Key takeaways
- On October 23, 2026, the OPC published its submission to ISED’s AI transparency consultation, agreeing with the five areas ISED named but adding its own test: information must be understandable and available at the point of decision, not merely published somewhere.
- The submission borrows PIPEDA’s meaningful consent standard: disclosure must cover what is collected, who it is shared with, the purposes, and the risks and consequences.
- Its sharpest number warns about incident reporting: 40% of PIPEDA breach reports arrive more than three months after the breach, a delay the OPC traces to “as soon as feasible” timing.
A consultation response that sets a test
The OPC published its submission on October 23, 2026, responding to Innovation, Science and Economic Development Canada’s discussion paper on building trust in AI through increased transparency. The submission is dated September 23, 2026, signed by Deputy Commissioner Marc Chénier, and agrees with the five areas where ISED says transparency problems arise: AI-generated content, AI interaction, information about AI systems, AI incidents, and AI agents.
The test the OPC adds is what will matter to anyone writing a disclosure or a vendor questionnaire. ISED’s paper defines transparency broadly as the availability of information about AI systems. The OPC says that is too thin: information must be understandable and accessible when it matters to a person’s decision. That is PIPEDA’s meaningful consent standard, carried into AI: Principle 4.3.2 requires purposes stated so a person can reasonably understand them, and section 6.1 makes consent valid only where the person would understand the nature, purpose, and consequences of the processing.
The five areas, and what the OPC actually asked for
| Area | What the OPC asked for |
|---|---|
| AI-generated content | Labelling that protects the person depicted as well as the person viewing. |
| AI interaction | Disclosure when an automated system makes or informs a significant decision about a person, and when an AI system collects personal information without direct interaction. |
| Information about AI systems | Disclosure of known limitations and intended uses, including training data limits. |
| AI incidents | A way for users to report failure cases, regular testing by developers, and timelines fixed in advance. |
| AI agents | Nothing specific yet. The OPC says its work here is ongoing. |
Labelling helps the subject too
Most of the generated content debate is framed around the viewer: can the person scrolling tell this image or text is synthetic, so they are not deceived. The OPC adds the other side. A person who is the subject of synthetic content benefits when that content is labelled, because an organization deciding about them is less likely to treat a fake as fact. The proposed Protecting Privacy and Consumer Data Act in Bill C-36 would give people more control over personal information online, including a right to deletion covering synthetic content, and the February 2026 joint statement signed by 66 data protection authorities expects meaningful information about capabilities and safeguards, rapid removal mechanisms, and enhanced safeguards for children. Watermarking outputs for viewers is half a program; the other half is a removal path that works fast.
The four questions every disclosure must answer
On interaction transparency, the submission reaches back to the OPC’s Guidelines on Obtaining Meaningful Consent: disclosure must emphasize what is collected, who it is shared with, the purposes, and the risks of harm and other consequences.
Two cautions come with that. First, over-disclosure is a real failure mode: the OPC repeats its former Bill C-27 position that limiting a general account of automated decision system use to uses that could have a significant impact strikes a reasonable balance. Second, do not build a second disclosure universe: detail should follow impact, not whether an AI system happens to be in the chain, and people should not have to read one document for AI-involved handling and a different one otherwise. Teams drafting separate “AI notices” apart from their privacy notices should hear that warning before any rule exists: the split itself is a defect.
The number that should change the incident conversation
The submission’s incident section carries its hardest evidence: 40% of breach reports under PIPEDA arrive more than three months after the breach occurred. The OPC traces the delay to PIPEDA’s “as soon as feasible” standard, which weakens its oversight role, delays its advice to organizations, and leaves people exposed longer than necessary. Read that as a design instruction for any AI incident reporting regime: copy that wording without a fixed clock, and expect the same three month tail. The OPC also wants a mechanism for users to report failure cases, alongside regular testing by developers.
On system information, the point is parallel: tell buyers about known accuracy limits and intended uses, including where training data is time bounded or drawn from a single, non-representative source. The joint ChatGPT investigation with Quebec, Alberta, and British Columbia recommended telling users in Canada about the general level of accuracy of personal information in outputs, in plain language. If a vendor cannot tell you where its system is weak, reconsider whether the use is appropriate at all.
What stays open
Agents get the shortest section, and that thinness is itself information. The OPC says its work on agentic AI is ongoing, including through the Global Privacy Assembly, and it will share more when it can. No positions, no timelines, no disclosure list. Teams deploying agents now are writing their own rules for disclosure, logging, and authority limits, and should expect the regulator’s version to arrive later. That is the thread to watch.
Actionable takeaway: Audit one AI disclosure this week against the OPC’s test. Pick the disclosure a customer or employee actually sees before a significant decision, and check it against the four questions: what is collected, who gets it, for what purpose, and what harm could follow. If any answer lives in a separate AI notice, in a linked policy, or in language a non-specialist cannot follow at the moment of decision, that disclosure fails the test the OPC just set.