Artificial Intelligence (AI) decision-making process visibility, traceability and compliance governance

From: Innovation, Science and Economic Development Canada

Shared Services Canada (SSC) is interested in solutions that provide visibility into AI decision-making processes, enhance the traceability of AI outputs, and ensure that AI models comply with the Federal Government's AI Strategy and its Guiding Principles.

Challenge sponsor:
Shared Services Canada (SSC)

Funding mechanism:
Contract

Opening date:
October 30, 2026

Closing date:
December 22, 2026 14:00 Eastern time

Propose a solution (login required)

Log in to view your submissions

Here are a few things you need to know before you get started on your application to this challenge:

  1. This challenge is only open to receive proposals for Phase 2 (prototype development).
  2. We recently made changes to the Challenge Stream, we have outlined the new parameters
  3. Read through the official solicitation documents
  4. To read the tender notice for this specific challenge, refer to Tender Notice | CanadaBuys

Challenge
 

Problem statement

The Government of Canada (GoC) is committed to the responsible use of Artificial Intelligence (AI) compliant with its AI Strategy and Guiding Principles, see references noted in this challenge notice.

The widespread adoption of AI technologies has created opportunities to enhance decision-making and improve service delivery within the GoC. In fostering the responsible usage of AI, the GoC has established an adoption strategy and guiding principles. To support adherence and implementation, the GoC is interested in testing solutions that provide visibility into AI decision-making processes, enhance the traceability of AI outputs, and ensure that AI models comply with Canadian laws and international standards and best practices.

Despite the availability of AI governance solutions from Canadian companies and international providers, existing offerings typically require significant manual effort. This effort is particularly evident in interpreting evolving AI governance requirements, applying them to specific AI systems, updating controls and assessments, and identifying their ecosystem-wide impacts.

The challenge seeks innovation to advance capabilities for identifying and incorporating evolving governance requirements, determining their potential impact on registered AI systems, associated controls, assessments, and evidence, and supporting timely reassessment, all while maintaining explainability, traceability, auditability, and human oversight.

Desired outcomes and considerations

Essential (mandatory) outcomes

The proposed solution must:

  1. Support the continuous alignment of registered AI systems with relevant Canadian regulations, policies, directives, and other governance requirements and be able to identify potentially affected systems and indicate when a reassessment is required.
  2. Demonstrate interoperability with enterprise systems, Artificial Intelligence (AI) and Machine Learning (ML) platforms and governance solutions and the solution can be integrated with minimal customization.
    1. Demonstrate the ability to exchange governance information with enterprise systems and AI/ML lifecycle tools through standards-based Application Programming Interfaces (APIs), connectors and interoperable data exchange mechanisms. Governance information may include AI system metadata, risk assessments, compliance findings, audit evidence, monitoring results, approvals and decision records. As an example: This governance information includes but is not limited to, information about the AI system, ownership, intent, deployment status, funding state, client information, system objectives, assessments, algorithmic impact assessment, control requirements (playbooks).
    2. Demonstrate how governance information can be collected, aggregated and maintained across multiple systems through APIs, connectors and data exchange mechanisms.
    3. Leverage open standards and documented interfaces to reduce dependency on proprietary technologies enabling interoperability across diverse enterprise environments.
  3. Demonstrate how administrative, support and access to governance information and data can be restricted, monitored and controlled in accordance with the GoC requirements.
    1. Enable organizations to define and manage data residency requirements, retention, access and deletion of policies and information without vendor intervention.
  4. Enable assessment and reassessment of registered AI systems applicable AI governance requirements, policies, standards, directives while supporting reassessment when governance requirements, assessment frameworks are added modified, replaced or retired. The solution must demonstrate the ability to translate AI governance requirements into traceable controls assess whether applicable controls have been satisfied and identify non-conformities.
    1. Enable authorized users to add, modify, version, replace or retire governance requirements and assessment frameworks to individual AI systems or groups. Demonstrate compliance assessment at minimum against the Policy on Service and Digital, Directive on Automated Decision-Making, Algorithmic Impact Assessment, AI Strategy and AI ethics and responsibilities.
    2. Demonstrate the ability to add, modify, version, replace and retire governance requirements, controls and assessment criteria, and assign them to individual AI systems or groups of AI systems. while supporting the application of different assessment criteria to different AI systems based on their intended use, risk profile or governance requirements Offerors are encouraged to prove extensibility to additional internationally recognized governance frameworks and standards, including the National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO) and the EU Act.
    3. Generate human-readable explanations of assessment and reassessment results. Each finding must identify the applicable requirement, evidence considered, assessment result and confidence score or a certainty measure. user.
    4. Collect, link, and retain assurance artefacts including control mapping, assessment records, evidence references, approvals, exceptions, attestations, remediation actions and audit histories. The system must identify whether each artifact was provided by an authorised individual (Role-Based Access Control (RBAC)).
    5. Provide measurable results and clearly distinguish between results when performing a compliance assessments to determine whether compliance is met, partially met, not met, not applicable and unable to determine.
  5. Allow for authorised reviewers to validate reject, modify or annotate findings and retain and audit log history for decisions.
  6. Support the assessment and reassessment of risks associated with data, models and AI-generated outputs and incorporate the resulting information into governance assessments and assurance activities.
    1. Support assessment of data related risks and quality measures relevant to the registered AI system including the establishment of baseline measures and thresholds to maintain a traceable record of issues.
    2. Enable organizations to define, evaluate and reassess risk, performance and quality measures appropriate to a registered AI system. including configurable measures, thresholds, and evaluation criteria to maintain a traceable record of assessment outcomes.
    3. Support the evaluation and monitoring of AI-generated outputs against criteria appropriate to the system's intended use and identified risks including accuracy, quality, fairness, consistency, safety, and alignment with defined operational requirements.

