Ottawa Is Writing AI Transparency Rules Right Now — and Your Business Is in Scope

The federal government's AI transparency consultation closes September 23, 2026. That is twelve days from today. If your business uses AI to serve customers, screen job applicants, or make decisions about individuals, the rules coming out of this process will affect your operations — and you have until September 23 to tell Ottawa what those rules should look like.

Here is what the consultation covers, what is already legally required, and what Canadian SMBs should be doing right now regardless of how the rules land.

What the Government Is Asking

On July 23, 2026, the Department of Innovation, Science and Economic Development launched a public consultation titled *Enhancing Trust in Artificial Intelligence Through Increased Transparency*. The consultation runs through September 23, 2026, and is open to any individual, business, or industry association.

The government has organized the consultation around five core transparency questions:

1. Disclosure of AI interaction. When a customer is talking to a chatbot, interacting with an AI assistant, or receiving recommendations from an algorithmic system, should they be told? Should businesses be required to identify that the system is AI-powered?

2. AI-generated content. When AI has created or substantially altered a piece of content — a summary, a marketing email, a customer communication — should that content be labeled? What constitutes "substantially generated"?

3. System capabilities and limitations. When an AI system has known limitations — accuracy constraints, language gaps, subject-matter boundaries — should businesses be required to disclose those to users?

4. AI in significant decisions. When AI meaningfully influences a decision about an individual — a hiring screen, a credit assessment, a service routing decision — should that person be told AI was involved, and should they have the right to seek human review?

5. Agentic AI. As AI systems gain the ability to take actions autonomously — booking appointments, sending communications, managing accounts — what transparency obligations should apply to businesses deploying them?

These are not hypothetical scenarios. Every one of them is already happening inside Canadian businesses today. (Government of Canada. *Have your say on advancing AI transparency in Canada.* ISED, July 2026)

The Context: Why This Consultation Exists Now

AI adoption among Canadian businesses has tripled in two years. Statistics Canada's Q2 2026 Survey on Business Conditions found that 19.2% of Canadian businesses now use AI to produce goods or deliver services — up from just 6.1% in Q2 2024. Among businesses in information and cultural industries the rate reaches 42.3%; professional, scientific and technical services sit at 32.4%.

As adoption accelerates, enforcement scrutiny is rising in parallel. The Office of the Privacy Commissioner's 2025-26 Annual Report documented a 109% year-over-year increase in PIPEDA complaints — a surge the OPC attributes partly to AI-driven awareness tools that helped individuals recognize when their information may have been handled improperly.

The OPC's joint investigation of OpenAI's ChatGPT — PIPEDA Findings 2026-002, published May 2026 — established a precedent: AI systems that collect and process personal information without adequate disclosure violate Canadian privacy law. Those conclusions apply not just to OpenAI — they signal how the OPC will read PIPEDA in relation to any Canadian business using AI to process customer or employee data.

Canada's AI for All national strategy, launched June 4, 2026, targets an increase in business AI adoption from 19% today to 60% by 2034 — and projects $200 billion in economic growth and 250,000 new jobs over five years. More AI in more businesses means the government needs a transparency framework before adoption scales further. The consultation is the mechanism for designing that framework.

What Is Already Required — Right Now

"There is no federal AI law" does not mean there are no obligations. Three distinct requirements already apply to Canadian businesses:

Quebec Law 25 — Automated Decision-Making Transparency

In force now for any business with Quebec-resident customers. When a decision based on automated processing of personal information significantly affects an individual, they must be informed that the decision was produced through automated processing — and they have the right to request that a human review the decision and the information on which it was based.

This applies regardless of whether you are physically located in Quebec. Scope includes e-commerce platforms, fintech tools, customer service routing, and any AI-assisted decision system that touches Quebec residents.

Ontario Employment Standards Act — AI Hiring Disclosure

Amendments under Ontario's *Working for Workers Four Act* took effect January 1, 2026, for employers with 25 or more employees. Every publicly advertised job posting must disclose whether AI tools are used to screen, assess, or select applicants. The same statement must appear on any associated application form.

The obligation covers any Applicant Tracking System with automated scoring or filtering, AI-assisted resume ranking, and chatbot-based pre-screening. Osler has noted that legal consensus treats any tool that algorithmically ranks or shortlists candidates as qualifying under the law's broad definition.

PIPEDA Transparency Principle

PIPEDA's Principle 8 (Openness) and Principle 9 (Individual Access) already require organizations to be transparent about how they collect, use, and disclose personal information — including through automated systems. Following the ChatGPT investigation, the OPC has made clear that this transparency obligation extends to how AI processes personal data. Organizations using AI to make or influence decisions about individuals must be able to explain those processes clearly on request.

