Manitoba's new AI and cybersecurity governance framework for the public sector

Manitoba has enacted Bill 51, the Public Sector Artificial Intelligence and Cybersecurity Governance Act (the Act), which will govern how public sector entities use AI and manage cybersecurity.

The Act received Royal Assent on June 1, 2026, but is not yet in force. It comes into force on a day fixed by proclamation, which has not yet happened. Once it is in force, many of the Act's practical requirements will still depend on regulations that have not yet been written.

What Entities Does the Act Cover? 

The Act applies to “public sector entities” prescribed by regulation. The definition includes government departments, government agencies, other reporting organizations, municipalities, incorporated communities and local government districts. The regulations will determine which entities within those categories are actually subject to particular provisions.

A Note on Vendors in the Private Sector

The Act applies to an AI system used by a prescribed public sector entity when the system is developed by a third party on the entity's behalf. If your organization procures AI tools, software, or cybersecurity services from outside vendors, expect procurement requirements and contractual compliance commitments to evolve as the Act's regulations take shape. A companion article covers the broader private-sector picture, including a separate government consultation on private sector AI legislation and other AI-related rules already affecting Manitoba businesses.

Requirements

The Act itself sets up a framework rather than fixed rules. It creates two separate tracks, one for AI and one for cybersecurity, each with its own regulation-making power.

AI obligations, once regulations are made, may require a covered entity using AI to:

• Tell the public how it's using AI;
• Put an accountability framework in place;
• Manage the risks that come with using it;
• Comply with prescribed technical standards for AI use;
• Avoid any uses the regulations end up prohibiting; and
• Ensure a person reviews and oversees the system's use in certain situations.

Cybersecurity obligations run on a separate track, and don't depend on whether the entity uses AI at all. A covered entity may need to:

• Comply with prescribed cybersecurity requirements and technical standards; and
• Follow any directive the Minister issues to that specific entity, which the Minister must then make public.

What's Still Missing? 

Quite a lot. There's no proclamation bringing the Act into force yet, no list yet of which specific entities are actually covered, and no regulations setting out what any of the above obligations look like in practice. Ontario's experience shows that framework legislation can leave substantial details to subsequent regulations: its comparable 2024 legislation did not produce its first regulations until March 2026, roughly 16 months after Royal Assent. Manitoba's own regulatory timeline remains uncertain.

What Already Applies to Public Entities

Several sources of legal exposure already apply to AI-assisted decisions today. 

• Administrative law: decision-makers exercising public power still need to act fairly and be able to explain their decisions, AI-assisted or not;
• Privacy law: The Freedom of Information and Protection of Privacy Act and The Personal Health Information Act already govern how personal information is collected, used, and disclosed by public bodies; and
• Human rights law: biased AI outcomes affecting benefits, housing, employment, or services can already be challenged under The Human Rights Code (Manitoba). This applies equally to private organizations, not just public ones.

The Practical Stakes

The Act does not establish specific offences or monetary penalties for non-compliance, but section 3(4) says failure to comply with the Act or directives associated with the Act "does not affect the validity of any policy, Act, regulation, directive, instrument or decision."

That absence of formal enforcement is easy to misread as low stakes. In practice, the consequences run through other channels instead. A vendor or contractor found non-compliant risks losing a government contract or being passed over for the next one, since procurement processes can build compliance into their evaluation criteria regardless of what the Act itself requires.

An entity's non-compliance can also draw public criticism once it becomes known, particularly if the AI system in question affected someone's benefits, housing, or access to a service. In a later court challenge to a decision the system helped make, evidence that the entity ignored applicable accountability or oversight obligations could potentially be relevant to arguments about the fairness or reasonableness of the decision, depending on the circumstances, even though the Act itself creates no cause of action.

None of this depends on the Act having its own penalties. The exposure comes from contracts, reputation, and existing legal doctrines that operate whether or not the Act backs them up with a fine. 

How to Prepare 

• Watch for the regulations prescribing which public sector entities are subject to the Act's various provisions. Those regulations will begin to clarify which organizations and obligations are covered.
• Take stock of what AI you're already using, buying, or building, including tools embedded in other software.
• Flag the higher-risk uses: anything touching benefits, access to services, or sensitive information
• Put someone in charge of each system, even informally, before regulations require it.
• Start documenting what a system does, what data it uses, and what a person decided when they relied on (or overrode) it.
• Look at your vendor contracts now, especially around audit rights, data ownership, and what happens if new rules make a system non-compliant.
• Review your cybersecurity practices now, including incident response plans and technical safeguards. The Act's cybersecurity framework operates on its own track and does not depend on whether you're using AI at all.

The Act's detailed practical obligations aren't in force yet, but the organizations best positioned when they do will be those that started preparing beforehand.