Additional outcomes

The proposed solution should:

  1. Support deployment in on-premises, private cloud, and Canadian-hosted cloud environments without requiring significant architectural modification.
  2. Provide bilingual functionality, including user interfaces, documentation, reporting, and governance workflows, in both English and French.
  3. Support multiple organizations, departments, or domains within a shared platform while enabling independent governance policies, controls, reporting, and oversight for each tenant.
  4. Generate governance reports, alerts, and notifications and integrate with enterprise collaboration, communication, and ticketing/case management systems.

Background and context

As SSC expands the use of AI solutions, including generative and Agentic AI, there is a growing need for a consistent, centralized, and scalable approach to AI governance. Current governance activities may rely on separate processes, manual tracking, and fragmented documentation, which can limit real-time visibility into AI system inventories, risk posture, compliance status, policy alignment, and decision-making evidence.

Maximum value and travel

Multiple contracts could result from this Challenge.

Phase 2

  • The maximum funding available for any Phase 2 contract resulting from this challenge is: $2,000,000.00 CAD excluding applicable taxes, shipping, travel and living expenses, as required
  • The maximum duration for any Phase 2 contract resulting from this challenge is up to 20 months (excluding submission of the final report)
  • Estimated number of Phase 2 contracts: 1-2

This disclosure is made in good faith and does not commit Canada to award any contract for the total approximate funding. Final decisions on the number of Phase 2 awards will be made by Canada on the basis of factors such as evaluation results, departmental priorities and availability of funds. Canada reserves the right to make partial awards and to negotiate project scope changes.

Note: Selected companies are eligible to receive one contract per phase per challenge.

Travel

No travel is anticipated or required.

Eligibility
 

Solution proposals can be submitted by a business that meets all of the following criteria:

  • for profit
  • incorporated in Canada (federally or provincially)
  • small and medium sized business with 499 or fewer full-time equivalent (FTE) employees**
  • research and development activities that take place in Canada
  • 50% or more of its annual wages, salaries and fees are currently paid to employees and contractors who spend the majority of their time working in CanadaFootnote **
  • 50% or more of its FTE employees have Canada as their ordinary place of workFootnote **
  • 50% or more of its senior executives (Vice President and above) have Canada as their principal residenceFootnote **

Evaluation criteria
 

The official source of the Evaluation Criteria for this challenge is the Government Electronic Tendering System (CanadaBuys).

In the event of a discrepancy between the information below and the information published on CanadaBuys, CanadaBuys will take precedence.

Phase 2

The Applicant (offeror) must complete the Challenge Stream Submission Form with a degree of information sufficient to enable Canada's assessment of the proposal against the criteria and the Evaluation Schema. The information must demonstrate how the proposal meets the criterion.

Part 1: Phase 2 - Mandatory Criteria

Proposals must meet all Mandatory Criteria identified by achieving a "Pass" in order to proceed to Part 2. Proposals that do not meet all Mandatory Criteria will be deemed non-responsive and given no further consideration.

