Canada's privacy regulators call for accountable AI in health care

Canada’s federal, provincial and territorial privacy commissioners and ombuds on 29 October 2026 issued a resolution on the responsible use of artificial intelligence in health care and health research. It calls on governments and public and private-sector organisations to protect personal health information and fundamental rights as they develop, procure and adopt AI systems.

For compliance teams, the resolution is a cross-Canada supervisory signal rather than a single new operating rule. It identifies unauthorised collection, use and disclosure of health information, inaccurate inferences, systemic discrimination and other patient harms as consequences of weak safeguards, accountability and oversight. Developers, service providers and health-care organisations are being asked to establish and implement trustworthy AI accountability and management frameworks.

Four asks for governments

The regulators are urging federal, provincial and territorial governments to review, amend or adopt legislation and regulations that support innovation while ensuring AI systems are:

- privacy protective;
- valid and reliable;
- safe;
- human rights affirming;
- transparent; and
- accountable.

They also want governments to consult meaningfully with the privacy regulator in each jurisdiction when preparing AI laws and regulatory frameworks. Public engagement should be frequent and transparent, with particular attention to marginalised and vulnerable communities.

The strongest legislative ask is that governments legally require all relevant parties developing, procuring or using AI in health care to establish effective governance and accountability frameworks. The resolution does not set out a common framework or implementation date, so organisations will need to track how each jurisdiction translates the call into legislation, regulation or guidance.

Patricia Kosseim, Ontario’s Information and Privacy Commissioner, said AI could reduce administrative burdens but carries risks including “the unauthorized collection, use, and disclosure of personal health information” and built-in biases affecting marginalised and underrepresented groups.

Atlas reads the combination of the six principles and the focus on development, procurement and adoption as a lifecycle expectation. A health-care provider should not treat vendor selection as the point at which its responsibility ends, while a developer’s privacy and reliability controls will be relevant to the customer’s deployment decisions.

Developers, providers and procurement

The FPT regulators say they have issued specific recommendations for AI developers and service providers, and for health-care providers that procure, adopt and use AI systems. Those recommendations call for essential elements of a trustworthy AI accountability and management framework.

The resolution therefore reaches beyond model builders. Health-care organisations using AI for administrative work, clinical decision support or patient care should expect scrutiny of how responsibility is allocated between the provider, the developer and any service supplier. The principles also point to controls around the accuracy and reliability of outputs, transparency about system use, protection of health information and assessment of effects on groups that may be disproportionately affected.

The regulators’ wording remains a request to governments and interested parties, not an immediate statutory duty imposed by the resolution itself. But the FPT bodies have committed to continue advocating for laws and regulations on responsible AI in health and health research, and to coordinate “to the extent possible” on joint enforcement, guidance and public education.

Research ethics must also change

The resolution separately calls on Canada’s health research agencies to update national research ethics policies with more detailed guidance for AI and AI-enabled research involving human participants.

Research ethics boards, associations and oversight bodies should strengthen members’ education and capacity to conduct due diligence on AI research proposals. Health researchers should improve their assessments of risks and benefits to individuals and groups, and be transparent about and share the outcomes of their AI research.

The resolution was passed at the annual meeting of Canada’s federal, provincial and territorial information and privacy commissioners and ombuds, hosted in Ottawa by the Privacy Commissioner of Canada and the Information Commissioner of Canada. With no deadline attached, its immediate effect is to establish a common position for future legislation, guidance, education and coordinated supervisory activity across Canadian privacy jurisdictions.