Canada Artificial Intelligence and Data Act (AIDA)

Canada

v2022 (proposed - not yet enacted)

15 domains

33 controls

The Artificial Intelligence and Data Act (AIDA), proposed as Part 3 of Bill C‑27 (Digital Charter Implementation Act), is a pending Canadian federal law that would establish a risk‑based regulatory framework for high‑impact artificial intelligence systems. The Act would impose obligations on providers and operators of high‑impact AI systems, including conducting risk assessments, implementing monitoring and mitigation measures, maintaining detailed documentation, and providing transparency notices to affected individuals. It defines “high‑impact” AI based on criteria such as the system’s scope, level of autonomy, and potential for significant harm. The Act also includes provisions for exemptions, enforcement powers for the Minister of Innovation, Science and Industry, and alignment with existing privacy legislation. As of now, AIDA remains a proposed statute and has not yet been enacted.

Unverified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (15)

Accountability and Governance

3 controls

Controls in the Accountability and Governance domain of Canada Artificial Intelligence and Data Act (AIDA) — 3 controls
Code	Title	Description
AIDA-11	Incident Reporting	Report material harms or risks of harm from AI systems to the AI and Data Commissioner.
AIDA-12	Record Keeping	Maintain records of measures taken to comply with AIDA obligations, available on Commissioner request.
AIDA-13	Risk Mitigation Measures	Establish, implement and maintain measures to mitigate identified risks of harm and biased output.

Assurance

1 controls

Controls in the Assurance domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-19	Audit and Assurance	Subject high-impact systems to independent audit or assurance reviews proportionate to risk.

Data

1 controls

Controls in the Data domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-5	Data Governance	Ensure training and operational data is appropriate, lawfully obtained and quality-assured.

Deployment and Operations

3 controls

Controls in the Deployment and Operations domain of Canada Artificial Intelligence and Data Act (AIDA) — 3 controls
Code	Title	Description
AIDA-10	Monitoring and Drift Detection	Continuously monitor deployed systems for performance drift and emerging harms.
AIDA-8	Human Oversight	Maintain human oversight proportional to risk, including ability to intervene and override automated decisions.
AIDA-9	Robustness and Validation	Validate AI system performance, robustness, and reliability against intended use cases.

Design and Development Requirements

4 controls

Controls in the Design and Development Requirements domain of Canada Artificial Intelligence and Data Act (AIDA) — 4 controls
Code	Title	Description
AIDA-4	Bias and Discrimination Mitigation	Implement measures to detect, mitigate and monitor biased outputs across protected characteristics.
AIDA-5	Data Governance	Ensure training and operational data is appropriate, lawfully obtained and quality-assured.
AIDA-6	Transparency to Users	Disclose to users when they interact with a high-impact AI system and provide intended use information.
AIDA-7	Public Reporting	Publish plain-language descriptions of high-impact AI systems, including capabilities and limitations.

Fairness

2 controls

Controls in the Fairness domain of Canada Artificial Intelligence and Data Act (AIDA) — 2 controls
Code	Title	Description
AIDA-17	User Redress	Provide affected individuals a means to challenge or seek correction of AI decisions impacting them.
AIDA-4	Bias and Discrimination Mitigation	Implement measures to detect, mitigate and monitor biased outputs across protected characteristics.

Governance

4 controls

Controls in the Governance domain of Canada Artificial Intelligence and Data Act (AIDA) — 4 controls
Code	Title	Description
AIDA-1	Scope and High-Impact Systems	Identify AI systems that may be high-impact based on intended use, risk of harm and reliance on automated decisions.
AIDA-12	Record Keeping	Maintain records of measures taken to comply with AIDA obligations, available on Commissioner request.
AIDA-18	Training and Competence	Train staff developing, deploying or operating AI systems on AIDA obligations and risks.
AIDA-2	Accountability Framework	Establish an accountability framework with roles for AI risk owners, sign-off authorities and an AI ethics function.

High-Impact AI System Classification

3 controls

Controls in the High-Impact AI System Classification domain of Canada Artificial Intelligence and Data Act (AIDA) — 3 controls
Code	Title	Description
AIDA-1	Scope and High-Impact Systems	Identify AI systems that may be high-impact based on intended use, risk of harm and reliance on automated decisions.
AIDA-2	Accountability Framework	Establish an accountability framework with roles for AI risk owners, sign-off authorities and an AI ethics function.
AIDA-3	Harm Assessment	Assess potential harms including physical, psychological, economic and biased output before deploying AI.

Incident Response

1 controls

Controls in the Incident Response domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-11	Incident Reporting	Report material harms or risks of harm from AI systems to the AI and Data Commissioner.