What the Consultation Could Produce

No specific rules have been tabled — this is still an input-gathering stage. But the five areas of inquiry closely parallel what other jurisdictions have already enacted:

Chatbot and AI agent identification. The EU AI Act (in force since 2024) requires that AI chatbots be identifiable as AI to users. A similar Canadian rule would require businesses operating AI-powered customer service tools to identify them clearly — an obligation that currently does not exist federally.

AI-generated content labeling. The consultation explicitly asks whether content created or substantially altered by AI should be labeled. A federal labeling standard could apply to commercial communications, customer-facing content, and media, covering territory not addressed by any current Canadian law.

Federal extension of Ontario's hiring disclosure. The consultation references AI used in "screening, assessment, or selection" as an area of interest. A federal rule along Ontario's lines would extend mandatory disclosure to all Canadian employers rather than only Ontario employers with 25 or more staff.

Right to explanation for automated decisions. Building on Quebec Law 25 and the proposed Bill C-36 provisions, a national standard could extend the right to an explanation for AI-influenced decisions to all Canadians — not just Quebec residents or those in federally regulated sectors.

Agentic AI disclosure. The consultation specifically calls out agentic AI as a category requiring separate consideration. As more businesses deploy AI agents for scheduling, purchasing, customer communications, and operations, disclosure of what those agents can and cannot do is likely to become required.

Five Steps for Canadian SMBs — Right Now

Regardless of when new rules take effect, these actions are low-risk and high-value today:

1. Map every AI touchpoint in your customer and employee journey. List every system that collects, processes, or uses personal information: CRM scoring, chatbots, job screening tools, automated email systems, recommendation engines. This map is the foundation of any transparency compliance framework.

2. Verify your Quebec and Ontario obligations today. If you have Quebec-resident customers, confirm your Law 25 automated decision-making process is documented and that individuals have a path to request human review. If you are an Ontario employer with 25 or more employees, confirm your job postings include AI screening disclosure — failure to comply is an Employment Standards Act violation from January 1, 2026 onward.

3. Review your privacy policy for accuracy. Your PIPEDA-required policy should accurately describe your use of AI to process personal information. If it was last updated before you adopted AI tools, it is very likely out of date — and the OPC is actively investigating based on inadequate disclosure, as the ChatGPT findings demonstrated.

4. Consider submitting to the consultation. The submission process is online and open until September 23, 2026. A one-to-two-page response focused on your sector's practical constraints is more useful to the policy process than silence — and it gives you a window into the government's thinking before rules are finalized.

5. Document your AI systems' decision logic now. Maintain records of what your AI systems do, what data they use, what decisions they influence, and what their known limitations are. This documentation serves three purposes at once: it positions you for upcoming disclosure requirements, it supports your PIPEDA accountability obligations, and it reduces your exposure if a customer or regulator asks questions.

Looking Ahead

Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled June 15, 2026, and includes mandatory disclosure requirements for AI-influenced decisions about individuals. It is not yet in force — realistic estimates put enforcement in 2027 or 2028 — but its provisions signal what federal AI transparency requirements will look like when they arrive.

The September 23 consultation is the government's last significant input-gathering step before drafting those rules. The businesses that understand the scope, document their AI use cases carefully, and begin building transparency into their AI deployments will be significantly better positioned than those encountering the requirements for the first time as law.

Sources

• Government of Canada. *Have your say on advancing AI transparency in Canada.* ISED, July 23–September 23, 2026. ised-isde.canada.ca
• Government of Canada. *Government of Canada launches public consultation on AI transparency.* Canada.ca, July 23, 2026
• Statistics Canada. *Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026.* statscan.gc.ca
• Office of the Privacy Commissioner of Canada. *Championing privacy in the age of AI — Annual Report 2025-26.* priv.gc.ca
• Office of the Privacy Commissioner of Canada. *PIPEDA Findings 2026-002: Joint Investigation of OpenAI OpCo, LLC.* priv.gc.ca, May 2026
• Prime Minister of Canada. *Prime Minister Carney launches AI for All: Canada's new national artificial intelligence strategy.* June 4, 2026. pm.gc.ca
• Hicks Morley. *New Year, New Rules: Ontario Job Posting Requirements Take Effect January 1, 2026.* hicksmorley.com
• Osler, Hoskin & Harcourt LLP. *AI in Hiring: Ontario Employers Grappling with New Job Posting Disclosure Requirement.* osler.com
• Government of Canada. *Government of Canada tables new legislation to protect children's data, strengthen privacy and build trust in the digital economy (Bill C-36).* Canada.ca, June 15, 2026
• Government of Canada. *AI for All: Canada's National Artificial Intelligence Strategy.* ised-isde.canada.ca

Cloud Forces helps Canadian SMBs navigate the evolving AI compliance landscape — from auditing your AI use for PIPEDA and provincial obligations to building the documentation and governance frameworks that upcoming federal rules will require. Explore our AI Advisory services or contact us to start with an AI compliance audit.