sector entity is an institution under the Freedom of Information and Protection of Privacy Act other than the Assembly, an institution under the Municipal Freedom of Information and Protection of Privacy Act, a children's aid society or a school board. Section 5 applies to the public sector entities a regulation prescribes for it that use or intend to use an artificial intelligence system in prescribed circumstances.
Such an entity must, in accordance with the regulations, provide information to the public about its use of the system. It must also, in accordance with the regulations, develop and implement an accountability framework respecting its use of the system. It must take such steps as may be prescribed to manage the risks associated with its use of the system. It must use the system in accordance with any prescribed requirements.
It must not use an artificial intelligence system if the regulations prohibit the use. Section 6 applies to the public sector entities a regulation prescribes for it. When such an entity uses an artificial intelligence system in prescribed circumstances, it must disclose information about the use in accordance with the regulations, and ensure that an individual exercises oversight of the use and provides additional information, in accordance with the regulations.
Use of an artificial intelligence system by a public sector entity includes use of a system that is publicly available, developed or procured by the entity, or developed by a third party on its behalf. Section 8 lets the Minister make regulations setting technical standards that the public sector entities the Minister prescribes must conform to in their use of artificial intelligence systems.
Ontario Regulation 51/26 prescribes public sector entities for the purpose of section 2 of the Act, which concerns cyber security. Ontario Regulation 52/26 prescribes every school board for the purposes of section 9 of the Act, which concerns digital information about individuals under age 18. Nothing in the Act or in a regulation or directive made under it establishes a private law duty of care owing to any person.
A failure to comply with the Act or with a regulation or directive made under it does not affect the validity of any policy, Act, regulation, directive, instrument or decision. The Act received Royal Assent on . Section 17 of the Schedule provides that the Act comes into force on a day to be named by proclamation of the Lieutenant Governor. The Act was not in force before .
When LexLint raises it
When your app profile says your app generates content with AI or makes high-risk automated decisions.