GRCLibrary.ai

Annex

Canada Public Sector GRC Requirements Annex

This annex is the Canada-specific public-sector carrier for the GRC library. It supplements the jurisdiction-neutral compliance/public-sector/annex-public-sector-requirements.md by organizing Canadian federal, provincial, territorial, municipal or local, contractor, health-information, financial-sector, and private-sector applicability boundaries.

Type
Annex
Version
0.0.28
Date
2026-10-27
Owner
Chief Compliance Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Compliance: Sector-Specific
Review frequency
Annual and upon material Canadian public-sector law, policy, directive, or guidance change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Applicability triggers
  • Applicability decision tree
  • Authority and force model
  • Domain cluster 1: federal AI governance and automated decision-making
  • Domain cluster 2: federally regulated financial institutions
  • Domain cluster 3: security, cloud, identity, records, incidents, and digital service
  • Domain cluster 4: federal access to information and privacy
  • Domain cluster 5: provincial and territorial access and privacy
  • Domain cluster 6: health-information privacy
  • Relationship to the Canadian AI and privacy annexes
  • Library gaps requiring additional documentation
  • Framework alignment
  • Limitations

Related documents