New Ontario Bill 194 to Regulate Public-Sector Use of Artificial Intelligence Systems

On May 13, 2024, the Government of Ontario introduced Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (Bill 194), which, if passed, will enact the Enhancing Digital Security and Trust Act, 2024 (the Act). The Act, as drafted, seeks to regulate the use of artificial intelligence systems within the public sector, among other goals.

Bill 194 also introduced amendments that, if passed, will significantly reform the Freedom of Information and Protection of Privacy Act (FIPPA). For more information regarding the potential impact of Bill 194 on FIPPA, please see our Blakes Bulletin: New Ontario Bill 194 to Reform FIPPA and Introduce Mandatory Privacy Breach Reporting. 

Application

As drafted, new requirements governing artificial intelligence systems will apply only to specified Ontario public-sector entities that use or intend to use artificial intelligence systems in certain circumstances. The regulations created under the Act will prescribe these public-sector entities and use cases. 

The proposed scope of the Act is broad and includes: 

• Institutions under FIPPA, such as the Ministries of the Government of Ontario, hospitals, and colleges and universities
• Institutions under the Municipal Freedom of Information and Protection of Privacy Act, such as municipalities, school boards, city boards, transit commissions, public library boards, health boards, police service boards, conservation authorities, district social services administration boards, local services boards, planning boards, local road boards and management boards
• Boards under the Education Act
• Societies under the Child, Youth and Family Services Act

Requirements for the Use of Artificial Intelligence Systems

The Act sets out a proposed foundation for responsible, transparent, accountable and secure public-sector use of artificial intelligence systems that should benefit Ontarians and protect their privacy. 

The Act currently defines “artificial intelligence systems” to mean: 

• A machine-based system that, for explicit or implicit objectives, infers from the input it receives to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments
• Other systems that may be prescribed in the regulations

Further, the “use of an artificial intelligence system by a public-sector entity” includes using publicly available artificial intelligence systems as well as systems developed or procured by the public-sector entity or developed by a third party on behalf of the public-sector entity. This means private sector providers of artificial intelligence systems to Ontario’s public sector will be indirectly impacted by the requirements contemplated by the Act. 

As drafted and if passed, prescribed public-sector entities who use artificial intelligence systems in certain circumstances will be required to do the following: 

• Provide information to the public regarding their use of the artificial intelligence system
• Develop and implement an accountability framework regarding their use of the artificial intelligence system, which may include documentation, performance and monitoring requirements
• Adopt steps prescribed by regulations to manage any risks associated with the use of the artificial intelligence system, including potential reporting and record-keeping requirements
• Comply with additional requirements specified in the regulations, which may include restrictions or prohibitions on the use of artificial intelligence systems in certain circumstances
• When using the artificial intelligence system, disclose information regarding the use of the artificial intelligence system and ensure that there is an individual who exercises oversight of the use of the system

The Government of Ontario is seeking consultations on the proposed legislation and Bill 194 in general. Comments are due by June 11, 2024. 

For more information, please contact: 

or any other member of our Privacy & Data Protection or Technology groups.