Starter checklists, not official guidance or legal advice. Each list is derived from the sources cited under it. Your service's policy, privacy office and legal counsel decide what applies to you.
Before a service pilots or adopts an AI tool
Based on the headings of the joint privacy guidance and the Toronto Police Service Board policy. [Joint guidance, May 2022] [TPSB policy]
- Is there lawful authority for this specific use, and who has confirmed it?
- Is the use necessary and proportionate? Is there a specific reason, based on evidence, rather than a general belief that it is useful?
- Has a privacy impact assessment been done, and is there a plan to monitor and re-assess after launch?
- Has accuracy been tested, including for bias, before use?
- Who is accountable inside the service, and who is accountable for the vendor?
- Have officers been trained, and do they know what they remain responsible for?
- What data is collected, for what purpose, how long is it kept, and how is it secured?
- Will use be disclosed to the public, and to the Crown where it may influence charges?
- Is there board or oversight review, and has the public been engaged in proportion to the risk?
Questions for a vendor
Derived from the same sources, with the Clearview lesson in mind: a public body cannot collect personal information from a third party that collected it unlawfully. [OPC, 2021]
- Where did the training data and any reference database come from, and was it collected lawfully in Canada?
- What independent testing exists for accuracy and for differences across groups?
- Where is our data stored and processed, who can access it, and is it used to train the vendor's models?
- What logs and audit records exist, and can we produce them for a court, a board or a privacy commissioner?
- Can outputs be traced to source material so a user can verify them?
- What happens to our data and records if we stop using the product?
- Which of these answers can we put in writing in the contract?
Supervisor review of an AI-assisted report
Adapted from a Police1 article for supervisors. It describes a report as "a credibility document" because it is the foundation for a prosecution, suppression hearing or civil case. [Police1]
- Does the narrative match the CAD times, body-camera footage and physical evidence?
- Does it contain specific, observable facts, or generic conclusions such as "the subject was evasive"?
- Has the writing style changed suddenly from the officer's usual work? If so, ask the officer to explain the incident in their own words.
- Does the report read more tidily than a real scene usually does?
- Is the approved tool and the permitted data defined in policy, and did the officer follow it?
- Has the officer read every line and can they stand behind every word?
Before an individual uses an AI tool
The Police1 article advises services to define approved tools and what data can or cannot be entered, and to say clearly if AI-assisted writing is not allowed. [Police1]
- Is this tool approved by my service for this task?
- What information am I allowed to enter, and what is off limits?
- Who reviews my work, and do I know what I must disclose?
- If I am unsure, have I asked my supervisor or privacy office before using it?