Mandatory Criteria

(Applicant's proposal must address)

Question 1 a: Phase 2 Scope

Describe the proposed innovation and demonstrate how it responds to the challenge. Include in your description the scientific and technological basis upon which the solution is proposed and clearly demonstrate how the solution meets all of the Essential Outcomes in the Desired Outcomes section in the Challenge Notice.

Question 1 a: Evaluation Schema (Mandatory – Pass/Fail)
Pass

The proposed solution is within the scope for the challenge, and clearly addresses all Essential Outcomes identified in the Challenge.

Fail

The proposed solution is articulated as out of scope for the challenge.

or

The proposal does not clearly demonstrate how the proposed solution addresses all Essential Outcomes identified in the challenge.

or

The proposed solution is poorly described and does not permit concrete analysis.

or

There is little to no scientific and/or technological evidence that the proposed solution is likely to meet all Essential Outcomes.

Question 2: Proof of Feasibility and Current Technology Readiness Level (TRL)
  1. Indicate the current TRL of the proposed solution. (Drop Down Menu of the Challenge Stream Submission Form)
  2. Describe the research and development activities that have taken place to prove the solution's feasibility and bring the proposed solution to the stated TRL.
    This section must include :
    • A description of the method of research;
    • The solution objectives and an analysis of the results proving the feasibility of the solution;
    • Data proving the solution's feasibility;
    • Evidence to demonstrate the highest level of validation conducted (e.g., activities such as paper studies, analytic studies, components that are not yet integrated or representative, integration of "ad hoc" hardware in the laboratory, laboratory test, simulated environment, field testing, debugging, etc.);
    • The type of environment(s) in which this was done and by whom, including title.
Question 2: Evaluation Schema (Mandatory – Pass/Fail)
Pass:

The Applicant (offeror) has demonstrated that the proposed solution is currently between TRL 5 to 9 (inclusive), and provided justification by explaining the research and development (R&D) that has taken place to bring the solution to the stated TRL, proving the solution's feasibility.

and

The Applicant (offeror) has demonstrated the research and development activities that have taken place to prove the solution's feasibility and bring the proposed solution to the stated TRL.

Fail:

The Applicant (offeror) has not provided sufficient evidence to demonstrate that the current TRL is between 5 to 9 (inclusive) including one or more of the following:

  1. There is insufficient/no evidence provided for TRL judgment and/or to prove the solution's feasibility.
  2. The solution involves the development of basic or fundamental research.
  3. The solution is demonstrated at TRL 4 or lower.
  4. The solution is demonstrated at higher than TRL 9.
  5. Insufficient/unclear/no justification explaining the R&D that took place to bring the solution to the stated TRL.
  6. The explanation simply paraphrases the description of a given TRL level and only provides a vague description and overview of the R&D completed.
Question 3a: Innovation

Demonstrate how the proposed solution meets one or more of the ISC definitions of innovation below:

  1. An inventionFootnote *, new technology or new process that is not currently available in the marketplace.
  2. Significant modifications to the application of existing technologies/components/processes that are applied in a setting or condition for which current applications are not possible or feasible.
  3. An improvement in functionality, cost or performance over an existing technology/process that is considered state-of-the-art or the current industry best practice.
Question 3a: Evaluation Schema (Mandatory – Pass/Fail)
Pass:

The proposed solution meets one or more of the ISC definitions of innovation.

Fail:
  • The proposed solution does not meet any of the ISC definitions of innovation

    or
     
  • The proposed solution is an incremental improvement, "good engineering", or a technology that would go ahead in the normal course of product development (i.e. the next version or release).
Question 3b: Advance on State of the Art

Describe in detail the competitive advantages and level of advancement over existing technologies. Where appropriate, name existing technologies as well as potential substitutes or competitors.

To demonstrate this, the proposal must include the following information:

  • Improvements (minor or major) over existing technologies or substitutes. Use direct comparison.
  • How the proposed innovation will create competitive advantages in existing market niches or market spaces.
Question 3b: Evaluation Schema (Mandatory Criteria – Pass/Fail + Points)
0 points/Fail:
  • The Applicant (offeror) has not demonstrated that the proposed solution advances the state-of-the-art over existing technologies, including available competing solutions; or
  • The proposed solution improves minimally upon the current state of the art, though not sufficiently enough to create competitive advantages in existing market niches; or
  • The stated advancements are described in general terms but are not substantiated with specific, measurable evidence.
5 points/Pass:
  • The Applicant (offeror) has demonstrated that the proposed solution offers one or two minor improvements to existing technologies, including available competing solutions that have potential to create competitive advantages in existing market niches.
12 points/Pass:
  • The Applicant (offeror) has demonstrated that the proposed solution offers three or more minor improvements to existing technologies, including available competing solutions, that together are likely to create competitive advantages in existing market niches

