Canada’s privacy regulators published joint health-AI recommendations on 29 October. Adopted on 15 September, the resolution asks governments to require governance frameworks from developers, buyers and users. It is a set of regulatory recommendations, not legislation enacted by the announcement.[1][2]
For healthcare providers, the procurement message reaches beyond selecting a model. Contracts should cover privacy and security training, record-keeping, auditing and limits on data use, including prohibitions on unauthorised commercialisation or disclosure by contractors and subcontractors. Providers should assess suppliers’ privacy, security and AI risks before adoption.[1]
The recommendations also address what happens inside a healthcare organisation. Staff need training on approved tools and the risks of “shadow AI”—tools used without organisational approval. Appropriate human oversight and continuing risk monitoring are part of the proposed governance, rather than checks that end when a contract is signed.[1]
People should have accessible ways to challenge consequential decisions. Consent-related duties follow applicable privacy law; pre-deployment opt-outs are proposed where practicable. The resolution should therefore not be read as creating an unconditional new right to opt out of every health-AI use.[1]
Sources & further reading
- Joint privacy regulators’ resolution on artificial intelligence in healthcare Office of the Privacy Commissioner of Canada · Accessed 30 Oct 2026
- Canadian privacy regulators announce joint health-AI recommendations Office of the Privacy Commissioner of Canada · 29 Oct 2026 · Accessed 30 Oct 2026
Report an error or suggest a correction