Manitoba’s new AI and Cybersecurity Governance Act: Key takeaways for the public and private sectors

As provinces across Canada increasingly turn their attention to artificial intelligence governance, Manitoba has become the latest jurisdiction to act. While the Federal “AI for All” national strategy continues to be developed, Bill 51 represents one of the first provincial frameworks specifically addressing AI use in government operations and its implications extend beyond the public sector.

Manitoba has enacted Bill 51, The Public Sector Artificial Intelligence and Cybersecurity Governance Act, which establishes a regulatory framework for the transparent and accountable use of artificial intelligence systems and sets cybersecurity standards for public sector entities.

The Act is enabling legislation. Rather than imposing comprehensive requirements immediately, it leaves many substantive obligations to future regulations, directives and technical standards. The Act is not yet in force, and no proclamation date has been fixed, but it signals a clear direction for Manitoba’s public sector and organizations that work with government.

Who the Act applies to

The Act only applies to “public sector entities” including:

• The Manitoba government
• Government agencies as defined in The Financial Administration Act
• Any other reporting organization as defined in The Financial Administration Act
• Municipalities, incorporated communities established or continued under The Northern Affairs Act and local government districts

Private-sector businesses are not directly regulated by the Act. However, vendors and service providers that supply AI systems or cybersecurity services to government may face significant indirect impacts through procurement requirements, contractual obligations and new technical standards

The Act applies to artificial intelligence systems used by prescribed public sector entities that are:

• Publicly available
• Developed or procured by the public sector entity
• Developed by a third party on its behalf

An “artificial intelligence system” is defined as a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. The definition also includes systems prescribed by regulation, allowing the framework to account for changing technology.

What the Act does

The Act establishes a regulatory framework governing both artificial intelligence and cybersecurity. Regulations under either framework may be general or particular in their application, apply to one or more classes of public sector entities, and apply differently to different public sector entities or classes.

Artificial intelligence regulations

If required by regulation, a prescribed public sector entity using an artificial intelligence system must provide information to the public about that use, establish an accountability framework and manage associated risks. Prescribed public sector entities must also ensure that the system is used in accordance with the regulations and comply with the prescribed technical standards for that use.

The Lieutenant Governor in Council may make regulations governing:

• Disclosure requirements and exemptions
• Accountability frameworks, including roles and responsibilities, documentation, bias detection, impact and risk assessments, and mitigation measures
• Risk-management steps, including monitoring, reporting and recordkeeping
• Permitted and prohibited uses of AI systems
• Human oversight and additional disclosure in prescribed circumstances
• Procurement requirements, policies, procedures and contracts relating to AI systems

Cybersecurity regulations

Prescribed public sector entities must comply with prescribed cybersecurity requirements and technical standards. With the approval of the Lieutenant Governor in Council, the Minister may also issue a directive imposing requirements or standards on a specified entity that differ from those applicable to others.

The Lieutenant Governor in Council may make regulations governing:

• Which public sector entities must develop and implement cybersecurity programs
• Program requirements, including roles and responsibilities, progress reporting, education and awareness, incident response and recovery, and oversight
• Cybersecurity incident reporting, including form, frequency and requirements for different incidents
• Procurement requirements, policies, procedures and contracts relating to cybersecurity

Looking ahead

The Act leaves key operational questions to future regulations, including which entities and classes will face particular requirements, how routine or lower-risk AI uses will be treated, cybersecurity incident-reporting requirements, the role of independent oversight bodies and whether smaller municipalities will receive support.

Except in urgent circumstances, the Minister must provide an opportunity for public consultation before making regulations. Each regulation must also be evaluated for effectiveness within three years after coming into force. Public sector entities should use the consultation process to provide input on proposed requirements and their practical implications.

Although Manitoba has not indicated any timeline, approximately 18 to 24 months elapsed between Royal Assent of Ontario’s similar legislation and its first regulations. Meanwhile, public sector entities should monitor regulatory developments, while vendors serving them should prepare for potential changes to procurement processes and new contractual, technical and compliance requirements.

Practical steps

Public sector entities can prepare by:

• Taking stock of AI systems already in use, being purchased or under development, including features built into existing software
• Documenting how systems are used, the information they rely on and their role in decision-making
• Identifying higher risk uses, particularly those affecting individuals or involving sensitive information
• Assigning responsibility for AI approval, oversight, monitoring and escalation
• Documenting when and how employees review, correct or override AI-generated results
• Reviewing existing testing and monitoring practices for performance, accuracy, bias and other risks
• Assessing cybersecurity incident response, recovery and reporting procedures
• Reviewing vendor contracts to determine whether they adequately address data use, security, audit rights, incident reporting, subcontractors and changes to AI systems

Private-sector service providers can prepare by:

• Documenting their AI products and services, including intended uses, limitations, data flows, functionality, performance and potential risks
• Maintaining evidence of cybersecurity safeguards and incident-response capabilities
• Keeping records needed for future audit and reporting requirements
• Identifying subcontractors and other third parties involved in service delivery and reviewing applicable controls
• Preparing for termination and transition requirements, including data return or deletion

No penalties, but compliance still matters

Notably, the Act does not create offences, fines, administrative penalties or a formal inspection and enforcement regime. Its regulation-making powers also do not expressly authorize offences or monetary penalties.  This means enforcement will likely depend on governance, oversight and compliance mechanisms, such as audit requirements, reporting obligations and procurement conditions, rather than conventional statutory penalties.

The Act further provides that non-compliance does not, by itself, invalidate a policy, Act, regulation, directive, instrument or decision.  While this limits immediate legal consequences, organizations should not treat compliance as optional. Reputational risk, loss of government contracts and future regulatory tightening remain meaningful incentives for compliance.

The Act’s practical significance will ultimately depend on the regulations, directives and technical standards that follow. Organizations that begin preparing now will be better positioned when those requirements do take effect.

Other AI-related Manitoba legislation

Bill 51 is not the only recent Manitoba legislation addressing AI in the province. Recent amendments to The Business Practices Act (Manitoba) through Bill 49 which came into force on July 1, 2026, targets personalized algorithmic pricing in consumer transactions by treating certain uses of pricing algorithms as unfair business practices. Together, these Acts reflect Manitoba’s broader effort to establish governance guardrails for AI-driven systems across both the public and private sectors.

Our AI and Emerging Technology group sits at the cutting edge of these exciting times in technological innovation – feel free to reach out if you have any questions about how your business can successfully adopt AI tools while protecting itself from liability and usage issues.

Share