What matters
- Four developments between October 8 and 14, 2026 put AI obligations on Canadian privacy teams: the OPC’s voiceprint guidance, Bill C-34’s recommender-system duties, Newfoundland’s ATIPPA review submission naming AI, and Bill C-36’s automated decision-making rules.
- The pattern is that AI governance no longer arrives as its own statute. It arrives inside access laws, online safety bills, call-recording guidance, and private-sector privacy reform.
- Practitioners say the mandates are arriving faster than the evidence infrastructure: shadow AI breaks AI inventories, and human-review rules risk becoming rubber stamps.
One line in St. John’s, then the pattern
On October 14, 2026, Information and Privacy Commissioner Kerry Hatfield filed her office’s submission to the five-year review of Newfoundland and Labrador’s access and privacy law. One ask: address AI’s emerging issues. One line. No detail.
Alone, a footnote. But it was the fourth AI signal in a single week, and it set the week’s thesis: AI governance is no longer a separate discipline. It is showing up inside every privacy file, wearing that file’s uniform.
The four signals
First, the guidance. On October 8, the federal Office of the Privacy Commissioner updated its guidance on recording customer calls. The headline: voiceprints are sensitive biometric information, and collecting them requires meaningful consent. The generic “this call may be recorded for quality purposes” notice no longer cuts it. For any team running an IVR, a call-centre contract, or a voice-analytics pilot, that is an AI governance assignment in a call-recording uniform: a voiceprint is a machine-learning model of a person’s body.
Second, the safety bill. A new CMAJ analysis by SickKids researchers backs Bill C-34, the Safe Social Media Act, and prescribes duties aimed at recommender systems and defaults: put the ranking under the same rules as the post, and give the new Digital Safety Commission real enforcement teeth. The catch: age assurance for every user means estimating every visitor’s age, which is biometric inference at platform scale. A bill sold as child safety is, under the hood, an AI-procurement and vendor-diligence mandate.
Third, the review. Back to Newfoundland: a statute written in 2015 is being told, by the commissioner who calls it the strongest access regime in Canada, that it needs language for automated decision-making and AI-shaped records. Statutory reviews are the leading indicator in Canadian privacy law. The asks named in St. John’s today become other provinces’ amendments a cycle or two later.
Fourth, the reform bill. Bill C-36, tabled June 15, 2026 and still before Parliament, would require organizations to give notice when they use automated decision-making to make a prediction, recommendation, or decision that could have a legal or similarly significant effect on a person. It also gives individuals an express right to make written representations asking an employee to review the outcome. Not a future AI act. The privacy bill now in the legislative queue, applying to any decision using an automated decision system, further than Quebec’s Law 25 rule for exclusively automated decisions.
| The instrument | The AI obligation | Who it bites |
|---|---|---|
| OPC call-recording guidance (Oct 8) | Voiceprints treated as sensitive biometrics; meaningful consent for voice analytics | Call centres, IVR vendors, anyone running voice AI |
| Bill C-34 (Safe Social Media Act) | Duties aimed at recommender systems and defaults; age assurance for all users | Platforms, and privacy teams asked to sign off on age-estimation vendors |
| N.L. ATIPPA review submission (Oct 14) | Commissioner asks for AI language in a 2015 access and privacy statute | Public bodies buying AI triage and procurement tools |
| Bill C-36 (PPACDA, before Parliament) | Notice for automated decisions with legal or similarly significant effect; right to human review on written request | Any organization with scoring, ranking, or screening systems |
The part the statutes skip
Here is where the week gets uncomfortable. Practitioners keep raising the same objection, and it has nothing to do with the drafting.
Two complaints recur. First, shadow AI: employees adopt Copilot, SaaS features with AI baked in, and scripts calling LLM APIs faster than legal, security, or compliance can review them. Most companies cannot say which tools run on AI. A static inventory built from procurement records is out of date on arrival; practitioners argue the fix is continuous discovery instead of point-in-time audits. The second is the rubber stamp: human-review requirements without metrics and independent audits become empty gestures, with reviewers approving algorithmic outputs without real context. Auditors are starting to ask teams to prove a human genuinely reviewed a decision, and a “reviewed” checkbox proves authorization, not oversight. One counterpoint worth keeping: a brief note recording what was checked and why turns a status flag into defensible evidence.
Bill C-36 would give every Canadian the right to ask an employee to review their automated decision. Nobody has published a number on how many Canadian organizations could produce the record that review would need.
Actionable takeaway: Run a 30-day inventory sprint: find every automated decision your organization makes about people (hiring screens, pricing, fraud flags, support triage), write down the human-review path for each, and flag the ones you cannot find. The laws are arriving in pieces, but the question they will all ask is the same, and nobody can answer it yet: show me the list.