Canada Artificial Intelligence and Data Act (AIDA)

Canada

v2022 (proposed - not yet enacted)

10 domains

20 controls

The Artificial Intelligence and Data Act (AIDA), proposed as Part 3 of Bill C‑27 (Digital Charter Implementation Act), is a pending Canadian federal law that would establish a risk‑based regulatory framework for high‑impact artificial intelligence systems. The Act would impose obligations on providers and operators of high‑impact AI systems, including conducting risk assessments, implementing monitoring and mitigation measures, maintaining detailed documentation, and providing transparency notices to affected individuals. It defines “high‑impact” AI based on criteria such as the system’s scope, level of autonomy, and potential for significant harm. The Act also includes provisions for exemptions, enforcement powers for the Minister of Innovation, Science and Industry, and alignment with existing privacy legislation. As of now, AIDA remains a proposed statute and has not yet been enacted.

Unverified

Canada Artificial Intelligence and Data Act (AIDA) is a compliance framework from Canada with 10 domains and 20 controls that map to 23 other frameworks. The largest domains are Design and Development Requirements (4 controls), Governance (4 controls), Operations (4 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (10)

Accountability and Governance

2 controls

Controls in the Accountability and Governance domain of Canada Artificial Intelligence and Data Act (AIDA) — 2 controls
Code	Title	Description
AIDA-11	Incident Reporting	Report material harms or risks of harm from AI systems to the AI and Data Commissioner.
AIDA-13	Risk Mitigation Measures	Establish, implement and maintain measures to mitigate identified risks of harm and biased output.

Assurance

1 controls

Controls in the Assurance domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-19	Audit and Assurance	Subject high-impact systems to independent audit or assurance reviews proportionate to risk.

Deployment and Operations

1 controls

Controls in the Deployment and Operations domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-9	Robustness and Validation	Validate AI system performance, robustness, and reliability against intended use cases.

Design and Development Requirements

4 controls

Controls in the Design and Development Requirements domain of Canada Artificial Intelligence and Data Act (AIDA) — 4 controls
Code	Title	Description
AIDA-4	Bias and Discrimination Mitigation	Implement measures to detect, mitigate and monitor biased outputs across protected characteristics.
AIDA-5	Data Governance	Ensure training and operational data is appropriate, lawfully obtained and quality-assured.
AIDA-6	Transparency to Users	Disclose to users when they interact with a high-impact AI system and provide intended use information.
AIDA-7	Public Reporting	Publish plain-language descriptions of high-impact AI systems, including capabilities and limitations.

Fairness

1 controls

Controls in the Fairness domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-17	User Redress	Provide affected individuals a means to challenge or seek correction of AI decisions impacting them.

Governance

4 controls

Controls in the Governance domain of Canada Artificial Intelligence and Data Act (AIDA) — 4 controls
Code	Title	Description
AIDA-1	Scope and High-Impact Systems	Identify AI systems that may be high-impact based on intended use, risk of harm and reliance on automated decisions.
AIDA-12	Record Keeping	Maintain records of measures taken to comply with AIDA obligations, available on Commissioner request.
AIDA-18	Training and Competence	Train staff developing, deploying or operating AI systems on AIDA obligations and risks.
AIDA-2	Accountability Framework	Establish an accountability framework with roles for AI risk owners, sign-off authorities and an AI ethics function.

High-Impact AI System Classification

1 controls

Controls in the High-Impact AI System Classification domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-3	Harm Assessment	Assess potential harms including physical, psychological, economic and biased output before deploying AI.

Operations

4 controls

Controls in the Operations domain of Canada Artificial Intelligence and Data Act (AIDA) — 4 controls
Code	Title	Description
AIDA-10	Monitoring and Drift Detection	Continuously monitor deployed systems for performance drift and emerging harms.
AIDA-16	Generative AI Specific Measures	Apply additional measures for general-purpose and generative AI including content provenance.
AIDA-20	Cessation of High-Risk Use	Have authority and procedure to suspend or cease operation of an AI system causing serious harm.
AIDA-8	Human Oversight	Maintain human oversight proportional to risk, including ability to intervene and override automated decisions.

Security

1 controls

Controls in the Security domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-15	Security of AI Systems	Protect AI systems against adversarial attacks, model theft and data poisoning.

Third-Party

1 controls

Controls in the Third-Party domain of Canada Artificial Intelligence and Data Act (AIDA) — 1 controls
Code	Title	Description
AIDA-14	Third-Party AI Components	Assess and manage risks from third-party models, APIs and datasets used in high-impact systems.

Your Compliance Coverage

If you comply with Canada Artificial Intelligence and Data Act (AIDA), you already cover:

OECD AI Principles

55%

11 controls mapped

Compare →

NIST AI Risk Management Framework (AI RMF 1.0)

35%

7 controls mapped

Compare →

OECD Recommendation on Artificial Intelligence (2024 Update)

25%

5 controls mapped

Compare →

+ 20 more: ISO/IEC 27557:2022 - Organisational Privacy Risk Management (20%), NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements (20%)

See all 23 mapped frameworks ↓

Maps to 23 other frameworks

20 total controls

OECD AI Principles

11 source controls mapped|8 target controls covered

55%

NIST AI Risk Management Framework (AI RMF 1.0)

7 source controls mapped|6 target controls covered

35%

OECD Recommendation on Artificial Intelligence (2024 Update)

5 source controls mapped|5 target controls covered

25%

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

4 source controls mapped|5 target controls covered

20%

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

4 source controls mapped|5 target controls covered

20%

ISO/IEC 29134:2023

3 source controls mapped|1 target controls covered

15%

ISO/IEC 23894:2023

2 source controls mapped|3 target controls covered

10%

ISO/IEC 27400:2022

2 source controls mapped|3 target controls covered

10%

ISO/IEC 38500:2024 - Governance of IT

2 source controls mapped|2 target controls covered

10%

SQF Code Edition 9 - Safe Quality Food

2 source controls mapped|2 target controls covered

10%

ASIS SPC.1-2009 - Organizational Resilience Standard

2 source controls mapped|1 target controls covered

10%

ISO/IEC 29147:2018

2 source controls mapped|1 target controls covered

10%

ISO/IEC 27031:2011

2 source controls mapped|1 target controls covered

10%

ISO/IEC 29100:2024

1 source controls mapped|3 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety

1 source controls mapped|3 target controls covered

ISO 37301:2021