Keep every AI system aligned with the rules and prove it.
TovrisAI registers your department’s AI systems, checks each one against the Directive on Automated Decision-Making with cited evidence and a confidence score, and puts every finding in front of a person before it counts. Each step lands in a tamper-evident audit trail.
- Five result states
- English and French
- Data stays in Canada
Run5 steps
- Load the record0.2s
Register fields · AIA level III
- Decide what applies0.1s
39 of 45 requirements apply
- Retrieve evidence1.4s
9 artefacts · cited passages
- Assess each requirement41k tok
Azure OpenAI · Canada East
- Send to review0.1s
Lowest confidence first
Benefits eligibility triage · AIA level III · DADM 2025-06-24
§6.1.1
DADM-AIA-COMPLETE
MetComplete, approve and publish the AIA before production
Final AIA recorded; publication link on file · 3 evidence
0.93§App. C · 6.3.7
DADM-C-PEER-ONE
Partially metPeer review by at least one qualified expert
Review report found; reviewer's qualifications not stated · 2 evidence
0.71§App. C · 6.3.13
DADM-C-HUMAN-HIGH
Not metA human makes the final decision at levels III and IV
Process map shows approvals issued without an officer · 2 evidence
0.86§6.3.8
DADM-GBA
Unable to determineComplete a Gender-based Analysis Plus
No GBA Plus evidence linked; a reviewer decides · 0 evidence
0.34§App. C · 6.3.7
DADM-C-PEER-TWO
Not applicablePeer review by at least two qualified experts
Applies at level IV; this system is level III · 0 evidence
1.00
Built on the Government of Canada’s own instruments
- DADMEncoded · 2023 and 2025 editions
- AIAQuestionnaire and scoring
- PSDEncoded · section 4.1
- RegisterImport and export
- AI StrategyPack in progress
- AI ethicsPack in progress
- GC AI Register entries imported, 0 failures
- 412
- DADM 2025 requirements, quoted word for word
- 45
- Result states, each with confidence and citations
- 5
- Official languages: screens, findings and reports
- 2
Measured in the simulated Government of Canada test environment · synthetic data
Six jobs, one name
Tovris is named for what it does. Each job is a part of the product you can open, inspect and export.
AI system registry
One inventory of every AI system, with the 24 fields of the public GC AI Register plus owner, AIA impact level and risk tier. Import the register, get a data-quality report, export it back.
Human review
Reviewers validate, reject, modify or annotate every finding, lowest confidence first. Separation of duties stops anyone approving their own assessment.
Automated assessment
Each applicable requirement is checked against your evidence. The result comes with a confidence score, citations to the exact passages and a plain-language explanation in both languages.
Bilingual reports
Governance reports for one system, a selection or the whole portfolio, in English and French, as PDF, JSON or CSV. The report says what the screen says.
Dashboards and risk monitoring
Track data quality, drift and output fairness for each system. A breach becomes a finding and a reassessment task, and the owner is told.
Access, audit and residency
Single sign-on with MFA from your identity provider, five roles enforced on the server, a hash-chained audit log you can verify, and model calls for Government of Canada tenants kept in Canada.
A governance loop that keeps running
Six steps from inventory to decision, then back again whenever a rule, a system or its risk signals change.
- 01
Register
Record every AI system with the GC AI Register's fields and your governance fields: owner, intended use, AIA impact level, risk tier. Bring the published register in by CSV.
- 02
Encode the rules
Policy instruments become versioned, machine-readable requirements. Each keeps the exact wording of the official text in English and French, linked to the stored source.
- 03
Decide what applies
The applicability rules pick the requirements for each system from its AIA level and attributes, and record why each one applies.
- 04
Assess
Each requirement is checked against linked evidence and gets one of five results with a confidence score. When the evidence is not there, the answer is “unable to determine”, not a guess.
- 05
Review
People validate, reject, modify or annotate each finding. Every decision goes into the audit log next to the model's original answer.
- 06
Detect change
When a directive is amended, or a system or its risk signals change, Tovris finds the affected systems and opens reassessment tasks. The loop starts again at step 04.
Governance you can show, not just assert
Spreadsheets and one-off reviews work until a directive is amended or an auditor asks how a conclusion was reached.
TovrisAIThe usual way
Inventory
One registry with the GC AI Register's own fields, imported and exported
A spreadsheet per branch, out of date when read
Policy text
Exact quotes from the official text, versioned, in both languages
Paraphrased into checklists
Assessment
Per requirement, repeated whenever something changes
Manual, once, before launch
Uncertainty
A confidence score, and “unable to determine” when evidence is missing
Hidden behind a yes/no checkbox
Policy changes
Compared clause by clause, with affected systems and reassessment tasks
Noticed months later, if at all
Proof
A hash-chained trail from requirement to evidence to reviewer decision
Email threads and screenshots
| Dimension | The usual way | TovrisAI |
|---|---|---|
| Inventory | A spreadsheet per branch, out of date when read | One registry with the GC AI Register's own fields, imported and exported |
| Policy text | Paraphrased into checklists | Exact quotes from the official text, versioned, in both languages |
| Assessment | Manual, once, before launch | Per requirement, repeated whenever something changes |
| Uncertainty | Hidden behind a yes/no checkbox | A confidence score, and “unable to determine” when evidence is missing |
| Policy changes | Noticed months later, if at all | Compared clause by clause, with affected systems and reassessment tasks |
| Proof | Email threads and screenshots | A hash-chained trail from requirement to evidence to reviewer decision |
Runs where Government of Canada data is allowed to live
The same product in a Canadian cloud region, your own tenancy or your own server room. Tenants marked Government of Canada can only reach models hosted in Canada.
- Isolation level 1 of 4
Canadian cloud
Codebeatz runs Tovris for you in a Canadian Azure region. Model calls go to Azure OpenAI in Canada East.
Azure, Canadian regions - Isolation level 2 of 4
Private cloud
The same containers in your department's own cloud subscription, in a Canadian region you choose.
Your Canadian tenancy - Isolation level 3 of 4
On premises
Docker Compose behind your firewall. Database and job queue on an internal network; only HTTPS is exposed.
Inside your perimeter - Isolation level 4 of 4
Offline mode
Try the whole workflow with no model provider. Nothing leaves the server, and results are labelled as a heuristic, not an assessment.
No model calls
The objective of this directive is to ensure that automated decision systems are used in a manner that reduces risks to clients, departments and Canadian society, and leads to more efficient, accurate, consistent and interpretable decisions made pursuant to Canadian law.
See the whole loop on a system you know
Register, assess, review, change: we walk through it on the simulated Government of Canada environment, in English or French.
Live walkthrough · English or French · Synthetic data only