Key takeaways
- The federal consultation “Have your say on advancing AI transparency in Canada” closed on September 23, 2026, after a two-month window. It asked whether five areas need action: AI-generated content detection, knowing when you interact with AI, consistent information about AI systems, serious incident tracking, and AI agent activity.
- In a submission published September 23, Michael Geist recommends a statutory AI Transparency Act built on three pillars: mandatory public disclosure of AI corporate safety and escalation policies, training data transparency for large language models, and annual reports on government and law enforcement demands for user data. His argument: the voluntary code of conduct in place since September 2023 has not produced consistent industry practice.
- Whatever Ottawa publishes in its What We Heard report, the direction is visible. Voluntary codes are giving way to verifiable disclosure. The incident reporting, agent inventory, and provenance practices you build now are the same ones any future regime will audit.
On September 23, 2026, the federal consultation window closed on one of the most consequential AI policy questions Ottawa has asked this year: should Canada regulate AI transparency, and how? The consultation, run by Innovation, Science and Economic Development Canada, opened on July 23 and invited Canadians to respond to a survey or by email, with submissions treated as public documents. The government will review what it receives and publish a What We Heard report.
What Ottawa put on the table
The consultation identified five areas where transparency issues arise and where further action may be warranted:
- Detecting and identifying AI-generated content.
- Knowing when you interact with AI, so individuals are not misled by systems that pass as human.
- Consistent information about AI systems: how they were developed, what they can do, and where they fall short.
- Tracking serious AI incidents related to AI systems.
- Tracking the activity and interactions of AI agents.
Each area comes with the same menu of options: regulatory measures, guidance and codes of conduct, standards, research and development, literacy initiatives, or procurement requirements. That framing is deliberate. Ottawa is testing the appetite for a statute before it drafts one.
The case for a statute, not another code
The most developed public answer so far comes from Michael Geist, the University of Ottawa law professor and Canada Research Chair in Internet and E-commerce Law, who published his full submission on September 23. He proposes an AI Transparency Act built on three pillars.
First, corporate safety and escalation policies should be public. It should not take a meeting with company executives for a minister, or anyone else, to learn a company’s policies on banning users or reporting conduct to police. Companies would have to disclose their user-safety policies fully, including the standards for escalating beyond flagging content or banning users, plus age-related restrictions. Companies that fail to live up to their published policies should face liability for that failure.
Second, training data transparency. Creators and rights holders want to know whether their works were used to train a model. Geist argues transparency is the practical answer while copyright cases still work their way through the courts: a creator cannot request exclusion from training data without first knowing their work is in it. He points to the EU AI Act, which requires providers of general-purpose models to publish a sufficiently detailed summary of training content, and to California’s AB 2013, which requires generative AI developers to document training datasets, including sources and whether the data includes copyrighted, licensed, or personal information.
Third, government demands should be reported. AI providers now hold conversational records that are among the most sensitive data Canadians generate, and governments and police will seek access to them, as they do with other intermediaries. Geist proposes mandatory annual transparency reports with aggregated figures on government and law enforcement demands, in the style of what telecom and major platform providers already publish. He also flags two gaps the consultation missed: the government’s own use of AI (the Government of Canada AI Register describes itself as a minimum viable product) and, in his assessment, why Bill C-36 is unlikely to fill the automated decision-making gap before 2030 at the earliest.
How this compares to what others already require
The debate is not happening in a vacuum. Here is how the regimes cited in the consultation discussion line up:
| Regime | Transparency obligation |
|---|---|
| EU AI Act | Providers of general-purpose models publish a sufficiently detailed summary of training content: major datasets, principal domains crawled, categories of data |
| California AB 2013 | Generative AI developers document training datasets: sources, copyrighted/licensed/personal data, collection period |
| California Transparency in Frontier AI Act | Frontier developers publish transparency reports and describe how they assess and manage risk |
| Canada, Voluntary Code of Conduct (Sept 2023) | Developers establish methods to detect AI content, maintain public incident databases, publish capability information |
| Proposed Canadian AI Transparency Act | Statutory disclosure of safety policies, training data, and government demands, backed by a regulator with penalty powers |
The pattern is hard to miss. The jurisdictions moving first are moving to statutes, not pledges. Canada’s voluntary code has been in place since September 2023, and the government’s own discussion paper acknowledges that transparency practices remain inconsistent across the industry.
What your team should do before the rules land
You do not need to wait for the What We Heard report. Four moves put you ahead of wherever this lands:
- Inventory your agents and conversational systems. The principle that a consumer dealing with an agent should know it is an agent is the least controversial item on the table. Confirm the AI nature of the interaction is disclosed in every flow you deploy.
- Define “serious incident” internally and rehearse reporting. Do not limit the definition to technical malfunctions: discriminatory outcomes and exposed sensitive inferences count too. Decide who reports, to whom, on what clock, and when affected people get advisories.
- Document training-data provenance. For models you fine-tune or deploy, record where the data came from and on what legal basis. If your vendor cannot tell you what a model learned from, you cannot answer the creator opt-out question either.
- Watch the government’s own register. The AI Register is a minimum viable product today. Procurement transparency is moving in one direction, and vendors selling to government will feel it first.
Actionable takeaway: Pick one of the five consultation areas this week (incident reporting or agent inventory are the best starters) and write the internal policy as if disclosure were already mandatory. If a statute arrives, you are ready. If it does not, you still have a stronger governance program than the organizations that waited.