Operations

4 controls

Controls in the Operations domain of Canada Artificial Intelligence and Data Act (AIDA) — 4 controls
Code	Title	Description
AIDA-10	Monitoring and Drift Detection	Continuously monitor deployed systems for performance drift and emerging harms.
AIDA-16	Generative AI Specific Measures	Apply additional measures for general-purpose and generative AI including content provenance.
AIDA-20	Cessation of High-Risk Use	Have authority and procedure to suspend or cease operation of an AI system causing serious harm.
AIDA-8	Human Oversight	Maintain human oversight proportional to risk, including ability to intervene and override automated decisions.

Quality

1 controls

Controls in the Quality domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-9	Robustness and Validation	Validate AI system performance, robustness, and reliability against intended use cases.

Risk

2 controls

Controls in the Risk domain of Canada Artificial Intelligence and Data Act (AIDA) — 2 controls
Code	Title	Description
AIDA-13	Risk Mitigation Measures	Establish, implement and maintain measures to mitigate identified risks of harm and biased output.
AIDA-3	Harm Assessment	Assess potential harms including physical, psychological, economic and biased output before deploying AI.

Security

1 controls

Controls in the Security domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-15	Security of AI Systems	Protect AI systems against adversarial attacks, model theft and data poisoning.

Third-Party

1 controls

Controls in the Third-Party domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-14	Third-Party AI Components	Assess and manage risks from third-party models, APIs and datasets used in high-impact systems.

Transparency

2 controls

Controls in the Transparency domain of Canada Artificial Intelligence and Data Act (AIDA) — 2 controls
Code	Title	Description
AIDA-6	Transparency to Users	Disclose to users when they interact with a high-impact AI system and provide intended use information.
AIDA-7	Public Reporting	Publish plain-language descriptions of high-impact AI systems, including capabilities and limitations.

Your Compliance Coverage

If you comply with Canada Artificial Intelligence and Data Act (AIDA), you already cover:

NIST AI Risk Management Framework (AI RMF 1.0)

85%

17 controls mapped

Compare →

NIST AI 600-1: Generative AI Profile

60%

12 controls mapped

Compare →

OECD AI Principles

55%

11 controls mapped

Compare →

+ 38 more: OECD Recommendation on Artificial Intelligence (2024 Update) (25%), Vermont Artificial Intelligence and Consumer Data Act (AICDA) (20%)

See all 41 mapped frameworks ↓

Maps to 41 other frameworks

20 total controls

NIST AI Risk Management Framework (AI RMF 1.0)

17 source controls mapped|20 target controls covered

85%

NIST AI 600-1: Generative AI Profile

12 source controls mapped|14 target controls covered

60%

OECD AI Principles

11 source controls mapped|11 target controls covered

55%

OECD Recommendation on Artificial Intelligence (2024 Update)

5 source controls mapped|5 target controls covered

25%

Vermont Artificial Intelligence and Consumer Data Act (AICDA)

4 source controls mapped|3 target controls covered

20%

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

4 source controls mapped|5 target controls covered

20%

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

4 source controls mapped|7 target controls covered

20%

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule

3 source controls mapped|2 target controls covered

15%

ISO/IEC 29134:2023

3 source controls mapped|3 target controls covered

15%

ISO/IEC 27014:2020

3 source controls mapped|2 target controls covered

15%

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

3 source controls mapped|2 target controls covered

15%

ISO/IEC 27400:2022

2 source controls mapped|3 target controls covered

10%

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

2 source controls mapped|4 target controls covered

10%

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution

2 source controls mapped|2 target controls covered

10%

ISO/IEC 38500:2024 - Governance of IT

2 source controls mapped|2 target controls covered

10%

GLI-33 - Gaming Laboratories International Event Wagering Systems

2 source controls mapped|2 target controls covered

10%

TISAX - Trusted Information Security Assessment Exchange

2 source controls mapped|2 target controls covered

10%

Telecommunications Sector Security Reforms (TSSR)

2 source controls mapped|2 target controls covered

10%

Protective Security Policy Framework (PSPF) Release 2024

2 source controls mapped|2 target controls covered

10%

SQF Code Edition 9 - Safe Quality Food

2 source controls mapped|2 target controls covered

10%

ASIS SPC.1-2009 - Organizational Resilience Standard

2 source controls mapped|1 target controls covered

10%

ISO/IEC 29147:2018

2 source controls mapped|1 target controls covered

10%

ISO/IEC 27031:2011

2 source controls mapped|1 target controls covered

10%

ISO/IEC 27006:2024