AI-Assisted Customs Duty Assessment and Trade Compliance

Enforcement · Financial Services · Risk Assessment & Triage

What it collects that can identify you

Sensitive personal information

Identifiable data

Importer and trade chain partner registration data including business names, addresses, contact information, and CRA-issued Business Numbers (BN9). For sole proprietors, client identifiers may constitute personal information.

Also collects operational data, which is anonymized data.

Run by: Canada Border Services Agency (CBSA)
Where: No fixed location
Kept: Retained As specified by applicable legislation including the Customs Act; exact retention period not specified in source documents
Shared with: Accountable organization, 3rd parties, Me

What it is for

Enforcement

Financial Services

Risk Assessment & Triage

This system automates the calculation of duties and taxes on imported commercial goods and flags potentially non-compliant import transactions for review by Canada Border Services Agency officers. It uses rule-based logic applied to trade data submitted by importers and customs brokers. All flagged transactions are reviewed by human officers before any compliance action is taken, and importers have access to formal recourse processes.

What it collects and what happens to it

Data taken in

Sensitive personal information

Identifiable data

Importer and trade chain partner registration data including business names, addresses, contact information, and CRA-issued Business Numbers (BN9). For sole proprietors, client identifiers may constitute personal information.

Operational data

Anonymized data

Commercial accounting declarations submitted by trade chain partners including tariff classification, declared value for duty, origin of goods, import permits, remission orders, and financial transaction records stored within CARM.

Processing

Classification & Prediction

Rule-based classification that calculates duties and taxes owed using mathematical logic based on the Customs Act, and applies established risking rules to classify transactions as potentially compliant or non-compliant. Includes data validation rules for syntax errors and permit mapping.

What it does

Deciding (Analytical AI)

Human decides

The system scores and ranks import transactions against risk rules to flag potentially non-compliant ones and calculates duties and taxes; CBSA officers review all outputs and make the final decisions on compliance action.

Outputs

A recommendation or prediction

Anonymized data

Lists of potentially non-compliant transactions generated by CARM's risking rules, provided to CBSA officers as recommendations for further review. Also identifies transactions requiring manual intervention or approval by a delegated CBSA authority.

Sensitive personal information

Identifiable data

Electronic notifications to trade chain partners of assessed duties and taxes, validation errors, case updates, and compliance decisions rendered by CBSA officers, linked to their CARM client portal account.

Operational data

Anonymized data

Reports generated according to program and legislative requirements, including compliance verification reports and financial statements shared with partner agencies such as the Canada Revenue Agency, Statistics Canada, and the Department of Finance.

Run by

Canada Border Services Agency (CBSA)

The federal agency responsible for deploying and operating the CARM system, managing the assessment and collection of duties and taxes on imported goods, and overseeing trade compliance activities.

CBSA Assessment and Revenue Management (CARM) — Government of Canada Open Data

Built by

Deloitte and Accenture

Third-party consulting firms that contributed to the development of the CARM system alongside the CBSA. The system is hosted on Amazon Web Services (AWS) Canadian Cloud Service.

Algorithmic Impact Assessment — CBSA Assessment and Revenue Management (CARM)

Kept for

Retained As specified by applicable legislation including the Customs Act; exact retention period not specified in source documents

Electronic records including commercial accounting declarations, financial transaction information, and registration data are maintained in the CARM system using Amazon Web Services (AWS) Canadian Cloud Service, a dedicated OpenText service in the AWS Cloud, and CBSA's Enterprise Data Warehouse. The Privacy Act restricts subsequent use and disclosure of personal information.
Duration: As specified by applicable legislation including the Customs Act; exact retention period not specified in source documents

Shared with

Available to the accountable organization

CBSA officers and staff with role-based access controls can access CARM data relevant to their job functions, including compliance monitoring, managing corrections and adjustments, and processing appeals. Access is managed through internal oversight controls.

