Artificial Intelligence (AI) decision-making process visibility, traceability and compliance governance

*Please note that the ISC website will be available on October 30th, 2026 as of 10:30am ET. This Challenge Notice is issued under the Innovative Solutions Canada Program (ISC) Call for Proposals 004 (EN578-24ISC4). For general ISC information,Offerors can visit the ISC website at: https://ised-isde.canada.ca/site/innovative-solutions-canada/en. Please refer to the Solicitation Documents Innovative Solutions Canada Program Call for Proposals – 004 - Tender Notice | Canada Buys https://canadabuys.canada.ca/en/tender-opportunities/tender-notice/cb-331-17030872 which contains the process for submitting a proposal.Steps to apply: Step 1: Read this challenge. Step 2:Read the Call for Proposals : https://canadabuys.canada.ca/en/tender-opportunities/tender-notice/cb-331-17030872 Step 3:Propose your solution here : https://ised-isde.canada.ca/app/scr/iscwp/web/challenge/bcd74ad7-1732-4e9e-998c-24833e0443d6#!/challenge/details Challenge title: Artificial Intelligence (AI) decision-making process visibility, traceability and compliance governance Challenge sponsor: Shared Services Canada (SSC)Funding Mechanism: ContractMAXIMUM CONTRACT VALUE: Multiple contracts could result from this Challenge. Phase 2: • The maximum funding available for any Phase 2 contract resulting from this Challenge is : $2,000,000.00 CAD excluding applicable taxes, shipping, travel and living expenses, as required. • The maximum duration for any Phase 2 contracts resulting from this Challenge is up to 20 months (excluding submission of the final report). • Estimated number of Phase 2contracts: 1 This disclosure is made in good faith and does not commit Canada to award any contract for the total approximate funding. Final decisions on the number of Phase 1 and Phase 2 (amend as applicable) awards will be made by Canada on the basis of factors such as evaluation results, departmental priorities and availability of funds. Canada reserves the right to make partial awards and to negotiate project scope changes.Note: Selected companies are eligible to receive one contract per phase per challenge.Travel: No travel required. Kick-off Meeting: All communication will take place by telephone or videoconference. Progress Review Meeting(s): Any progress review meetings will be conducted by telephone or videoconference.Final Review Meeting: All communication will take place by telephone or videoconference.Problem Statement: Challenge Statement Summary The Government of Canada (GoC) is committed to the responsible use of Artificial Intelligence (AI) compliant with its AI Strategy and Guiding Principles, see references noted in this challenge notice. The widespread adoption of AI technologies has created opportunities to enhance decision-making and improve service delivery within the GoC. In fostering the responsible usage of AI, the GoC has established an adoption strategy and guiding principles. To support adherence and implementation, the GoC is interested in testing solutions that provide visibility into AI decision-making processes, enhance the traceability of AI outputs, and ensure that AI models comply with Canadian laws and international standards and best practices. Despite the availability of AI governance solutions from Canadian companies and international providers, existing offerings typically require significant manual effort. This effort is particularly evident in interpreting evolving AI governance requirements, applying them to specific AI systems, updating controls and assessments, and identifying their ecosystem-wide impacts. The challenge seeks innovation to advance capabilities for identifying and incorporating evolving governance requirements, determining their potential impact on registered AI systems, associated controls, assessments, and evidence, and supporting timely reassessment, all while maintaining explainability, traceability, auditability, and human oversight.Details: Essential (mandatory) Outcomes The proposed solution must: 1. Support the continuous alignment of registered AI systems with relevant Canadian regulations, policies, directives, and other governance requirements and be able to identify potentially affected systems and indicate when a reassessment is required. 2. Demonstrate interoperability with enterprise systems, Artificial Intelligence (AI) and Machine Learning (ML) platforms and governance solutions and the solution can be integrated with minimal customization. 2A. Demonstrate the ability to exchange governance information with enterprise systems and AI/ML lifecycle tools through standards-based Application Programming Interfaces (APIs), connectors and interoperable data exchange mechanisms. Governance information may include AI system metadata, risk assessments, compliance findings, audit evidence, monitoring results, approvals and decision records.As an example: This governance information includes but is not limited to, information about the AI system, ownership, intent, deployment status, funding state, client information, system objectives, assessments, algorithmic impact assessment, control requirements (playbooks). 