Canada does not currently have a dedicated AI statute in force (see our companion piece on whether Canada has an AI law). What it does have, since September 2023, is a voluntary code that a specific, named list of organizations has agreed to follow — and the difference between that and a law is the whole point of this article.
Key takeaways
Innovation, Science and Economic Development Canada (ISED) published its Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems in September 2023. The name is precise and worth reading in full: it is voluntary, it is a code of conduct rather than a regulation, and it covers advanced generative AI systems specifically — not AI generally.
Signatories commit to working toward six named outcomes, quoted directly from the page: “Accountability – Organizations understand their role with regard to the systems they develop or manage, put in place appropriate risk management systems, and share information with other organizations as needed to avoid gaps,” “Safety – Systems are subject to risk assessments, and mitigations needed to ensure safe operation are put in place prior to deployment,” “Fairness and Equity,” “Transparency,” “Human Oversight and Monitoring,” and “Validity and Robustness.” These are outcomes, not specific rules — the Code’s measures table, discussed next, is where each outcome becomes a checkable action.
The Code’s measures table has four columns: Developers and Managers, each split between “all advanced generative systems” and “advanced generative systems available for public use.” A handful of measures apply only to the narrower, public-facing case. “Ensure that systems that could be mistaken for humans are clearly and prominently identified as AI systems” is a manager’s obligation, owed regardless of whether the system is public-facing — the closest thing in Canadian federal policy to a general chatbot-disclosure norm, though it is voluntary, not law. Other measures apply only to public systems specifically: developing “a reliable and freely available method to detect content generated by the system, with a near-term focus on audio-visual content (e.g., watermarking)” is owed by developers of public-facing systems only, not by every developer or by managers at all.
46 organizations are named as signatories on ISED’s own page, including CIBC, TELUS, IBM, Cohere, Mila, the Vector Institute, Amii, Salesforce, SAP Canada, and the Organisme d’autoréglementation du courtage immobilier du Québec (OACIQ). Signing is a commitment to work toward the six outcomes and the measures that apply to the signatory’s role — it is not a licence, a certification, or a legal filing, and the list is described on the government’s own page as subject to change, so a current count should always be checked against the live page rather than assumed.
The government’s own wording removes any ambiguity on this point: “this code does not in any way change existing legal obligations that organizations may have – for example, under the Personal Information Protection and Electronic Documents Act”. A signatory that collects personal information to train or run a generative AI system is still fully bound by PIPEDA, including the requirement in section 5(3) that collection, use or disclosure be limited to “purposes that a reasonable person would consider are appropriate in the circumstances,” regardless of whether the organization has also signed the voluntary code. The Code adds a layer of commitment on top of existing law; it does not substitute for it, and non-signatories remain just as bound by PIPEDA as signatories are.
ISED ran a companion consultation on developing a formal “Canadian code of practice,” now closed, and its own page states the purpose plainly: the code “will provide voluntary guidance to companies developing and using AI systems, and it will help them to prepare their processes and products before formal regulation takes effect.” That sentence is the government’s own framing of the Code’s purpose: a bridge for companies to get ahead of a regulatory framework that does not yet exist, not a replacement for one. What that eventual formal regulation might look like, and whether it will resemble the AI-specific bill previously before Parliament, is covered in our companion piece on whether Canada has an AI law.
Reading a Code commitment correctly
If a company states it follows the ISED Voluntary Code, that tells you it has committed to work toward the six outcomes and the measures matching its role — developer or manager, public-facing system or not. It does not tell you the company has met a compliance standard, passed an audit, or is exempt from PIPEDA, Law 25, or any other existing obligation. The Code and the law are two separate, cumulative layers.
Two rows in the measures table are worth pulling out because they answer questions people ask most often. First, red-teaming: developers of every advanced generative system — public-facing or not — commit to “employ adversarial testing (i.e., red-teaming) to identify vulnerabilities” before release, per the table. Second, training-data transparency: only developers of public-facing systems commit to “publish a description of the types of training data used to develop the system” — a system built and used only internally carries no such commitment under the Code, even for a signatory. That distinction matters if you are trying to work out what a signatory has actually promised for a specific product, rather than assuming the Code applies uniformly to everything a signatory builds.
Related: does Canada have an AI law.
The engagement hub covering how a due-diligence review would treat a signatory’s commitments in practice is the AI due diligence hub.
No. It is explicitly voluntary and binds only its signatories — the page states it “does not in any way change existing legal obligations” such as those under PIPEDA.
No. Obligations split by role (developer versus manager) and by whether the system is available for public use — some measures, like third-party audits before release, apply only to public-facing systems (ISED).
46 organizations are listed on ISED’s own page as of this reading, including CIBC, TELUS, IBM, Cohere and Canada’s three national AI institutes (ISED Voluntary Code) — check the live page for the current list, since it is described as subject to change.
A short call is enough to separate what the Code asks for from what the law already requires.
