SCITUS: A Multi-Jurisdictional Framework for Adapting NIST AI RMF to the Canadian Regulatory Context
Computers and Society
Summary
The authors explain that Canadian organizations using AI face complicated rules from both the federal government and different provinces, without one clear law to follow. Since a key federal AI law was dropped, they created SCITUS, a system that adapts a well-known AI risk management framework to fit all these different Canadian rules at once. SCITUS includes a set of updated guidelines and controls that consider new AI challenges in Canada, and the authors show how it can be used in government, healthcare, and business settings. They suggest this approach is better than dealing with each region’s rules separately and could help other countries with similar legal divisions.
Authors
Mohammad Etemad
Abstract
Canadian organizations deploying artificial intelligence systems face a fragmented regulatory landscape spanning federal requirements (the Treasury Board Directive on Automated Decision-Making) and divergent provincial regulations across Ontario, Quebec, Alberta, Manitoba, and British Columbia. The death of Bill C-27 (Artificial Intelligence and Data Act) in January 2025 - and the federal government's June 2026 confirmation that it will pursue targeted instruments rather than omnibus AI legislation - leaves organizations without unified compliance guidance. Global frameworks such as NIST AI RMF 1.0, the EU AI Act, and ISO/IEC 42001 provide valuable guidance but lack systematic methodologies for adaptation to multi-jurisdictional national contexts. We present SCITUS (Systematic Canadian Integration for Trustworthy and Unified Standards), a comprehensive framework adapting NIST AI RMF 1.0 to Canadian federal and provincial AI regulations simultaneously. SCITUS integrates seven trustworthy-AI characteristics enhanced for Canadian requirements, four core governance functions, a novel multi-jurisdictional compliance mapping methodology, and a versioned control catalog that has evolved from 31 controls (v1.0, June 2025) to 57 controls (v2.0, July 2026) in response to regulatory developments - including Canada's first regulatory findings on generative-AI training data - and the documented 2026 agentic-AI threat landscape. We demonstrate applicability through scenarios spanning federal government, provincial healthcare, and the private sector, and argue that systematic adaptation of NIST AI RMF to multi-jurisdictional requirements offers significant advantages over jurisdiction-by-jurisdiction compliance and provides a replicable model for other federal systems.