Operationalizing the Gen-AI Voluntary Code of Conduct for Canadian Critical Infrastructure Entities

This document operationalises Canada's voluntary approach to generative-AI governance for critical infrastructure. It recognises that AI may enter infrastructure intentionally or through existing IT and operational-technology products, where failure may affect public safety, essential services, communications, transportation, energy, financial systems, digital infrastructure and national resilience. It uses the NIST-style GOVERN, MAP, MEASURE and MANAGE structure and is broad and non-prescriptive rather than a mandatory checklist.

It connects AI governance with the heightened safety, security and resilience consequences of critical-infrastructure environments.

Use it for critical-infrastructure AI governance, organisational accountability, use-case and dependency mapping, risk measurement, continuous mitigation, incident response, operational technology, supply-chain controls and resilience.

Canadian critical-infrastructure owners, operators and related stakeholders, including suppliers of AI-enabled products or services into critical-infrastructure environments.

CURRENT VOLUNTARY GUIDANCE.

Introduction & Purpose → AI Risk Governance Framework → GOVERN → MAP → MEASURE → MANAGE → AI Incident/Risk Controls → Critical-Infrastructure Application.