On October 23 the Office of the Privacy Commissioner of Canada published its submission to Innovation, Science and Economic Development Canada's consultation, Enhancing trust in artificial intelligence through increased transparency. The submission itself is dated September 23, the day the consultation closed, so nothing new was decided this week. What changed is that the regulators' positions are now readable, and they tell you the likely shape of future AI disclosure obligations well before anything becomes law.
The five areas
ISED's discussion paper asked about transparency in five areas, and the OPC concurs that issues arise in each:
- AI-generated content. Whether people can tell that something was produced by AI.
- AI interaction. Whether people know they are dealing with an AI rather than a person.
- Information about AI systems. What an organization says about the systems it uses.
- AI incidents. What happens, and who hears about it, when an AI system causes harm.
- AI agents. Systems that take actions rather than produce answers.
Treat that list as the agenda. Whatever Canada eventually requires, it will be built on those five categories, and nothing stops you from answering them now.
The OPC's actual point: available is not the same as understandable
The substance of the OPC's submission is a single sharp argument. Transparency is not achieved by making information exist somewhere. Information about AI systems has to be understandable, and it has to reach people at the moment they are making a decision. The OPC asks that future work explicitly name the provision of decision-relevant information, in a usable format and at the right time, as an objective in its own right.
That is a direct shot at how disclosure is usually done. Burying "we may use artificial intelligence to process your enquiry" in paragraph nine of a privacy policy satisfies availability and fails the test being described. The equivalent done properly is telling someone they are talking to a bot in the first message, not in a document they will never open.
Two other submissions worth knowing about
The Competition Bureau argued that transparency obligations should be proportionate and should target harms rather than technologies, and warned that disclosure requirements can force companies to expose competitively sensitive information. For a small business, the proportionality point is the one to hope prevails: a twelve-person firm using a chatbot should not face the documentation burden designed for a model developer.
The Schwartz Reisman Institute at the University of Toronto went the other direction, arguing transparency should function as governance infrastructure rather than disclosure, and recommending a serious AI incident reporting regime plus requirements for agent identification and activity records. If something like that lands, "what did your agent do last month" becomes a question you need to be able to answer with a log rather than a shrug.
Use the five areas as a self-assessment
- AI-generated content: does anything you publish to customers get produced by AI without review or attribution? Decide your own rule now, because marketing output is where this bites first.
- AI interaction: if you run a website chatbot, is it obvious it is a bot at the point someone asks something that matters, and can a person reach a human?
- Information about AI systems: could you list which AI tools touch customer information, and what each one does? That list is the deliverable.
- AI incidents: if an AI tool produced something wrong that reached a customer, who finds out, who decides, and is it recorded anywhere?
- AI agents: can you say what your agents are permitted to do, and what they actually did? This is the area where most businesses currently have nothing.
The takeaway
Nothing here is binding, and Canadian AI legislation has a history of not arriving. The value in reading a consultation is that it tells you which questions you will eventually be asked, and four of these five are worth answering for ordinary operational reasons regardless of whether a law shows up. The regulator's framing is the part to keep: disclosure that is technically available but practically unreadable is not transparency, and that standard is easier to meet when you design for it than to retrofit later.