Submission to Innovation, Science and Economic Development Canada (ISED) on the Canadian Guardrails for Generative AI.

Members of the Canadian Chamber of Commerce believe in the need for rules to govern generative AI. Our members understand that the Government of Canada intends to prioritize the regulation of generative AI systems and ask that this Code of Practice remain voluntary, non-binding, and in effect until the Artificial Intelligence and Data Act (AIDA) receives royal assent.

Given the robust intent of the Code of Practice to ensure that developers, deployers, and operators of generative AI systems are able to avoid harmful impacts, build trust in their systems, and transition smoothly to compliance with Canada’s forthcoming regulatory regime, we believe these considerations require a continual, and meaningful consultative approach, inclusive of fair timelines.

In devising this voluntary Code of Practice, Government Officials should take the opportunity to sufficiently leverage domestic industry expertise, capable of adequately guiding government regulation – even if the code is voluntary. Further, given the global nature of AI, our members encourage the Government of Canada to seek input from and coordinate with international trading partners on this Code and subsequent regulations, with the goal of ensuring interoperability and harmonization with existing legislation and guidance. As such, it will be important that Innovation, Science and Economic Development Canada (“ISED”) recognize the evolving nature of the Code and ensure it continues to be iterative as Canada hears from industry, academia, and other governments.

Moving forward, we ask the government to involve the Canadian Chamber and its members to enable further discussion to avoid regulatory fragmentation, address legitimate concerns about risks, and give legal certainty to businesses looking to embrace innovation and deploy AI systems. Let us remember that a key strategic aim for Canada is to improve Canada’s industrial competitiveness by developing a thriving AI ecosystem. It is critical that we achieve a fair balance and develop an appropriate degree of regulation where necessary, with clear obligations that will encourage AI adoption and innovation. Tailoring future regulation precisely to tackle the identified risks and gaps missing from existing legislation could be a guiding principle for policymakers.

While the Code of Practice is voluntary, it is unclear what mechanism, if any, Government Officials envision Canadian companies adopt when signing up or committing to the Code of Practice.

Members welcome the opportunity to provide comments about any such mechanisms that are proposed. It is, therefore, crucial that the government conducts thorough and regular consultations to ensure the implementation of accurate regulations for the betterment of Canadians, industry, and the government.

In addition to the above comments about process, the following input is important to our
members for consideration:

• We understand and agree in principle, with the intention of a solid AI framework for safety, transparency, and accountability. We see, however, great ambiguity and potential gaps in the scope of information provided to support ISED’s current consultation that industry consultation could help clarify. The government’s discussion document offers no clear definitions for generative AI, a key concept underlying the proposed core elements of the Code. It is difficult to comment on the appropriateness of the proposed elements without understanding precisely what would be captured by the associated guardrails. Clearly and consistently defining key terms, including but not limited to Generative AI, will ultimately ensure organizations can operationalize the Code of Practice. We encourage ISED to align its approach with international practices, principles and standards. For example, terms used in the voluntary Code of Practice should be consistent with the Organisation for Economic Co-operation and Development (OECD) AI Framework, the United States National Institute of Standards and Technology’s (NIST) AI Risk Management Framework, as well as the EU-US Terminology and Taxonomy for Artificial Intelligence. The consistent use of these terms would provide greater clarity on roles and responsibilities and lead to much more effective implementation and monitoring of the voluntary guardrails.
• ISED should also define and distinguish the roles within the AI ecosystem (i.e., developers, deployers and operators), as well as associated activities. Doing so is essential to understand which organization or entity is best placed to identify and mitigate the risk of harm while also addressing situations where a single entity engages in activities that transcend more than one role. Tailoring obligations to both roles and activities in an entity’s role will help entities better understand and fulfill their obligations, resulting in better compliance with the guardrails.
• ISED should prioritize a risk-based approach to the application of this Code of Practice. Generative AI risks are use-case specific, as such, the guardrails should focus on specific applications of Generative AI that pose higher risks.
• The Code of Practice should recommend the adoption of appropriate cybersecurity measures, based on risk assessments, to prevent and identify adversarial attacks and insider threats on Generative AI systems. Doing so would help prevent data poisoning, jailbreaking, and protect against intellectual property theft. Cybersecurity measures could include red teaming and penetration testing exercises as well as other modes of security testing of generative AI systems. The goal would be to facilitate the secure, rapid and confidential discovery of vulnerabilities to their AI systems as well as potential harmful effects throughout the lifecycle of the system in order to find and fix vulnerabilities in a timely fashion.
• Where possible, information sharing and user education should be promoted. Developers and deployers of AI systems should be encouraged to share information and research on vulnerabilities, risks and the malicious use of AI systems with trusted stakeholders across governments, industries, civil society and academia in a confidential manner. They should also share best practices for managing these risks. The goal would be to facilitate the sharing of essential information on attempts to circumvent safeguards and to promote opportunities for technical collaboration to reduce and mitigate potential vulnerabilities and risks.
• Similar to AIDA, a balanced approach between the transparency of a given AI system and the protection of an organization’s confidential information is required to avoid unnecessary disclosures of information that might create risks counter to the government’s policy intent (i.e., the risk of harm posed by bad actors and risks of inconsistencies with organizations’ competing regulatory obligations, such as privacy laws).
• In addition to addressing risks associated with Generative AI, the Code of Practice should recognize the promise and opportunity of this evolving technology. Companies should be encouraged to invest in research and innovation that may leverage AI and machine learning to help solve societal and economic challenges facing Canadians.
• Under the best circumstances, even if industry reception of the Code of Practice was in full agreement, the government must recognize that rapidly evolving technologies such as AI and generative AI make static processes for regulation insufficient. ISED must ensure it creates and adopts iterative processes to adopt this reality. Given rapid developments in this technology, we urge the government to monitor the likely impact of regulatory obligations on the development and application of AI to avoid further risk or prevent innovation in this area, hindering Canada’s competitive landscape.
• The Code of Practice refers to the lifecycle-based evaluation (“performance, predictability, interpretability, corrigibility, safety and cybersecurity”) of a model’s output, which members consider as rational, though they pose extremely hard challenges for foundational model (FM) providers who lack knowledge of specific downstream applications. Furthermore, when it comes to downstream applications, there can be developers of those downstream applications who may or may not be the operator or user of the application. It is the operators of the downstream application that are responsible for the legal and ethical applications they envision or deploy. The task is even more difficult with generative AI models, given their outputs are derived from user-controlled inputs.
• No one-size-fits-all approach will address all the different uses of AI. Rather, there should be a multi-layered approach to governance, including representation from companies across industry and civil society through national regulations and industry standards, and via intergovernmental frameworks. Given the crossborder nature of the digital economy, AI regulatory frameworks and technical standards should ideally operate across nations and regions. Increased global alignment on AI regulation will help to facilitate the adoption, use, and interoperability of AI technologies across different jurisdictions. By taking coordinated and aligned approaches, regulators can encourage the adoption of measures that promote cross-border research and AI applications created in other countries.

The Canadian Chamber of Commerce and our members again thank the Government for the opportunity to comment on the proposed generative AI Code of Practice. We support the government’s proactive role in building trust in emerging technologies and welcome opportunities to convene industry for consultation on its impact on Canadian business. We would be happy to share further insights on the contexts and recommendations and greatly welcome the opportunity to speak further.