In Canada, software that uses machine learning for a medical purpose is regulated by Health Canada as a medical device, and license applications for Class II, III, and IV machine learning-enabled devices are covered by a pre-market guidance dated April 1, 2026. Patient data handled by clinical AI tools falls under provincial health privacy laws such as Ontario's Personal Health Information Protection Act (PHIPA) or, in other settings, the federal Personal Information Protection and Electronic Documents Act (PIPEDA). The Artificial Intelligence and Data Act, which would have set AI-specific duties, died with Bill C-27 in January 2025, so existing device and privacy rules do the work.
Key takeaways
- Health Canada's machine learning-enabled medical device (MLMD) guidance applies to new and amended Class II, III, and IV license applications.
- A predetermined change control plan can pre-authorize planned model updates without a new amendment for each one.
- Which privacy law applies depends on the province and on who holds the data, so it is decided case by case.
- Ontario's privacy commissioner issued AI scribe guidance on January 28, 2026, and Ontario runs a government-supported scribe program.
- One Toronto hospital study reported fewer unexpected deaths with an early warning tool, but it covered a single site.
How Health Canada treats machine learning in devices
Health Canada's pre-market guidance for machine learning-enabled medical devices is dated April 1, 2026. It applies to manufacturers submitting new or amended applications for Class II, III, and IV devices, and it covers the machine learning system itself: the models and the training algorithms. Standalone software and devices with embedded software can both qualify, and the department says the document reflects its current thinking and may be revised as the technology matures.
The guidance asks manufacturers to show that training, tuning, and test datasets represent the Canadian population and the intended patient group. Risk analysis is expected to address bias, overfitting, performance degradation, automation bias, and alarm fatigue, and performance should be reported for relevant subgroups. Sex- and gender-based analysis (SGBA Plus) is recommended. Labeling should describe intended use, how the model works, data characteristics, performance limits, and any planned changes. Clinical validation evidence is required for Class III and IV devices and should be available on request for Class II. Cybersecurity is handled in a separate Health Canada document.
Updating a model after approval
Machine learning models are often retrained, which raises a licensing question: does every retraining need a new amendment? The guidance answers with the predetermined change control plan (PCCP). A PCCP has three parts, a description of the planned changes, a protocol for making and testing them, and an impact assessment. If Health Canada accepts the plan, changes that stay inside it do not need a significant-change amendment. Changes cannot alter the medical purpose or intended use, and the cover letter of the application should state that a PCCP is included.
Who oversees what in a clinical AI project
Several bodies can be involved in one deployment. The table summarizes the main layers; it is a simplified orientation, and an organization's legal counsel or privacy office decides how the rules apply to a specific project.
| Question | Rule or body | What it covers |
|---|---|---|
| Is the software a licensed device? | Health Canada, Medical Devices Regulations | Safety and effectiveness evidence, labeling, change control for Class II to IV devices |
| Who protects health data in Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia? | Provincial health privacy laws, such as PHIPA | Personal health information held by custodians in that province |
| Who protects personal data in Alberta, British Columbia, and Quebec businesses? | Provincial private-sector laws | Personal information handled inside the province |
| What about data crossing borders? | PIPEDA | Transfers across provincial or national lines, and federal works and businesses |
| Who guides the use of AI scribes in Ontario? | Information and Privacy Commissioner of Ontario | Vendor assessment, contract terms, monitoring, and governance |
The Office of the Privacy Commissioner of Canada explains on its page on provincial laws that may apply instead of PIPEDA that one organization can fall under more than one law, so the applicable law is determined case by case.
AI scribes in Ontario
Ambient scribes, which listen to a visit and draft the clinical note, are among the most visible tools in Canadian clinics. Ontario's AI Scribe Program launched in 2025 through the Ministry of Health and Ontario Health, with Supply Ontario and OntarioMD as partners. Supply Ontario maintains a vendor-of-record arrangement with pre-qualified products and discounted pricing, and says the vetted tools meet provincial data security and privacy requirements for clinical settings.
On January 28, 2026, the Information and Privacy Commissioner of Ontario released "AI Scribes: Key Considerations for the Health Sector" with a companion checklist. The guidance speaks to developers, procurers, and users, and stresses governance, accuracy, bias, and patient trust under PHIPA. A vendor list does not replace a clinic's own duties as the custodian of patient information.
One hospital example: an early warning tool
At St. Michael's Hospital in Toronto, part of Unity Health Toronto, a tool called CHARTWatch monitors patients on a general internal medicine ward and alerts clinicians to those at high risk of unexpected death or transfer to intensive care. A study published in the Canadian Medical Association Journal in September 2024 reported a 26 percent reduction in unanticipated mortality after rollout. It compared 4,023 patients treated while the tool was running with 9,626 earlier patients, and it used subspecialty units without the tool as a reference group.
The authors treated the result as promising rather than conclusive. The study took place at one hospital, the two periods differed in length, and the alerts came with a response process that included senior assessments and frequent nursing checks, so the effect cannot be credited to the algorithm alone.
Questions a clinic can ask before adopting a tool
- Is the product a licensed medical device, and for which intended use?
- Does the vendor describe the training data, known limits, and performance across patient groups?
- Where is patient data stored and processed, and is it reused for training?
- Which law governs the data, and has a privacy impact assessment been completed?
- Who reviews outputs before they enter the record, and how are errors reported?
- How will model updates be communicated and tested?
This article gives general information about regulation and privacy. It is not medical or legal advice, and it does not recommend a product. Decisions about care belong with a patient and their clinician, and questions about legal duties belong with a qualified professional or the primary sources listed below.
FAQ
Does every AI tool used in a hospital need a Health Canada license?
No. The device rules apply when software is intended for a medical purpose, such as diagnosis or treatment decisions. Administrative tools are assessed differently, and the Medical Devices Regulations and Health Canada's guidance define the boundary.
Can a licensed AI device keep learning after approval?
Only within limits. A predetermined change control plan can pre-authorize defined changes, but changes that alter the intended use or medical purpose fall outside it.
Is patient data used for AI covered by PIPEDA?
It depends. In Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia, provincial health privacy laws govern personal health information, while PIPEDA still applies to data crossing borders and to federal works and businesses.
Is there a Canadian law written specifically for health AI?
Not as of the last check in October 2026. The proposed Artificial Intelligence and Data Act did not pass, so device licensing, privacy statutes, and professional standards apply.
Related reading
- Canada's approach to AI regulation
- Fairness of AI in health care
- AI in nursing education
- AI and the future of patient care
More in AI in health.
Last verified: October 2026
Sources
- Pre-market guidance for machine learning-enabled medical devices, Health Canada, 2026
- Provincial laws that may apply instead of PIPEDA, Office of the Privacy Commissioner of Canada, 2026
- Annual report 2024-25 (on the lapse of Bill C-27), federal Privacy Commissioner's office, 2025
- IPC releases new guidance on AI scribes to help protect patient privacy, Information and Privacy Commissioner of Ontario, January 28, 2026
- Ontario AI Scribe Program news, Supply Ontario, February 10, 2026
- AI tool reduces risk of unexpected hospital deaths by 26 per cent, University of Toronto News, September 2024
- Verma AA et al., Clinical evaluation of a machine learning-based early warning system for patient deterioration, Canadian Medical Association Journal, 2024