Quebec imposes guidelines for the use of AI in the civil service

Quebec’s Ministry of Cybersecurity and Digital Technology (MCN) is adopting measures to regulate the use of generative artificial intelligence (GAI) by public bodies. These guidelines are in line with best practices, according to experts, who nevertheless fear that implementation will be difficult.

A few days before Christmas, Quebec announced in a news release the entry into force of an “application guideline.”

This document contains measures for the use of GAI in public administration.

These include data protection, staff training and criteria to be considered when choosing use cases for GAI. The document also provides a governance framework, risk management and control measures.

In addition to this guideline, the MCN has also updated its “statement of principles for the responsible use of artificial intelligence by public bodies.”

These two documents also lift last year’s suspension on the use of AI-based virtual assistants in public administration, according to the MCN.

“Experimental work carried out by the MCN in collaboration with 14 public bodies has made it possible to assess the risks of using AI and to draft guidelines for controlling them,” said the MCN minister’s office.

Best practices

Quebec’s approach to regulating this technology is in line with recognized best practices in the public sector, particularly at the international level, according to experts contacted by The Canadian Press.

Sébastien Gambs, a professor in the computer science department at the University of Quebec in Montreal (UQAM), views the introduction of this Quebec framework as a positive development.

“There is a desire to ensure that when an AI system is put in place, it is not just an experiment by a sorcerer’s apprentice, but that many issues are taken into account to ensure that it benefits society,” said Gambs, who holds the Canada Research Chair in Privacy-Preserving and Ethical Analysis of Massive Data.

According to Lahcen Fatah, an ethicist specializing in technology and artificial intelligence, Quebec is taking a “fairly pragmatic approach” with the application guideline.

“The document does not necessarily celebrate generative AI as a miracle solution. (…) AI is presented here as an assistance tool, never as a substitute for administrative or political judgement,” said Fatah, a doctoral student at UQAM.

He also praises, among the good measures integrated by Quebec, “the maintenance of a responsible human being” behind the use of GAI. The framework provides for an obligation of human supervision and “a refusal to delegate completely to a generative AI system,” he points out.

Ali Ekber Cinar, a doctoral student at McGill University’s Faculty of Law and a specialist in the field of law and technology, considers overall that the application guideline “is structurally sound and attentive to risks.”

He “particularly notes the explicit requirement to conduct privacy impact assessments (…) at all stages of projects.”

“This strikes me as remarkable, as it demonstrates a high level of caution and ensures that ethical and privacy considerations are treated as an ongoing responsibility,” Cinar said in an email.

“However, there are still gaps” in terms of personal data protection, although the framework provides for robust measures, he said.

In particular, he points out that the framework offers “limited guidance on informing data subjects, obtaining their consent, or the possibility of challenge and recourse.”

Cinar also highlights the lack of detail on certain aspects, including data “retention periods.”

Gambs also finds several aspects of the statement of principles interesting. In particular, he cites the section on the efficiency and effectiveness of AI systems, which, according to the statement, should enable simplified public services.

“For me, the basic question to ask is: does the AI system we are going to implement improve a government process or add value? It’s not just a complicated system we’re putting in place. (…) Is it really something that will benefit the population at a controlled cost?” he argues.

A challenge to implement

The UQAM professor believes that implementing these principles and guidelines within the public service is a major challenge.

In his view, their implementation may require training for existing staff and the hiring of new employees.

“I think there is already a fair amount of expertise in each department to be able to address privacy issues. But there are new principles emerging that are somewhat specific to AI, which, in my opinion, require internal skills development and perhaps the hiring of new people with this expertise,” said Gambs.

Fatah points out that the guideline is mandatory in nature, as it applies to organizations and departments subject to the Governance and Management of Information Resources Act.

This is “likely to have a concrete impact on administrative practices,” he said.

“However, despite being mandatory, it remains difficult to implement,” Fatah acknowledges.

“The framework is robust on paper, but its effectiveness will depend heavily on resources, the digital maturity of organizations and their ability to operationalize these requirements over time,” he says.

Although the measures adopted by the MCN are far from symbolic, Fatah believes that the adoption of a framework law remains necessary to strengthen the responsible development and deployment of AI in Quebec.

In its report on AI, published in January 2024, the Quebec Innovation Council recommended that the province quickly begin work on adopting a framework law.

The latter “would aim to establish guidelines applicable in both the private and public sectors” in order to protect citizens in the presence of AI systems “with a high risk of impact on human rights,” the Council wrote.

–This report by La Presse Canadienne was translated by CityNews