    or
     
  • The Applicant (offeror) has demonstrated that the proposed solution offers one significant improvement to existing technologies that is likely to create competitive advantages in existing market niches.
20 points/Pass:
  • The Applicant (offeror) has demonstrated that the proposed solution offers two or more significant improvements to existing technologies, including available competing solutions that are likely to create competitive advantages in existing market niches and could define new market spaces

    or
     
  • The Applicant (offeror) has demonstrated that the proposed solution can be considered a new benchmark of state of the art that is clearly ahead of competitors and that is likely to define new market spaces.

Part 2: Phase 2 - Point-Rated Criteria

Proposals must meet the overall minimum pass mark of 65 of 130 possible total points (50%) to be deemed responsive. Proposals that do not achieve the minimum pass mark will be declared non-responsive and given no further consideration.

Point-Rated Criteria

(Applicant's proposal to address)

Question 1b: Scope

Demonstrate the scientific and technological basis of how the proposed solution addresses the Additional Outcomes (if identified) in the Desired Outcomes section in the Challenge Notice. If no Additional Outcomes are identified in the Challenge Notice, text entered in this section will not be considered.

If no Additional Outcomes are identified in the Challenge Notice, Applicants (offerors) will receive 10 points.

Question 1b: Evaluation Schema (Point-Rated)
  1. Insufficient or no information provided to demonstrate that the solution will address any of the Additional Outcomes. 0 points
  2. Information provided demonstrates that the solution will address some (<50%) of the Additional Outcomes. 3 points
  3. Information provided demonstrates that the solution will address most (50% or more) of the Additional Outcomes. 6 points
  4. Information provided demonstrates that the solution will address all (100%) of the Additional Outcomes. 10 points
Question 4: Phase 2 Science and Technology Risks

Identify potential scientific and/or technological risks to the prototype development and describe how they will be mitigated in Phase 2.

Question 4: Evaluation Schema (Point-Rated)
  1. Information is insufficient or no information provided to demonstrate that the Applicant (offeror) has identified potential risks and described associated mitigation strategies or information provided contains significant gaps in risks and/or associated mitigation strategies. 0 points
  2. Information provided demonstrates that the Applicant (offeror) has identified potential risks and described associated mitigation strategies but there are minor gaps in risks and/or associated mitigation strategies. 5 points
  3. Information provided demonstrates that the Applicant (offeror) has identified the potential risks and described associated mitigation strategies. 10 points
Question 5: Phase 2 Project Risks

Identify potential project risks to the prototype development and describe how they will be mitigated in Phase 2.

Applicants (offerors) should address the following risks:

  • Human Resources
  • Financial
  • Project Management
  • Intellectual Property
  • Material availability
  • Supply chain issues

Note to Applicants: S&T risks should not be included in this section. Question 4 addresses S&T risks.

Question 5: Evaluation Schema (Point-Rated)
  1. Information is insufficient or no information provided to demonstrate that the Applicant (offeror) has identified potential risks and described associated mitigation strategies or information provided contains significant gaps in risks and/or associated mitigation strategies. 0 points
  2. Information provided demonstrates that the Applicants (offerors) has identified potential risks and described associated mitigation strategies but there are minor gaps in risks and/or associated mitigation strategies. 5 points
  3. Information provided demonstrates that the Applicants (offerors) has identified the potential risks and described associated mitigation strategies. 10 points
Question 6: Phase 2 Project Plan

Demonstrate a feasible Phase 2 project plan by completing the table in the Proposal Submission Form.

  • Indicate if any milestones and activities will be completed concurrently;
  • Indicate the estimated exit TRL at the completion of Phase 2. (Drop Down Menu of the Challenge Stream Submission Form)
Question 6: Evaluation Schema (Point-Rated)
  1. Insufficient or no information provided to demonstrate a feasible project plan for Phase 2 and/or the project plan exceeds the maximum duration indicated in the Challenge Notice. 0 points
  2. Information is feasible for the Phase 2 project plan but not clearly demonstrated and/or includes gaps. 10 points
  3. information provided demonstrates a feasible project plan for Phase 2. 20 points
Question 7: Phase 2 Implementation Team

Demonstrate how your project implementation team has the required management and technological skill sets and experience to deliver the project plan for Phase 2 by completing the table provided.

