This readiness framework prepares organizations for Canadian AI governance rules. It is based on the federal Directive on Automated Decision-Making (in force; mandatory for federal automated decision systems and a strong voluntary baseline for the private sector), Quebec Law 25 automated-decision disclosure duties, and Ontario Bill 194 (public sector). The Artificial Intelligence and Data Act (AIDA, Bill C-27) died on the Order Paper in Jan 2025 and will not return as drafted. Successor federal legislation is expected, and this framework keeps organizations positioned for it.
The framework draws on three sources: the federal Directive on Automated Decision-Making (in force; mandatory for federal automated decision systems and a strong voluntary baseline for the private sector), Quebec Law 25 automated-decision disclosure duties, and Ontario Bill 194 (public sector). The Artificial Intelligence and Data Act (AIDA, Bill C-27) died on the Order Paper in Jan 2025 and will not return as drafted. Successor federal legislation is expected, and building on these sources keeps organizations positioned for it.
Official source: https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592
ThreeShield's CISSP- and CISA-certified assessors run the Canada AI Governance Readiness engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
| Canada AI Governance Readiness requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
Parts of it are mandatory for some organizations: the Directive on Automated Decision-Making for federal automated decision systems, Quebec Law 25's automated-decision disclosure duties, and Ontario Bill 194 for the public sector. For other private sector organizations, it is a strong voluntary baseline. We confirm scope in the first call, at no charge.
A gap assessment against the readiness framework usually takes a few weeks. Closing the gaps and standing up the evidence takes longer, and that is where most of the work sits, so the total depends on your starting point. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
ThreeShield meets you at your current security maturity. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You