Manitoba’s Public Sector Artificial Intelligence And Cybersecurity Governance Act: What Public Sector Organizations Need To Know

Note: The full picture of AI regulation in Manitoba is not clear as of yet. Even with this new legislation on the horizon, as will be seen below, there is still much work to be done by legislators before we are aware of all the rights, responsibilities and liabilities that Manitobans will face with a new regulatory regime. We will continue to update with new articles as new developments occur.

Overview

Manitoba has enacted The Public Sector Artificial Intelligence and Cybersecurity Governance Act, S.M. 2026, c. 43. The Act establishes a framework for regulating:

• the use of artificial intelligence systems by public sector organizations; and
• cybersecurity standards and practices within the public sector.

The Act is largely framework legislation. Many of its substantive obligations will apply only when regulations are made identifying the affected public sector entities, activities, systems, requirements and technical standards.

The Act comes into force on a date to be fixed by proclamation. The Act itself does not identify that date and, as of the date of publication, no proclamation has occurred.

Let’s address a few questions…

What is the purpose of the Act?

The stated purpose of the Act is to establish a regulatory framework that:

• governs the use of artificial intelligence systems in a transparent and accountable manner; and
• establishes cybersecurity standards.

The Act reflects the Legislature’s recognition that artificial intelligence may be used in public-service delivery and administrative decision-making, while creating risks involving misuse, inequitable impacts, privacy, accountability and cybersecurity.

Who may be subject to the Act?

The Act applies only to prescribed public sector entities. This means that an organization falling within the general definition of “public sector entity” is not necessarily subject to every requirement immediately. The organization, or its class of organizations, must be designated by regulation for the relevant provision.

The definition of “public sector entity” includes:

• the Government of Manitoba;
• a government agency as defined in The Financial Administration Act;
• another reporting organization as defined in The Financial Administration Act;
• a municipality;
• an incorporated community established or continued under The Northern Affairs Act; and
• a local government district.

Depending on the definitions incorporated from The Financial Administration Act, the framework may potentially extend to a broad range of public bodies. However, the Act leaves the actual designation of affected entities to regulations. The way in which the regulations may apply may be specific, general, provide grouping, or another form of classification.

What artificial intelligence systems are covered?

An “artificial intelligence system” is defined as a machine-based system that, for explicit or implicit objectives, infers from its inputs how to generate outputs such as:

• predictions;
• content;
• recommendations; or
• decisions

that may influence physical or virtual environments. Additional systems may also be added by regulation.

For a prescribed public sector entity, the Act may apply to an artificial intelligence system that is:

• publicly available;
• developed or procured by the entity; or
• developed by a third party on behalf of the entity.

The legislation therefore contemplates both internally developed systems and systems obtained from external vendors.

What obligations may arise concerning artificial intelligence?

The principal artificial intelligence obligations are set out in sections 4 to 6 of the Act, many of the details depend on future regulations.

Public transparency

When required by regulation, a prescribed public sector entity using an artificial intelligence system must provide information to the public about its use of the system.

Regulations may determine:

• what information must be provided;
• who must receive the information;
• what information need not be disclosed;
• when information must be provided or updated;
• how the information must be communicated;
• whether it must be presented clearly and understandably; and
• whether exemptions apply in specified circumstances.

Accountability frameworks

When required by regulation, an entity must develop and implement an accountability framework governing its use of artificial intelligence.

Regulations may address:

• the form and content of the framework;
• when it must be developed and updated;
• the responsibilities of designated individuals;
• documentation throughout different phases of a system’s use;
• system performance and monitoring;
• testing for bias and discriminatory impacts;
• impact and risk assessments; and
• mitigation measures.

Risk management

When required by regulation, an entity must take steps to manage risks associated with its use of an artificial intelligence system.

The regulations may require monitoring, reporting, recordkeeping and other risk-management measures.

Compliance with permitted-use requirements

An entity must use an artificial intelligence system in accordance with applicable regulations.

Regulations may restrict a system to specified purposes or impose other conditions on its use.

Prohibited uses

A prescribed public sector entity must not use an artificial intelligence system for a use or purpose prohibited by regulation.

The regulation-making authority expressly permits the government to prohibit particular uses of artificial intelligence, including uses involving the production of artistic or creative material.

Human oversight and additional information

In circumstances prescribed by regulation, an entity must ensure that an individual:

• oversees the use of the artificial intelligence system in accordance with the regulations; and
• provides additional information about the system’s use.

Regulations may also require information explaining how a person can make inquiries to the entity about its use of artificial intelligence.

Technical standards

A prescribed public sector entity using artificial intelligence must comply with any technical standards prescribed for that use.

The minister may make regulations identifying the entities subject to those standards and establishing the applicable technical requirements.

What cybersecurity obligations may arise?

The Act creates a separate regulatory framework for cybersecurity.

“Cybersecurity” is broadly defined to include the security, continuity, confidentiality, integrity and availability of digital information and the infrastructure used to store or transmit it. The definition also includes technologies, processes, practices, response measures and mitigation measures intended to protect networks, computers, programs and information from attack, damage or unauthorized access.