2B. Demonstrate how governance information can be collected, aggregated and maintained across multiple systems through APIs, connectors and data exchange mechanisms. 2C. Leverage open standards and documented interfaces to reduce dependency on proprietary technologies enabling interoperability across diverse enterprise environments. 3. Demonstrate how administrative, support and access to governance information and data can be restricted, monitored and controlled in accordance with the GoC requirements. 3A. Enable organizations to define and manage data residency requirements, retention, access and deletion of policies and information without vendor intervention. 4. Enable assessment and reassessment of registered AI systems applicable AI governance requirements, policies, standards, directives while supporting reassessment when governance requirements, assessment frameworks are added modified, replaced or retired. The solution must demonstrate the ability to translate AI governance requirements into traceable controls assess whether applicable controls have been satisfied and identify non-conformities. 4A. Enable authorized users to add, modify, version, replace or retire governance requirements and assessment frameworks to individual AI systems or groups. Demonstrate compliance assessment at minimum against the Policy on Service and Digital, Directive on Automated Decision-Making, Algorithmic Impact Assessment, AI Strategy and AI ethics and responsibilities. 4B. Demonstrate the ability to add, modify, version, replace and retire governance requirements, controls and assessment criteria, and assign them to individual AI systems or groups of AI systems. while supporting the application of different assessment criteria to different AI systems based on their intended use, risk profile or governance requirements Offerors are encouraged to prove extensibility to additional internationally recognized governance frameworks and standards, including the National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO) and the EU Act. 4C. Generate human-readable explanations of assessment and reassessment results. Each finding must identify the applicable requirement, evidence considered, assessment result and confidence score or a certainty measure. user. 4D. Collect, link, and retain assurance artefacts including control mapping, assessment records, evidence references, approvals, exceptions, attestations, remediation actions and audit histories. The system must identify whether each artifact was provided by an authorised individual [Role-Based Access Control (RBAC)]. 4E. Provide measurable results and clearly distinguish between results when performing a compliance assessments to determine whether compliance is met, partially met, not met, not applicable and unable to determine. 5. Allow for authorised reviewers to validate reject, modify or annotate findings and retain and audit log history for decisions. 6. Support the assessment and reassessment of risks associated with data, models and AI-generated outputs and incorporate the resulting information into governance assessments and assurance activities. 6A. Support assessment of data related risks and quality measures relevant to the registered AI system including the establishment of baseline measures and thresholds to maintain a traceable record of issues. 6B. Enable organizations to define, evaluate and reassess risk, performance and quality measures appropriate to a registered AI system. including configurable measures, thresholds, and evaluation criteria to maintain a traceable record of assessment outcomes. 6C. Support the evaluation and monitoring of AI-generated outputs against criteria appropriate to the system’s intended use and identified risks including accuracy, quality, fairness, consistency, safety, and alignment with defined operational requirements. Additional Outcomes The proposed solution should: 1. Support deployment in on-premises, private cloud, and Canadian-hosted cloud environments without requiring significant architectural modification. 2. Provide bilingual functionality, including user interfaces, documentation, reporting, and governance workflows, in both English an French. 3. Support multiple organizations, departments, or domains within a shared platform while enabling independent governance policies, controls, reporting, and oversight for each tenant. 4. Generate governance reports, alerts, and notifications and integrate with enterprise collaboration, communication, and ticketing/case management systems. Background and context As Shared Services Canada (SSC) expands the use of AI solutions, including generative and Agentic AI, there is a growing need for a consistent, centralized, and scalable approach to AI governance. Current governance activities may rely on separate processes, manual tracking, and fragmented documentation, which can limit real-time visibility into AI system inventories, risk posture, compliance status, policy alignment, and decision-making evidence.