Available to 3rd parties

Information from CARM is shared with the Canada Revenue Agency, Public Services and Procurement Canada, Innovation Science and Economic Development, the Office of the Auditor General, Canadian Centre for Cyber Security, Department of Finance, and Statistics Canada, in accordance with the Customs Act, Customs Tariff, Special Import Measures Act, Excise Tax Act, and other applicable legislation.

Available to me

Trade chain partners can access their own account data, transaction history, payment due dates, financial statements, and case status through the CARM Client Portal. They can submit accounting documents, make payments, request rulings, and manage appeals electronically.

Stored

Stored on 3rd Party Cloud

All electronic records are maintained in the CARM system using the Amazon Web Services (AWS) Canadian Cloud Service and a dedicated OpenText service in the AWS Cloud, located within Canada's jurisdiction.
Duration: As specified by applicable legislation; exact period not stated in source documents

How to read the colours

Can it identify you?

Anonymized data: Data about people with the link to who is broken. Stripped of identifiers, blurred, aggregated, or noised so this system can’t reasonably tie a record back to an individual.
Pseudonymous data: Each person’s data is tied to a token (hash, ID, template) that lets this system recognise the same person across events, but the token itself doesn’t reveal a name. Reidentification is possible with extra information.
Identifiable data: The data either contains a direct identifier (name, address, account name, recognisable face or voice, plate number) or carries a token this system uses to look up legal identity during processing.

Who completes the loop?

Human decides: This mode suggests; a person decides what to do next. The AI is always advisory — a human is in the loop on every decision. Example: a triage tool ranks cases for a clinician who chooses which to see first.
Human executes: This mode decides; a person carries out the result. Example: an optimizer plans the day’s trash-collection routes, and drivers run them.
Autonomous: This mode decides and acts on its own. No person reviews each decision or carries out the resulting action.

Definitions from the DTPR standard. Amber is about your data, violet about who decides. The fuller the shape and the deeper the colour, the more identifying the data or the less a person is involved.

What you can do

Ask about this system

Questions go to the Helpful Places, not the vendor.

Your rights

Right to ContestImporters and trade chain partners who disagree with a CBSA assessment or compliance decision resulting from a CARM-assisted activity may apply for further re-determination or review using established recourse mechanisms. Information on recourse options is available at https://www.cbsa-asfc.gc.ca/recourse-recours/
Right to a Human ReviewAll outputs produced by the CARM automated system — including lists of potentially non-compliant transactions — are reviewed by CBSA officers who make the final decisions. No compliance action is taken solely on the basis of automated output. Officers can discard any transaction recommended by the system.
Right to Algorithmic TransparencyA meaningful explanation of how CARM contributes to decision-making, including the role of the system, input data and its source, evaluation criteria, outputs produced, and principal factors behind decisions, must be published in plain language through the Algorithmic Impact Assessment and made discoverable via the CBSA departmental website, as required by the Directive on Automated Decision-Making.
Right to AccessTrade chain partners have access to their import account information, transaction history, financial statements, and case status through the CARM Client Portal. The portal provides centralized visibility of all commercial interactions with the CBSA.

Risks and safeguards

Financial & business harmNon-compliant importers may face reassessment of duties and taxes, penalties, and interest charges that were previously undetected, creating financial impacts on their businesses.Safeguard: CARM operates on a post-entry verification model meaning no shipments are stopped at the border; impacts are reversible through established recourse mechanisms. CBSA officers review all system outputs and make final decisions. Importers may appeal any CBSA assessment or decision through formal recourse processes. The system also reduces financial unfairness by levelling the playing field for compliant importers.
Civil liberties harmThe use of risking rules and algorithmic flags could create disparate treatment of importers if rules embed systemic bias, or if the system's opaque trade-secret logic disproportionately targets certain importer profiles.Safeguard: The AIA confirms a Gender-Based Analysis Plus was undertaken on the data. Risk rules are linked to legislative requirements in the Customs Act, validated against prior compliance results, and tested during client simulations. All flagged transactions require human officer review before any compliance action. Recourse mechanisms are available for all affected parties. The system processes commercial trade data, not demographic characteristics of importers.