Is the October 2026 resolution on AI in health a law?

No. It is a joint resolution of Canada's federal, provincial and territorial privacy commissioners and ombuds, adopted September 15, 2026 and published October 29. It asks governments to legally require AI governance frameworks in health. What binds a clinic today is still its province's privacy law, such as Alberta's Health Information Act.

Do patients have to be able to opt out of an AI scribe?

The resolution says that when consent is required by the applicable privacy law, providers should explain the AI use clearly and, where practicable, offer the choice to opt out before the AI system is deployed. Whether consent is required depends on the province.

Can an AI scribe vendor train its model on patient conversations?

In Alberta, the OIPC's AI scribe guidance says the Health Information Act would likely not permit a vendor to use health information from a custodian to train its AI. The national resolution asks providers to put a ban on unauthorized commercialization or disclosure into their contracts.

AI Scribe Privacy: What Canada's Privacy Regulators Expect

Canada's privacy regulators expect a clinic that uses an AI scribe to explain it to patients and, where practicable, let them opt out before the tool is used; to name a contact person for objections; to have a human check every output; and to sign vendor contracts that bar the vendor from commercializing patient data. AI scribe vendors are expected to show clients how the system was trained and that its use complies with privacy law. That is the core of a joint resolution the federal, provincial and territorial privacy commissioners and ombuds published on October 29, 2026. It is a resolution, not a statute, so it creates no new duty and no penalty. Our read: it is short and concrete enough to work as a vendor questionnaire, and a small clinic should use it that way this month.

Event date: the Office of the Privacy Commissioner of Canada published the resolution and a news release on October 29, 2026. The resolution says it was adopted in Ottawa on September 15, 2026, so it waited about six weeks before going public. We read the resolution, the release, Alberta's AI scribe privacy impact assessment guidance and Ontario's AI scribe announcement on October 30.

News release of the Office of the Privacy Commissioner of Canada dated October 29, 2026: Canada's federal, provincial, and territorial privacy commissioners and ombuds call for the responsible use of artificial intelligence in health and health research, with the four calls to governments

Screenshot: Office of the Privacy Commissioner of Canada, news release of October 29, 2026. Captured October 30, 2026.

Who signed it, and what actually binds

The resolution page carries 14 signature blocks: the Privacy Commissioner of Canada, plus an information and privacy commissioner or ombud for each of the ten provinces and three territories, from Quebec's Commission d'accès à l'information to Nunavut's commissioner. The release says it "was passed at the recent annual meeting" of those offices, hosted in Ottawa by the Privacy Commissioner of Canada and the Information Commissioner of Canada. It names AI scribes directly: AI in health includes "generative AI tools, such as chatbots and AI scribes."

Header of the joint resolution Responsible use of artificial intelligence in health and health research, Resolution of the Federal, Provincial and Territorial Information and Privacy Commissioners and Ombuds, adopted in Ottawa (Ontario) on September 15, 2026

Screenshot: Office of the Privacy Commissioner of Canada, joint resolution page. Captured October 30, 2026.

What binds a clinic is still its province's privacy law. One of the resolution's four asks of governments is to "legally require" AI governance frameworks for everyone who develops, procures and uses AI in health care, which tells you that duty doesn't exist in that form yet. Alberta is the clearest case of existing law already reaching AI scribes. Under the Health Information Act, custodians "are required to submit PIAs to the Commissioner" for new systems that handle identifying health information, and the Alberta commissioner's September 2025 guidance spells out what an AI scribe PIA under section 64 has to cover. Ontario's commissioner released AI scribe guidance on January 28, 2026, with a checklist it says "should be followed by health information custodians", and Commissioner Patricia Kosseim put the order of operations plainly: "Health providers must put in place the core privacy, governance, and accountability measures needed before introducing new AI tools into their practice." British Columbia's commissioner published its own AI scribe guidance the same day.

The provider list, item by item

The resolution gives ten calls to action for "Healthcare providers who procure, adopt, and use AI systems." Six of them change something a five-doctor clinic does on a Monday morning. The table is ours: the resolution's wording, what we'd do, and where Alberta's guidance already turns the point into a requirement.

