Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces SCITUS, a framework designed to adapt the NIST AI Risk Management Framework (RMF) to the complex regulatory landscape of Canada, which includes both federal and provincial AI regulations. By integrating seven trustworthy-AI characteristics and employing a novel compliance mapping methodology, SCITUS addresses the lack of unified compliance guidance following the stalled Bill C-27 and evolving regulatory requirements. The framework's iterative control catalog, which has expanded from 31 to 57 controls in response to regulatory changes, demonstrates its practical applicability across various sectors, including government and healthcare.
SCITUS reveals a systematic approach to unify fragmented AI regulations in Canada, offering a replicable model for compliance that could transform regulatory practices.
Canadian organizations deploying artificial intelligence systems face a fragmented regulatory landscape spanning federal requirements (the Treasury Board Directive on Automated Decision-Making) and divergent provincial regulations across Ontario, Quebec, Alberta, Manitoba, and British Columbia. The death of Bill C-27 (Artificial Intelligence and Data Act) in January 2025 - and the federal government's June 2026 confirmation that it will pursue targeted instruments rather than omnibus AI legislation - leaves organizations without unified compliance guidance. Global frameworks such as NIST AI RMF 1.0, the EU AI Act, and ISO/IEC 42001 provide valuable guidance but lack systematic methodologies for adaptation to multi-jurisdictional national contexts. We present SCITUS (Systematic Canadian Integration for Trustworthy and Unified Standards), a comprehensive framework adapting NIST AI RMF 1.0 to Canadian federal and provincial AI regulations simultaneously. SCITUS integrates seven trustworthy-AI characteristics enhanced for Canadian requirements, four core governance functions, a novel multi-jurisdictional compliance mapping methodology, and a versioned control catalog that has evolved from 31 controls (v1.0, June 2025) to 57 controls (v2.0, July 2026) in response to regulatory developments - including Canada's first regulatory findings on generative-AI training data - and the documented 2026 agentic-AI threat landscape. We demonstrate applicability through scenarios spanning federal government, provincial healthcare, and the private sector, and argue that systematic adaptation of NIST AI RMF to multi-jurisdictional requirements offers significant advantages over jurisdiction-by-jurisdiction compliance and provides a replicable model for other federal systems.