Question 7: Evaluation Schema (Point-Rated)
  1. Insufficient or no information provided to demonstrate that the project team has the required management and technological skill sets and experience to deliver the Phase 2 project plan. 0 points
  2. Information is provided but there are minor gaps in required management and/or technological skill sets and/or experience to deliver the Phase 2 project plan. 10 points
  3. Information provided clearly demonstrates that the project team has the required management and technological skill sets and experience to deliver the Phase 2 project plan. 20 points
Question 8: Inclusivity

A key objective of the Innovative Solutions Canada program is to increase the participation of under-represented groups in the research and development of the proposed solution.

Applicants (offerors) should describe the policies, strategies, and/or procedures (e.g. recruitment strategy, internships, co-op placements, or other initiatives) that they currently have in place or would put in place to support the R&D effort in Phase 2 including an overview of the group(s); and which specific under-represented groups (women, youth, persons with disabilities, Indigenous people, visible minorities, 2SLGBTQI+ community, etc.).

Note: Do not provide any personal information of senior officials, individuals employed by your company or that of your subcontractors in the response below.

Question 8: Evaluation Schema (Point-Rated)
  1. No description and/or concrete examples of actions provided that  would be taken to encourage greater participation of under-represented groups. 0 points
  2. A description and concrete examples of actions to encourage greater participation of under-represented groups provided. 10 points
  3. If the Applicant (offeror) is registered on the Indigenous Business Directory, Modern Treaty or Comprehensive Land Claim Agreement (CLCA) business list/directory, please provide this information as part of this criterion as registered Indigenous Businesses will receive the maximum score for Question 8: Inclusivity.20 points
Question 9: Phase 2 Financial Controls, Tracking and Oversight

Describe the financial controls, tracking and oversight that will be used to manage the funds throughout Phase 2. Applicants (offerors) should indicate if an individual or firm will be managing the funds and provide their credentials and/or relevant experience.

A good financial control in R&D refers to effective management and oversight of financial resources allocated to R&D activities, with the goal of maximising the return on investment and ensuring funds are used efficiently and effectively.

For example, this section could include (but not limited to):

  • Establishing clear budgets and financial plan
  • Regular monitoring
  • Developing systems for tracking and recording costs (salaries, equipment and supplies, overhead expenses, etc.)
  • Providing accurate and timely financial reports (including actual and projected costs) to stakeholders such as management, funders or researchers
  • Ensuring compliance with relevant financial regulations, policies and procedures
Question 9: Evaluation Schema (Point-Rated)
  1. Insufficient or no information provided to demonstrate the Applicant's ability to manage funds in Phase 2. 0 points
  2. Information provided is vague and/or contains gaps. The Applicant (offeror) has some financial controls, tracking and/or oversight in place to manage the funds in Phase 2. 5 points
  3. Information provided demonstrates that the Applicant (offeror) has financial controls, tracking and oversight to manage funds in Phase 2. 10 points
Question 10: Commercialization Strategy

Explain your plan to commercialize the solution after Phase 2 into the commercial marketplace and/or ISC's Pathway to commercialization.

Applicants (offerors) should address the following:

  • Any previous experience and record in commercialization (e.g., sales; marketing; IP protection; demographic/target market analysis; manufacturing; technology commercialization);
  • Additional funding commitments from private and/or non-ISC funding sources;
  • Previous investments secured outside of the ISC program.

Note: Information on the Innovative Solutions Canada Pathway to commercialization process can be found on the program's website.

Question 10: Evaluation Schema (Point-Rated)
  1. Insufficient or no information provided to demonstrate that the Applicant (offeror) has planned a realistic strategy for commercialization. 0 points
  2. Information provided demonstrates a conceivably realistic strategy for commercialization, however there are gaps and/or elements of the strategy is vague. 5 points
  3. Information provided demonstrates that the Applicant (offeror) has a clear, comprehensive and realistic strategy. 10 points

Questions and answers

Offerors are invited to refer to the tender notice for this specific challenge at: Tender Notice | CanadaBuys

All enquiries must be submitted in writing to the Contracting Authority at TPSGC.PASIC-APISC.PWGSC@tpsgc-pwgsc.gc.ca no later than (10) ten calendar days before the Challenge Notice closing date. Enquiries received after that time may not be answered.

Responses to enquiries will be published through an amendment to the Challenge Notice on CanadaBuys. It is the responsibility of Offerors to monitor CanadaBuys regularly for updates throughout the solicitation period.

A glossary is also available.

 Report a problem
Date modified: