If your study uses AI on patient data, expect the ethics board to ask for a persuasive case that the benefits outweigh the risks. Canada’s federal, provincial and territorial privacy regulators have asked boards to expect more, and the teams that arrive with a plan will move fastest.
- Canada’s federal, provincial and territorial privacy regulators published a joint resolution on AI in health and health research on October 29.
- It asks CIHR, NSERC, SSHRC and the Panel on Research Ethics to update TCPS 2 for AI.
- Ethics boards are told to demand a persuasive case that benefits outweigh risks.
- The resolution is guidance, not law. You can still answer its questions today.
AI in health research just picked up a to-do list from privacy regulators across Canada. On October 29, the federal, provincial and territorial privacy commissioners and ombuds announced a joint resolution on AI in health care and health research, adopted at their September 15 meeting in Ottawa. Most of it is aimed at governments and vendors. The research section lands on a desk you already deal with: the research ethics board. Our view is that hospital research teams and health AI startups seeking a pilot should not wait for the national ethics policy to be rewritten. Bring a one-page AI addendum to your next ethics submission and answer the regulators’ questions before the board asks them.
What do regulators want from AI in health research?
It asks for three things from the research side. The national ethics policy for human research, TCPS 2, should be updated for AI. Ethics boards should get more training and resources, and should require a persuasive case that a study’s benefits outweigh its risks. Researchers should sharpen their risk assessments and publish their AI study outcomes openly.
The update to TCPS 2 is addressed to the Panel on Research Ethics and the three federal funders: the Canadian Institutes of Health Research, the Natural Sciences and Engineering Research Council and the Social Sciences and Humanities Research Council. The resolution text names two topics for more detailed guidance. One is the risk of re-identifying people when a study feeds de-identified, anonymized or synthetic data to an AI system. The other is bias that creeps in when people with unique characteristics are missing from the participant pool.
The resolution also sets six principles for every AI system in health: privacy protective, valid and reliable, safe, human rights affirming, transparent and accountable. (It is a statement of expectations from regulators, so nothing in it is binding on its own.)
Why should a health AI startup care about ethics boards?
Because a hospital pilot set up as research on patient data goes through a research ethics board, and those boards are now being told to ask harder questions about AI in health research. If your answers on data provenance, re-identification and bias are thin, expect more rounds of questions. A clear file protects your pilot timeline.
The same resolution asks health care providers to vet vendors on their privacy, security and AI-specific assessments, and to write contracts that bar a contractor from commercializing patient information without authority. A startup that can hand over those documents on day one is easier to say yes to. Our earlier piece on the Privacy Commissioner’s vendor due diligence guidance covers the procurement side in more detail.
What goes in a one-page AI addendum?
Six short answers, each tied to something the resolution asks for. Where the data came from and why its use is lawful. How you tested whether de-identified or synthetic data can be traced back to people. Who is missing from the data. Who checks the outputs. Where results will be published. What the vendor contract forbids.
For AI in health research, field 4 deserves more than a name. A recent experiment showed experts often adopt an AI agent’s lean without noticing, which is why we argued that a human in the loop sign-off should record the reviewer’s own call first. The resolution asks health providers for human-in-the-loop review of outputs too, so the same habit fits here.
Does this change anything for clinics using AI scribes?
Yes, at the staff level. The resolution names unapproved personal AI tools as a risk, using the example of a hospital employee running an AI system they bought themselves. If a clinician in your clinic or research unit records patient visits with a personal scribe app, that is the first gap to close.
Provincial regulators have already published scribe guidance that the resolution cites, including Alberta’s privacy impact assessment guidance for AI scribes, Ontario’s key considerations for the health sector and British Columbia’s best practices under PIPA. Start with the one for your province. Our guide to shadow AI in Canadian workplaces has a wider staff survey you can adapt.
What would make us drop the addendum?
If the Panel on Research Ethics publishes AI-specific TCPS 2 guidance with its own required form, use that instead of our template. And if ethics boards in your province tell you they already ask all six questions, the addendum becomes a formatting job and little more. Until either happens, a written answer beats an improvised one at the board meeting.
Draft the addendum before your next board meeting
For more on how Canadian organizations put AI to work, see our AI for business hub.
FAQ
Is the privacy regulators’ resolution on AI in health research legally binding?
No. It is a joint resolution that sets expectations and calls on governments, funders, ethics boards and researchers to act. Existing privacy laws still apply in each province and territory.
What is TCPS 2?
It is the Tri-Council Policy Statement on ethical conduct for research involving humans, used by Canada’s three federal research funders. The regulators want it updated for AI.
Which provinces have AI scribe privacy guidance?
The resolution cites guidance from Alberta, Ontario and British Columbia. Our shadow AI guide covers staff tools more broadly.
Facts checked October 30, 2026.
