Free · consultation closed · status checked 30 September 2026
Canada is deciding what AI transparency will require. The consultation closed on 23 September.
Innovation, Science and Economic Development Canada has been consulting on how AI transparency should work here. It is not a draft law and nothing in it binds anyone today. But it is the clearest public signal we have of what Canadian organisations will be asked to do about AI, and it names five things specifically.
If you deploy AI in a Canadian organisation, two things are worth doing before the twenty-third. Read what is actually on the table, because some of it is closer to your existing obligations than it first appears. And if any of it would be difficult for you, say so — consultations are one of the few points where a small organisation can be heard without a lobbyist.
The five areas under consultation
Summarised from the ISED consultation, with what each would mean in practice
1. Identifying AI-generated content
Whether, and how, content produced by an AI system should be identifiable as such — watermarking, provenance data, or disclosure.
What to do now. Know where your organisation publishes AI-generated material: marketing copy, images, customer correspondence, summaries sent to clients. Most organisations have more of this than they think, and almost none have a record of it. That record is the thing any future requirement will land on.
2. Telling people when they are interacting with an AI system
Whether people should be told when they are dealing with an AI rather than a person.
What to do now. List every point where a customer, employee or member of the public interacts with an AI on your behalf — chatbots, phone systems, triage tools, automated correspondence. Then ask whether a reasonable person would realise. If the answer is no, that is a decision you have already made without meaning to.
Note that Quebec is ahead of this. Law 25 already requires notice where a decision about a person is made exclusively by automated processing, and a route for them to make representations to a human being.
3. Consistent information about AI systems
Standardised information about how an AI system was developed, what it can do and where it falls down — the direction most international frameworks have taken.
What to do now. For each AI system you rely on, be able to answer: who built it, what it was trained to do, what it is not fit for, and what happens when it is wrong. If you buy AI inside another product, that is a supplier question, and most suppliers answer it badly until a customer insists.
4. Reporting serious AI incidents
Whether serious incidents involving AI systems should be reported, and to whom.
What to do now. Decide what an AI incident would look like in your organisation, and make sure your existing incident process would catch it. A model producing discriminatory outcomes, or confidential information appearing in an output, is not a security incident in the ordinary sense and will not be reported by people watching for malware. This is a small change to an existing register, not a new system.
5. Tracking what AI agents do
How to track the activity and interactions of AI agents — systems that take actions rather than only producing text.
What to do now. This is the newest and least settled of the five, and the one moving fastest in practice. If anything in your organisation lets an AI take an action — send an email, update a record, approve something, call another system — you need a log of what it did and under whose authority. Most organisations deploying agents today cannot produce that log, which is a problem well before any regulation arrives.
Being straight about this
None of this is law, and we are not going to pretend otherwise.
This is a consultation. It may produce legislation, guidance, a voluntary code, or nothing at all, and the timeline is not published. Anyone selling you AI transparency compliance today is selling you something that does not yet exist.
What is worth doing now is the part that is useful regardless: knowing where AI sits in your organisation, who owns it, what it decides, and what it would take to explain any of that to a customer or a regulator. Every one of the five areas above depends on that inventory, and so does the Quebec obligation that already applies.
Two things worth doing before the twenty-third
The consultation closed on 23 September 2026. If any of this would be hard for you, plan for it now rather than waiting for the Government’s response. The details are on the ISED consultation page.
And build the inventory. Our AI acceptable use policy template is free and covers approved tools and what must never be pasted into one. The automated decision inventory in our documentation pack covers the Quebec duty that already applies. If you would rather we looked at your AI deployment and told you where it would not hold up, that is our AI deployment review.