Ottawa Is Consulting on AI Transparency. Europe Shipped It

On July 23, ten days before the EU AI Act's principal transparency application date, Canada opened a consultation on AI transparency. That is a meaningful difference in legal stage: a consultation seeks views, while an applicable regulation imposes defined duties. Neither tells a Canadian firm, without further analysis, that every AI use has the same disclosure or record-keeping obligation. EU AI Act, articles 50, 111 and 113.

What ISED put on the table on July 23

The federal consultation on AI transparency runs from July 23 to September 23, 2026. It supports Canada's National Artificial Intelligence Strategy and invites responses through a survey or by email. Its accompanying discussion paper concerns increasing transparency and trust in AI. Submissions may be made public; the consultation is not itself a binding compliance standard.

The paper's focus on identifying AI-generated material raises a practical limit: information about provenance must remain useful through the actual production and publication workflow. The existence of a technical signal does not by itself show that a particular provider or deployer has discharged a legal duty.

The five questions Ottawa is asking

ISED identifies five areas: identifying AI-generated content; making AI interactions apparent; explaining system development, capabilities and limits; tracking serious incidents; and tracking AI-agent activity. These questions reach beyond labelling individual outputs.

There is overlap with article 50 of the EU AI Act, but its duties differ by role and use. Interaction notices, machine-readable marking and disclosure of specified synthetic or manipulated content are not interchangeable obligations. The Act also contains exceptions and a limited transition for article 50(2) marking obligations concerning systems placed on the market before August 2, 2026.

A small professional firm must first identify what it does with the system and whether the relevant law reaches that activity. Logging can help reconstruct events. It does not replace a required notice, an adequate explanation or an opportunity to make observations.

Strategy, bills and consultations have different effects

A strategy, a parliamentary bill and a consultation occupy different legal positions. The former AIDA proposal in C-27 did not become law. Bill C-36, introduced on June 15, 2026, proposes a new federal private-sector privacy statute. Its parliamentary record places it at second reading; the proposed duties must not be described as already operative.

The transparency consultation is another policy process. Its closing date does not establish when a report, regulation or statute will follow. Firms still need to address their current obligations while proposals develop.

What actually binds a Canadian firm today

The applicable obligations depend on jurisdiction, activity and information. For a Quebec enterprise within the private-sector Act's scope, section 12.1 requires notice when personal information is used for an exclusively automated decision. Specified information and explanations must be supplied on request, including the right to correct the information used. The person must be able to submit observations to a staff member in a position to review the decision. This is not a universal explanation duty for every AI-assisted draft. Section 12.1.

The CAI's sanctions also require precise labels. For persons other than natural persons, administrative sanctions can reach the greater of $10 million or 2% of the preceding financial year's worldwide turnover; penal fines can reach the greater of $25 million or 4%. Natural persons have different limits. The larger penal ceiling is not the administrative tariff for a transparency failure.

PIPEDA and provincial privacy legislation apply within their respective scopes, including relevant commercial cross-border flows. The EU AI Act can also reach third-country providers and deployers where the system's output is used in the Union, subject to the Act's scope and exceptions. Having a client with European customers does not alone settle which duty applies. Article 2.

Buying software against a rule that does not exist yet

For a small firm, procurement should connect each proposed use to an actual duty. Record what the system does, what information it uses and who can explain or reconsider a decision. Then verify the notices, access controls, retention limits and contract terms required for that use. No single logging feature guarantees compliance across all regimes.

That is a design reason for making records inspectable in Supacorp, the entity-management product I am building. Corporate records and AI-operation logs can support related accountability work, but they have different purposes and may contain different information. The governing corporate statute determines which records and filings are required. Select the records and controls needed for that statute and the proposed AI use.

What to watch before September 23

Follow the consultation's published results for the policy direction actually selected, and follow C-36's parliamentary record for changes to the proposed text and its status. Firms can submit evidence about workable safeguards without assuming their preferred architecture will become the legal standard. A consultation response, an announced policy and an enacted obligation should remain distinguishable throughout that process.