Key takeaways
- On October 29, 2026, Canada’s federal, provincial, and territorial privacy commissioners and ombuds published a joint resolution, adopted September 15 in Ottawa, calling for responsible AI use in health care and health research. Fourteen offices signed it.
- The resolution sets six core principles for health AI: privacy protective, valid and reliable, safe, human rights affirming, transparent, and accountable, and hands specific homework to governments, vendors, providers, and researchers.
- For vendors and providers, the sharpest items are contractual: ban your contractors from commercializing patient data, name a human contact for AI objections, and treat employee-brought AI tools as shadow AI until approved.
Yesterday, fourteen of Canada’s privacy watchdogs spoke with one voice. The joint resolution on responsible AI use in health and health research, adopted at the September 15 annual meeting in Ottawa and published October 29, assigns homework to governments, AI vendors, health care providers, and the research community. It is a resolution, not a law. That distinction is exactly where your risk sits.
Six principles, no new statute
The six principles: privacy protective, valid and reliable, safe, human rights affirming, transparent, and accountable. The regulators ask governments to review, amend, or adopt legislation so health AI meets all six, and to legally require every party that develops, procures, or uses these systems to build effective AI governance frameworks. Governments must also consult their privacy regulator when writing the rules, and hear the public while doing it, with extra attention to marginalized communities.
The fourteen also committed to four things themselves: keep pressing for trustworthy AI legislation, enforce privacy law, coordinate across jurisdictions, and educate the health sector. The signatories run from the OPC and Quebec’s CAI to the Ontario IPC, BC’s OIPC, and the northern and Atlantic offices. Joint enforcement is no longer a talking point; it is a signed commitment.
What vendors are being asked to prove
Privacy by design, itemized. Data minimization, de-identified or synthetic data wherever possible, documented data provenance, safeguards proportionate to the data’s quantity and sensitivity, protective defaults, no manipulative design, audit capability, and real-world testing.
Show your work. Vendors must give clients evidence of how the system is trained and a plain explanation of how it works and uses information, and demonstrate that the use complies with the applicable privacy law.
Assess for the whole life cycle, not once. Ongoing privacy, security, and AI-specific assessments, with mitigations matched to severity. Risk findings go to clients, with the downstream mitigations they should apply.
Build in a challenge mechanism. The governance framework must cover the system’s entire life cycle, include human-in-the-loop oversight, and give clients and end-users a way to challenge AI outputs.
The clause that belongs in your contracts
This is the part I would take straight to legal. The resolution tells health care providers to make their contracts carry five things: privacy and security training, record keeping, auditing, limits on the uses and disclosures of information, and prohibitions on a contractor or subcontractor’s unauthorized commercialization or disclosure of information. Read that last one again. Fourteen privacy chiefs want it in writing that your vendor cannot monetize patient data. If your AI vendor contract does not say that explicitly, it has a gap the country’s regulators just flagged.
Name a human for AI objections. Providers must designate a contact for concerns and objections about AI use of their information, and offer a practical way to challenge consequential decisions or inferences.
Offer opt-out where practicable. Where consent is required, give clear communication about how personal information is used with the AI system, and where practicable, offer opt-out before deployment.
Shadow AI, called by name. The resolution tells providers to train staff and block unapproved AI use. It names the exact scenario: a hospital employee using a personally procured AI tool outside hospital policy. Fourteen regulators just wrote “shadow AI” into a formal resolution. The quiet-use defense is finished.
| The resolution speaks to | The core demand | Your file action |
|---|---|---|
| Governments | Amend law to the six principles; legally require governance frameworks | Track your province’s AI health legislation as an open compliance item |
| Vendors and service providers | Privacy by design, evidence of training, life-cycle assessments, challenge mechanisms | Add those four as vendor questionnaire lines |
| Health care providers | Contract provisions, designated contact, shadow-AI controls, human oversight | Audit contracts for the commercialization ban; name the contact |
| Research community | Update TCPS 2, strengthen REB capacity, share outcomes | Ask whether your REB is ready for AI research proposals |
The research lane: TCPS 2 and the REBs
Health research gets its own track. The regulators call on the Panel on Research Ethics and the three federal funding agencies, CIHR, NSERC, and SSHRC, to update the Tri-Council Policy Statement, TCPS 2, for AI research: re-identification risk when de-identified, anonymized, or synthetic data feeds an AI system, and bias from underrepresented populations. Research ethics boards need the resources and education for this due diligence, and REBs should demand a persuasive showing that expected benefits outweigh the risks. Researchers should refine their risk and benefit assessments, and share outcomes publicly.
The question nobody can answer yet
The scribe groundwork already exists: Alberta’s AI scribe PIA guidance, Ontario’s AI scribes key considerations, and BC’s PIPA and AI scribes best practices, all cited in the resolution. What remains open is the legislative half. No province has amended its law to the six principles, and the first joint enforcement action does not exist yet. The document is a promise. The test is who keeps it first.
Try it: the Health AI Readiness Checker
I turned this resolution’s specific demands into a 16-question self-assessment: the contract ban on data commercialization, the named human contact, the shadow-AI clause, evidence of training, life-cycle assessments, and the rest. Answer each one and it scores all six principles, names your exact gaps, and hands you a prioritized action list.
Take the Health AI Readiness Checker. Free, about five minutes, nothing you enter is saved.
Actionable takeaway: Pull your highest-risk health AI vendor contract and check three lines: a written ban on unauthorized commercialization of patient data, a named contact for AI objections, and a shadow-AI clause that covers employee-procured tools. Then mark the resolution’s date in your calendar. The first joint enforcement action will cite it.