If a federal department uses an automated system to help decide something about you, two specific disclosures are required by name — one before the decision, one after. Neither is a courtesy. Both are written into a binding federal directive, and neither extends past the federal government’s own door.
Key takeaways
Two moments matter to a person on the receiving end of an automated decision: before it happens, and after it happens. The Treasury Board’s Directive on Automated Decision-Making writes a specific duty into each moment, and the two duties are worth separating, because they answer different questions and they are met in different ways.
The directive requires “providing notice through all service delivery channels in use that the decision will be made or assisted by an automated decision system,” and requires that notice be given “prominently and in plain language” (TBS, Directive on Automated Decision-Making, s.6.2). Read that requirement carefully: it does not say “disclose this somewhere on the department’s website.” It says every channel — if a service is available online, by phone, and in person, the notice has to appear in all three, not just the cheapest one to update. “Plain language” is not a suggestion either; the directive ties it to the government’s own Content Style Guide, which exists specifically to keep federal communication understandable to a general reader.
The second duty is separate and comes due only once a decision has been made: “providing a meaningful explanation to clients of how and why the decision was made” (TBS, s.6.2.3). The word “meaningful” is doing real work in that sentence — a boilerplate line stating that “an automated system was used” would satisfy the before-decision notice, but would not, on its own, satisfy the after-decision explanation, which has to actually describe how and why the particular outcome was reached. What counts as sufficiently detailed scales with the system’s Impact Assessment Level: a Level I system carries lighter transparency obligations than a Level IV one, under the same Appendix C the directive uses to set escalating requirements by level, described further in how AI systems get sorted by risk.
This is the single most important limit to hold onto. The directive “applies to any automated decision system in production used to make an administrative decision or a related assessment about a client” (TBS, s.5.1) — and every example on the page is a federal government program. It says nothing about a provincial ministry, a municipal government, a school board, or a private company. Write it as “a Canadian public-sector obligation” and the sentence becomes wrong the moment a reader assumes it covers their provincial or municipal government too. Each government sets its own policy for its own public service, and this directive is Ottawa’s policy for Ottawa’s departments — nothing more, and no comparable binding provincial directive could be located to cite alongside it.
The closest thing to a provincial parallel does not come from a government-operations directive at all — it comes from privacy law. Québec’s Loi 25 amendments require that organizations subject to the province’s private-sector personal information statute inform a person when a decision about them is “fondée exclusivement sur un traitement automatisé” of their personal information, no later than when they are told the decision, and must give them the chance to make representations to a staff member able to review it (CAI, Loi 25 changes). That duty runs on personal-information law, not government-operations policy, and it is triggered by a decision being made exclusively by automated processing — a narrower trigger than the federal directive’s “made or assisted by,” which also covers systems that merely assist a human decision-maker. The two rules resemble each other in spirit — both want the affected person told, both build in a form of review — but they run on different legal foundations, different triggers, and different regulators, and treating them as one rule with two names would misdescribe both.
Picture someone applying for a federal benefit online, where an automated system helps triage the application. Under the directive, the application portal itself — not a buried policy page elsewhere on the department’s site — has to carry the before-decision notice, in plain language, because the online channel is one of the “service delivery channels in use” the directive names. If the same benefit can also be applied for by phone or in person, the same notice has to appear there too, in whatever form suits that channel. If the application is later denied, the after-decision explanation the applicant receives has to go further than “your application did not meet the criteria” — it has to describe how and why the automated system reached that conclusion, scaled to how much impact the decision has on the applicant’s life. A benefit denial sits higher on the Impact Assessment Level scale than a low-stakes administrative matter, and the directive’s own Appendix C ties the depth of explanation owed to that level.
The directive does not leave departments to invent their own compliance approach from scratch. It names companion instruments departments are expected to use: an Algorithmic Impact Assessment tool for scoring a system’s level in the first place, a Guide on the Use of Generative AI for departments specifically deploying generative systems, and a Guide to Peer Review of Automated Decision Systems for having another part of government check the work (TBS, Directive on Automated Decision-Making). None of these three tools is optional window-dressing — the impact assessment is what determines which level a system sits at, which in turn determines how much before-decision notice and after-decision explanation the directive actually requires. Skip the assessment, and there is no basis for knowing what the disclosure duty even demands in a given case.
Related: Ottawa’s own rules for automated decisions and is there an AI registry in Canada.
Not under this directive — it binds federal departments only. A province may have its own policy, but the Treasury Board directive itself creates no obligation outside the federal government.
Not if it does not specifically say the decision will be made or assisted by an automated system, delivered through every channel the service uses. A generic privacy policy referencing data processing broadly is not the same as the specific notice the directive requires.
The directive itself does not spell out a penalty on this page, and enforcement runs through the government’s own internal compliance and review mechanisms rather than a citizen-facing complaint tribunal named here — this piece describes the disclosure obligation itself, not its enforcement pathway.
A short conversation can help map what notice and explanation your specific use case actually needs.