Compliance with cybersecurity requirements

A prescribed public sector entity must comply with cybersecurity requirements established by regulation.

Compliance with technical standards

A prescribed public sector entity must comply with prescribed technical cybersecurity standards.

The minister may make regulations identifying which entities are subject to the technical standards to be determined.

Ministerial directives

With the approval of the Lieutenant Governor in Council, the minister may issue a cybersecurity directive to a specific prescribed public sector entity concerning:

• cybersecurity requirements; and
• technical standards.

A directive:

• applies only to the entity identified in it;
• may establish requirements or standards different from those applying to another entity; and
• must be followed by the entity to which it is issued.

The minister must make the directive publicly available in the manner the minister considers appropriate.

What cybersecurity matters may be addressed by regulation?

The regulations may require designated public sector entities to develop and implement cybersecurity programs.

Those programs may be required to address:

• internal roles and responsibilities;
• progress reporting;
• cybersecurity education and awareness;
• incident response;
• recovery following cybersecurity incidents; and
• oversight of the cybersecurity program.

Regulations may also require entities to report cybersecurity incidents to the minister or another designated individual. Different reporting requirements may be established for different kinds of incidents.

The regulations may prescribe the form and frequency of incident reports.

How may the Act affect procurement and third-party contracts?

The Act permits regulations governing procurement requirements, policies and procedures for services relating to:

• artificial intelligence systems; and

Public sector entities should therefore anticipate that future regulations may affect:

• vendor selection;
• requests for proposals;
• contractual risk allocation;
• data governance;
• audit and reporting rights;
• technical specifications;
• incident response obligations;
• subcontracting;
• system monitoring; and
• contract termination rights.

The precise contractual requirements will depend on the regulations.

May external technical standards be incorporated?

Yes. Regulations may adopt all or part of a code or standard created by another government or a non-governmental organization.

A code or standard may be adopted as amended from time to time and may be subject to changes considered necessary by the regulation-maker.

This means regulated entities may eventually be required to comply with technical standards developed outside the Manitoba government.

Will there be public consultation?

Except where the minister considers the circumstances urgent, the minister must provide an opportunity for public consultation before a regulation is made. The minister must seek public advice and recommendations concerning the proposed regulation.

The minister must also arrange for a report evaluating the effectiveness of a regulation within three years after the regulation comes into force.

The report must be tabled in the Legislative Assembly within the first 15 sitting days after the minister receives it.

Does the Act create offences or fines?

The Act, as enacted, does not contain an offence provision, a prosecution provision or a schedule of fines or administrative monetary penalties.

It does not specify:

• fines for non-compliance;
• imprisonment;
• administrative monetary penalties;
• director or officer liability;
• limitation periods for prosecutions; or
• a statutory enforcement or inspection process.

Although prescribed public sector entities must comply with applicable regulations, technical standards and ministerial directives, the Act itself does not establish a specific monetary penalty for failing to do so.

Regulations made under the Act will form part of the Act because a reference to “this Act” includes the regulations. However, the regulation-making powers do not expressly identify a power to create offences or fines.

Does non-compliance invalidate a public decision?

No. The Act expressly provides that a failure to comply with the Act or a directive issued under it does not affect the validity of any:

• policy;
• Act;
• regulation;
• directive;
• instrument; or

Accordingly, non-compliance with the Act does not, by itself, invalidate an administrative decision or other government action.

What happens if the Act conflicts with another law?

If a provision of the Act conflicts with another enactment, the other enactment prevails.

The Act therefore operates subject to other Manitoba legislation, including legislation governing privacy, access to information, health information, public administration and sector-specific decision-making.

Practical steps for public sector entities

Although the detailed legal requirements will depend on proclamation and regulations, potentially affected organizations should consider preparing by:

1. identifying all artificial intelligence systems currently used, procured or being developed;
2. documenting the purposes for which each system is used;
3. identifying systems that generate recommendations, content, predictions or decisions;
4. reviewing vendor contracts and procurement practices;
5. assigning internal responsibility for artificial intelligence governance;
6. reviewing existing cybersecurity programs and incident-response procedures;
7. documenting human oversight of automated systems;
8. assessing existing risk, impact, bias-testing and monitoring processes; and
9. monitoring the publication of regulations and ministerial directives.

These steps are not themselves expressly mandated by the Act unless required by regulation, but they correspond to the subjects that regulations may address.

Key takeaway

The Act creates the legal architecture for regulating artificial intelligence and cybersecurity across Manitoba’s public sector, but many substantive requirements will depend on future regulations.

The most important questions for any organization will be:

• Is the organization prescribed as a public sector entity for the relevant provision?
• Is the artificial intelligence system or cybersecurity activity covered?
• What transparency, accountability, risk-management, reporting or technical requirements have been prescribed?
• Has the minister issued an entity-specific cybersecurity directive?

Organizations within the public sector should monitor the Act’s proclamation, the enactment of regulations and the publication of any ministerial directives.