StarApple AICanada

Tool 04

Fourteen controls, mapped to the instruments you answer to.

Each control is tagged with the instrument it answers to. Mark what is true today rather than what is written in a policy nobody follows, and the result will name the three gaps worth closing first.

We can state, for every AI system, what personal information it processes and on what basis.Instrument: PIPEDA
We know where each AI system processes data, including whether it leaves Canada.Instrument: PIPEDA
Retention and deletion rules apply to AI inputs and outputs, not only to source systems.Instrument: PIPEDA
Where a decision is made exclusively by automated means, we inform the individual.Instrument: Law 25
An individual can ask for the personal information used in that decision, and be heard by a person.Instrument: Law 25
We have risk-tiered our AI systems and can say which are high-impact.Instrument: TBS Directive and AIA
Human oversight is designed in, with a named person who can intervene or override.Instrument: TBS Directive and AIA
The reasoning behind automated decisions can be explained to the person affected.Instrument: TBS Directive and AIA
Every model has an owner, a documented purpose, and a validation record.Instrument: OSFI E-23
Model performance is monitored in production, with drift thresholds that trigger review.Instrument: OSFI E-23
There is a defined process for retiring or replacing a model.Instrument: OSFI E-23
AI systems are inside our technology and cyber risk register, with resilience requirements.Instrument: OSFI B-13
An accountable body meets on a set cadence to review AI risk and approve new systems.Instrument: ISO/IEC 42001
AI procurement includes vendor diligence on training data, security and model changes.Instrument: ISO/IEC 42001