Item	What the resolution says	What a small clinic does	Already in Alberta's AI scribe guidance
2, opt-out	When consent is required by law, explain the AI use and, "where practicable, offer the choice to opt out prior to the deployment of an AI system"	Ask before the recording starts, not after; note the answer in the chart	Consent rules vary by province; the resolution ties this to "applicable privacy laws"
3, contact person	"Designate a contact person" and let people "challenge any consequential decisions or inferences made"	Put one named person on the privacy notice for AI questions	Not covered in the guidance we read
4, collect less	Limit information "to that which is necessary for their designated purpose"	Switch off features you don't use; set how long audio is kept	The PIA must say "how long the full recording will be retained by the AI scribe and why"
7, contracts	Contracts should prohibit "a contractor or sub-contractor's unauthorized commercialization or disclosure"	Search the vendor terms for "improve", "train" and "de-identified" before you sign	HIA "would likely not permit" a vendor to use custodian health information "to train the AI"
9, shadow AI	Prevent unapproved AI use, for example "a hospital employee who uses their own personally procured AI system"	Give staff the approved scribe and ban personal scribe apps in writing	Not covered in the guidance we read
10, human review	"Human oversight and verification" of outputs, "including through human-in-the-loop review"	The clinician reads and corrects every note before signing it	Custodians "must, at minimum" proofread "any recorded summaries of a patient encounter"

Calls to action 1 to 3 for healthcare providers who procure, adopt, and use AI systems: comply with applicable privacy laws, offer the choice to opt out prior to deployment where practicable, and designate a contact person

Screenshot: joint resolution of September 15, 2026, calls to action for healthcare providers, items 1 to 3. Captured October 30, 2026.

The weak spot is item 2. "Where practicable" and "when consent is required" leave the hard question, whether a patient can refuse and still get the same visit, to provincial law. The resolution doesn't say a clinic can't make opting out costly. It just doesn't address it.

What vendors are asked to hand over

The developer section is the part with teeth for anyone selling an AI scribe, because clinics can paste it straight into procurement. Vendors are asked to know "the provenance of the information used to train each AI system and that the information is lawfully sourced", to ship with privacy settings "the most protective by default", and to give clients and end users a way to challenge AI outputs. Items 3 to 5 are the ones we'd expect a buyer to ask for in writing: "evidence of how the AI system is trained", a demonstration that "the use of the AI system complies with the relevant privacy law", and ongoing risk assessment findings with the fixes clients should apply.

Alberta's guidance shows where US-built tools trip. Its commissioner writes that "We commonly see reference to laws in software vendor contracts that do not apply to health information in Alberta", and the footnote names HIPAA. It also says vendor agreements often let the vendor keep health information after the contract ends, which HIA doesn't permit, and that the contract has to say "the vendor cannot retain a copy for any reason." A HIPAA business associate agreement, on its own, is not the contract an Alberta clinic needs. If you're a five-person vendor, we'd write one plain page per province you sell into: where the data is hosted, whether the model is "static or dynamic" and how it was trained (Alberta's PIA guidance asks for exactly that), how long audio is kept, and what happens to the data on termination.

The contrast with the US this week is hard to miss. On October 28, HHS's HTI-5 rule removed the "model card" source attribute requirements for decision support tools in certified health IT, effective December 28, 2026, as our October regulation tracker covers. One day later, Canada's regulators asked vendors for evidence of how their systems are trained. A vendor selling into both markets should keep its model documentation anyway: item 5 of the provider list tells Canadian clinics to weigh "the results of privacy, security, and AI-specific assessments of prospective AI system developers" before they buy.

What one clinician proposed, and how a commenter answered

The opt-out question is already live in clinics. On July 11, 2026, a clinician posting in r/FamilyMedicine described a plan to tell patients who refuse the AI scribe: "You are free to opt out of my use of the AI scribe but I will need to end your visit 5 minutes earlier." The top-voted comment was "Seems pushy to me personally." Another commenter, u/Hypno-phile, listed the questions they'd ask instead: "Where are the servers physically located? Are they in a jurisdiction where our privacy laws apply?" and "What practices do you have in place to audit the results for errors including hallucinations?"

Both questions show up in Alberta's PIA guidance, which asks vendors to describe "where the tool and health information are hosted" and how often they audit the tool. We wouldn't shorten a visit for a patient who opts out. A regulator reading item 2 next to that policy would be entitled to ask whether the choice was real.

What we couldn't confirm

The release doesn't say why the resolution was published six weeks after it was adopted. We read Alberta's AI scribe guidance in full but not Ontario's or British Columbia's: we couldn't download Ontario's guidance PDF, so it appears here only through its January 28 release and the line on its checklist page. We didn't find any open regulator investigation of an AI scribe in Canada. Whether consent is required for an AI scribe depends on each province's law, and we haven't checked all thirteen provinces and territories.