Five knowledge workflows Canadian public institutions can pilot safely

There is a shorter path. The Government of Canada has already drawn the line, and it is drawn in a place that leaves a useful amount of room.

The Directive on Automated Decision Making came into force 1 April 2019 and applies to systems developed or procured after 1 April 2020. It is triggered when a system makes, or assists an officer in making, an administrative decision, defined as one with the potential to affect legal rights, privileges or interests.

The Treasury Board of Canada Secretariat’s Guide on the Scope of the Directive on Automated Decision Making was last modified 24 June 2025. It places outside the boundary “actions that do not impact the legal rights, privileges or interests of individuals or employees.”

Its examples include “research, program evaluation, brainstorming and drafting documents.”

That is the government’s own scope guidance naming drafting and brainstorming as outside the Directive. It is the single most useful sentence available to anyone trying to start.

Two cautions, both of which matter more than the permission does.

Out of scope is not unregulated. The same guide notes that other requirements apply to systems used solely for research and experimentation, “such as those relating to privacy, security, information management, and values and ethics.” The same reasoning applies to any workflow outside scope.

Internal is not a synonym for out of scope. The most recent amendments confirmable from the Secretariat’s own announcement record, effective 25 April 2023, expressly brought internal services into coverage, including hiring, performance management and employee security screening. A workflow that feeds a staffing or screening decision is in scope no matter how internal it feels.

So the test turns on whether the workflow produces or assists a determination about a person, wherever it sits in the organization.

The Secretariat released the Government of Canada AI Register on 28 November 2025 and last updated it on 28 April 2026. A count taken directly from the open data service gives 412 records. Of those, 160 are recorded as in production and 182 as in development. The register spells the production value two ways, and we count both. A single-spelling count therefore returns 158. At launch the Secretariat described it as featuring over 400 systems, with input from 42 institutions.

Read that as a floor, not a census. The register describes itself as “a minimum viable product (MVP), or an early version with only basic features and content that is used to gather feedback.” It notes that “not all entries are complete.” Its builders assembled it “from existing sources of information, including Algorithmic Impact Assessments, Access to Information requests, responses to Parliamentary Questions, Personal Information Banks, and the GC Service Inventory.” The launch news release adds that the register excludes artificial intelligence embedded within low risk commercial products. It names virtual assistants and spell checkers as examples.

Its capability field is free text rather than a controlled vocabulary, and no category breakdown accompanies the published data. Anyone quoting a percentage of the register by use case has computed it themselves, from a field that was never designed to carry one.

Each of these appears in the Secretariat’s own guidance, though not all of them as endorsements, and the cautions attached to two of them are noted below. None, run as described, produces a determination about a person.

One. Drafting and editing internal documents. The Guide on the use of generative artificial intelligence was published 30 May 2024 and last modified 12 August 2026. It gives as an example of a low risk use “editing a draft document that will go through additional reviews and approvals.” The review chain carries the safety in that sentence, not the tool. Pilot it where a review chain already exists, and the control comes with it.

Two. Summarizing long records for a human reader. Consultation submissions, evaluation evidence, meeting records. The output is an input to a person’s work, never a substitute for reading where the reading matters. Measure it by whether the summary drops what the reader needed, not by whether it reads well.

Three. Retrieval across internal policy and procedure. This is the obvious candidate, and the one the Secretariat is most guarded about. The generative artificial intelligence guide warns not to use these tools as search engines “unless sources are provided so that you can verify the content.” Read that as a design requirement rather than a prohibition. Grounded, cited retrieval satisfies it; an ungrounded chat box does not. It is also the workflow most exposed to the state of the corpus. If the authoritative version of a procedure is in four places and three of them are wrong, a better model will not fix the answers. Piloting retrieval is, in practice, an audit of your own information holdings, and that audit is worth the six weeks by itself.

Four. Translation support with human revision. Support, not replacement. The output goes to a qualified reviser. This is a throughput workflow, and it is the one where the gap between an English result and a French result shows up fastest.

Five. Completeness checking against published criteria. The agentic guide names this directly, describing agents that “review incoming applications, verify completeness against eligibility rules and retrieve relevant files from approved internal systems.” Note the tension inside that sentence, because a review board will. The guide joins completeness and eligibility in one phrase; the Directive on Automated Decision Making separates them sharply. A system that tells an officer a form is missing a field is assisting. A system that tells an officer an applicant does not qualify is deciding. Draw that boundary deliberately and write it down.

The Guide on the use of generative artificial intelligence states a prohibition without qualification: “Public servants must not input personal information into publicly available online generative AI tools.” The Canadian Centre for Cyber Security is softer but points the same way. Its generative artificial intelligence guidance, republished December 2025, says: “Do not share private information with AI (artificial intelligence) tools unless you understand what they are doing with your data.”

The agentic guide adds two cautions that apply to every workflow above. The first is prompt injection: “Do not allow AI agents to automatically follow embedded directions because untrusted content may contain hidden instructions (‘prompt injection’) intended to alter the agent’s behaviour.” Any workflow that reads documents submitted from outside the institution is exposed to this, which means workflows two, three and five are all exposed to it. The second is skill atrophy: “Continued offloading of decisions to AI agents can lead to knowledge and skill atrophy and weakened human judgment.” That is a slow risk, and none of the usual pilot metrics measures it.

Pick the one where you can already measure the before state. Not the one with the largest theoretical benefit, and not the one the executive committee is most excited about.

Some workflows already have a counted volume of work, a recorded time taken and someone who can state the current error rate. Those are worth piloting even if the upside looks modest. If none of those exist, the pilot will end with a demonstration everyone liked and nobody can defend a budget with.

That is the actual constraint, and it has nothing to do with artificial intelligence.

Previously: human approval patterns for government AI agents. Next in this series: a practical Protected B AI architecture checklist.