Write an AI Disclosure Canadians Can Actually Use
Matthew Leo · Published October 31, 2026 · Guides
A notice that says “this service uses AI” tells a customer almost nothing. It does not explain what the system does, what information it sees, whether it makes an important decision or what can go wrong.
Canada’s Office of the Privacy Commissioner made that distinction clear in an October 23 submission to the federal government’s consultation on AI transparency. The submission is policy advice, not a new law, but it gives Canadian organizations a practical standard for notices they can begin improving now.
Start with the moment the person needs the information
The regulator says information must be more than technically available. It should be understandable, accessible and provided at a useful time.
Place the disclosure where the AI interaction or decision occurs. A person should not have to find a general privacy policy, search for the word “automated” and guess which section applies.
Useful trigger points include:
- before a chatbot begins collecting personal information;
- before an automated assessment affects eligibility, price, access or service;
- when AI-generated content could reasonably be mistaken for human-created material;
- when an agent is about to act on the user’s behalf; and
- when the purpose, data sources or consequences materially change.
Answer four basic data questions
The OPC points to its meaningful-consent guidance as a foundation. A usable notice should explain:
- What personal information is collected? Name the important categories rather than using a phrase such as “information you provide.”
- Who receives it? Identify service providers, model vendors or other relevant parties in terms a customer can understand.
- Why is it used? Separate the immediate service from training, analytics, fraud prevention or marketing.
- What are the meaningful risks or consequences? Explain what could affect the person, including an incorrect decision, disclosure to another party or loss of access.
If an organization cannot answer those questions, the problem is not copywriting. It does not yet understand its own AI supply chain well enough to deploy the system responsibly.
Explain the AI’s role, not just its presence
A clear disclosure distinguishes assistance from decision-making.
For example: “This tool drafts a recommendation for a staff member” describes a different process from “This tool decides whether the application proceeds.” If a human reviews the output, explain what that review can change rather than using “human in the loop” as a reassurance.
The notice should also say when a person can request an explanation, correction or human review. Existing Canadian privacy law may already apply when personal information is collected, used or disclosed, even while new AI-specific policy remains under development.
Use layers instead of one dense policy
The first layer should answer what is happening now. A second layer can give technical detail, retention periods, vendor names and contact information.
A short first layer could follow this structure:
What the system does: It reviews the information entered here and suggests a service option to our staff.
Information used: It uses the details in this form and relevant account history.
Important limit: The suggestion may be wrong. A staff member makes the final decision.
Your choice: You can ask for a human explanation or correction through the contact below.
The exact wording depends on the system. The structure forces the organization to identify the decision, the data, the risk and the user’s next step.
Add incident and failure reporting
Transparency cannot end at launch. The OPC says users should have a way to report failures and that organizations should regularly test whether systems behave as intended.
The submission also notes that 40% of breach reports received under the federal private-sector privacy law arrived more than three months after the breach occurred. AI services can make delayed reporting harder because one model or vendor may support many downstream products.
Organizations should therefore decide in advance who receives a complaint, who can pause the system, when a vendor must notify the customer and when affected people or regulators need notice.
A final pre-launch check
- Can a customer tell when they are dealing with AI?
- Can they tell whether it recommends, generates or decides?
- Are important data sources and recipients named?
- Are training and secondary uses separated from the core service?
- Is the most serious realistic consequence stated plainly?
- Is human review meaningful and reachable?
- Can the organization trace a complaint through every vendor involved?
- Will the notice change when the system changes?
This checklist complements Mapletechie’s analysis of Canada’s Children’s Privacy Code, which applies similar ideas to age-appropriate design and privacy-protective defaults.
Primary sources are the OPC’s full submission, its October 23 announcement and ISED’s consultation page. The disclosure framework remains under development; this guide does not treat the submission as enacted legislation.
Tags: privacy, Canada, AI governance, AI transparency