SCITUS: A Multi-Jurisdictional Framework for Adapting NIST AI RMF to the Canadian Regulatory Context

Canada's fragmented AI regulatory landscape requires customized compliance approaches: With the failure of Bill C-27 and the federal government's shift toward targeted instruments rather than comprehensive legislation, Canadian organizations must navigate multiple overlapping requirements across federal and provincial jurisdictions (Ontario, Quebec, Alberta, Manitoba, and British Columbia) without unified guidance.

NIST AI RMF can be systematically adapted for multi-jurisdictional contexts: SCITUS demonstrates that global frameworks like NIST AI RMF 1.0 can be methodically tailored to specific national regulatory environments through a novel compliance mapping methodology, providing a replicable model for other countries facing similar fragmentation challenges.

AI governance requirements are rapidly evolving and expanding: The SCITUS control catalog grew from 31 controls (v1.0, June 2025) to 57 controls (v2.0, July 2026) in just over a year, reflecting emerging regulatory findings on generative AI training data and newly documented threats from agentic AI systems—indicating that compliance frameworks must be versioned and regularly updated.

Seven trustworthy-AI characteristics form the foundation for Canadian compliance: SCITUS integrates enhanced trustworthy-AI characteristics alongside four core governance functions, providing organizations with a structured approach to addressing accountability, transparency, fairness, and other key responsible-AI principles within Canada's specific regulatory context.