Bill 194: Ontario’s missed opportunity to lead on AI

What if the most transformative technology of our time — artificial intelligence — was already impacting Ontarians’ lives without the protections we deserve?

Ontario’s Strengthening Cyber Security and Building Trust in the Public Sector Act, arguably the most consequential bill of the current legislative session, was adopted last Monday.

Bill 194 regulates some of the most significant digital issues of our time: cybersecurity, artificial intelligence, and children’s digital information. Yet it leaves all the critical rulemaking for future regulations to be set by government overseeing its own public institutions. The lack of transparency, explicit independent oversight and democratic process around this bill should be a concern for all Ontarians. 

AI is already transforming public services in Ontario, shaping decisions in health care, education, and social services. Done right, AI can enhance efficiency and improve outcomes. Done wrong, it can cause serious harms and have discriminatory impacts. Bill 194 was Ontario's chance to set clear statutory guardrails for public sector use of AI. Unfortunately, that chance has come and gone, leaving Ontarians without the certainty and protections they deserve.

When AI systems influence decisions that touch people’s lives, we must demand that they respect the fundamental principles we all value as a society. 

To be trustworthy, AI systems must be valid and reliable. They must undergo meticulous testing, with human review, to verify that they’re functioning reliably for the purpose for which they were designed, used, or implemented, under real-world conditions.

AI must be safe and designed to protect our lives, physical and mental health, property and economic security, and the environment. This requires robust monitoring and cybersecurity measures.

AI must be developed using a privacy-by-design approach, with safeguards built in right from the start to minimize data collection, reduce privacy and security risks, and ensure personal information is used only when necessary. 

Institutions must be transparent about their use of AI by adopting accessible policies and practices that clearly explain to Ontarians how they are using AI and supporting their access to information rights. 

They must also set clear rules and processes to manage every stage of AI development — from its creation and use to any changes or retirement of AI systems. 

AI-enabled decisions by must be traceable — institutions must clearly explain how automated decisions are made and take responsibility for the outcomes. People must be provided with ways to challenge AI decisions, and there must be independent oversight to hold institutions accountable.

Most importantly, AI must affirm the human rights of individuals and communities and actively address historical biases to ensure that decisions made or assisted by AI are fair, non-discriminatory, and respectful of human dignity. 

These are foundational principles. Yet Bill 194 mentions none of them. Instead, it authorizes the minister to set out eventual rules by way of regulation. Regulations are easier to make and change as the technology evolves. This need for flexibility may make sense at the level of technical detail, but not at the level of principle. 

Can you imagine a world where we would not want AI to be valid and reliable, safe, privacy-protective, transparent, accountable and human rights-affirming? 

These globally recognized principles should have been codified in Bill 194 to signal a clear government commitment to stand and live by them. Public institutions seeking to use Ontarians’ data in AI systems or other applications should be bound by these principles as a non-negotiable part of the social contract. Principles as fundamental as these should not be left to the whim of a murky regulation-making process. 

Moreover, these principles cannot exist in a vacuum — they require independent oversight to ensure compliance and hold public institutions accountable for potential misuse or harm. Bill 194 provides no clear or direct avenue for individuals to file privacy complaints to my office if they are legitimately concerned about the over collection, misuse or inaccuracy of their personal information and consequential decisions made about them, including through AI.

Without statutory guardrails and explicit independent oversight, Bill 194 missed the opportunity to secure Ontarians’ trust in AI’s promise to deliver a prosperous digital future for them and their children. 

But continue forward we must. For my part, I will continue to advocate for stronger protections, clearer accountability, and independent oversight throughout the regulation-making process to ensure AI is used to serve Ontarians, not the other way around.