Canada’s privacy regulators separate health-AI responsibilities for builders, buyers and researchers

Canada’s federal, provincial and territorial privacy regulators have [called for stronger governance of AI in health care and health research](https://www.priv.gc.ca/en/opc‑news/news‑and‑announcements/2026/nr‑c_261029/). Their October 29 announcement addresses developers, organizations buying or using systems, and research bodies. It also asks governments to review legislation and require accountability frameworks. The [resolution was adopted in Ottawa on September 15](https://www.priv.gc.ca/en/about‑the‑opc/what‑we‑do/provincial‑and‑territorial‑collaboration/joint‑resolutions‑with‑provinces‑and‑territories/res_20260915_aihealth/). The October 29 public call does not itself enact a new national health‑AI law. For a team preparing a procurement decision, the useful question is who must supply which evidence. A vendor’s technical explanation, a hospital’s deployment decision and an ethics board’s research review answer different questions. Treating one as a substitute for the others leaves responsibilities unassigned.

The [resolution](https://www.priv.gc.ca/en/about‑the‑opc/what‑we‑do/provincial‑and‑territorial‑collaboration/joint‑resolutions‑with‑provinces‑and‑territories/res_20260915_aihealth/) asks developers and service providers to explain training and information use, assess risks continually, provide human oversight, and enable clients and end users to challenge outputs. A buyer can use that distinction to ask for an explanation it can evaluate, rather than a general assurance that a product is responsible. Before purchase, it can establish who receives updated risk findings and who decides whether those findings require a change in use. Those are practical questions for the relationship; this report has not assessed a particular product’s compliance.

The [recommendations](https://www.priv.gc.ca/en/about‑the‑opc/what‑we‑do/provincial‑and‑territorial‑collaboration/joint‑resolutions‑with‑provinces‑and‑territories/res_20260915_aihealth/) ask procurers to assess vendors, oversee use and control subcontracting and data uses through contracts. Consent communications depend on applicable law, with opt‑outs where practicable; accessible contacts and decision challenges are requested. The operational task is to connect those pieces. If an organization offers a challenge route, someone needs authority to examine the disputed output and respond. If a supplier uses a subcontractor, the buyer needs to understand how that arrangement fits the permitted handling of information. A consent screen alone does not explain either process.

The [research recommendations](https://www.priv.gc.ca/en/about‑the‑opc/what‑we‑do/provincial‑and‑territorial‑collaboration/joint‑resolutions‑with‑provinces‑and‑territories/res_20260915_aihealth/) seek ethics‑board capacity, refined risk‑benefit assessments and shared outcomes. They warn that combining de‑identified datasets with other information can identify people again. That makes the label on a dataset an incomplete answer to a research‑risk question. A project review needs to examine its proposed uses and combinations, rather than assume that removing direct identifiers settles the issue. The two official pages provide a governance agenda, not an independent evaluation of clinical benefits or a jurisdiction‑by‑jurisdiction legal opinion. Canada’s Centre Block on Parliament Hill in Ottawa, photographed May 30, 2008. Archival government context; not the September 2026 regulators’ meeting or evidence that a new health‑AI law was enacted. Photo: [Marc‑Lautenbacher / Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Parliament_building_of_Canada_Ottawa.jpg), [CC BY‑SA 4.0](https://creativecommons.org/licenses/by‑sa/4.0/). Responsive display crop/downscale; photograph otherwise unaltered and adaptations retain the same license.