By Martin U. Wissmath and Cameron A. Axford

Basic Principles for Developing a Responsible AI Policy in a Rapidly Evolving Legal Landscape

An effective Artificial Intelligence (“AI”) legal policy is essential for Canadian charities and not-for-profits (NFPs) as they increasingly use AI technologies to enhance fundraising, manage stakeholder relationships, and streamline operations. Given the sensitive nature of personal data collected by charities and NFPs, compliance with applicable privacy laws and best practices is critical to safeguarding the trust of members and donors. Moreover, AI policies help organizations proactively address ethical considerations, prevent algorithmic bias, and ensure transparent data practices, aligning with Canada’s human rights standards and promoting fairness. As the proposed Artificial Intelligence and Data Act (AIDA — still in debate in Parliament and not yet in force) could introduce new regulatory requirements, having a robust AI policy helps organizations proactively navigate legal obligations, manage reputational risks, and leverage AI responsibly to support their missions and activities.

A comprehensive AI legal policy for Canadian organizations should begin with data privacy and protection measures, detailing guidelines for personal data handling. This includes securing clear consent, purpose-specific data collection, and minimizing data retention. Strong cybersecurity protocols, such as encryption and access controls, are essential to guard against unauthorized access and data breaches, especially for sensitive information. Transparency about data use is also critical, as organizations must inform individuals about how their data is used, stored, and shared, especially when AI informs decision-making processes. 

Ensuring fairness and mitigating bias is equally important. Organizations should implement AI systems with anti-discrimination measures in mind, regularly auditing them to detect and correct biases that could infringe on human rights or breach Canadian anti-discrimination laws. Regular algorithmic impact assessments should be conducted to identify biases in data or models that might lead to unfair outcomes.

The policy should prioritize transparency, supported by clear documentation of AI models, data sources, and decision-making criteria to help stakeholders understand the impact of AI. For high-stakes applications, AI decisions should be explainable in plain language so individuals affected can comprehend and, if needed, challenge AI-driven conclusions. Risk management and accountability structures are also necessary. Organizations should define roles for AI oversight, ensuring compliance with legal and ethical standards, and establish risk assessment processes to address potential harms. Meeting standards set out in AIDA will also be required, should it become law, or successor legislation, particularly for high-risk AI systems requiring enhanced transparency and record-keeping.

Regular internal audits can verify policy adherence. A feedback system allows stakeholders to raise concerns and suggest improvements. An ethics framework focused on human-centered values and incorporating human-in-the-loop mechanisms for critical AI decisions can provide accountability and address biases. Finally, the policy should include provisions for ongoing legal compliance and regular updates, maintaining alignment with evolving regulations like AIDA, and, where applicable, engage relevant international standards such as the European Union’s Artificial Intelligence Act for organizations operating across borders.

These elements will assist charities and NFPs to deploy AI responsibly, minimize legal risk and promote trust among stakeholders. With the ongoing development of AI regulations in Canada and around the world, policies must remain flexible, with regular review and updates, to adapt to new standards and emerging best practices. Charities and NFPs should work with their legal counsel to assist in crafting their AI policies to effectively manage legal risks, establish clear accountability, and maintain ethical standards that align with both legal obligations and organizational values.

​Read the October 2024 Charity & NFP Law Update