Ontario's AI guidelines for municipalities: what a Northwestern Ontario public body needs to know

Ontario's two main privacy and human rights regulators released joint AI principles in January 2026 aimed at public-sector organizations, including municipalities. They are not binding law today, but the regulators say they will inform how complaints and investigations are assessed. Here is what the six principles require and what a Northwestern Ontario municipality should do first.

Ontario does not yet have a binding AI-specific law for municipalities. But as of January 21, 2026, two provincial regulators — the Information and Privacy Commissioner of Ontario (IPC) and the Ontario Human Rights Commission (OHRC) — jointly released Principles for the Responsible Use of Artificial Intelligence. The document is addressed to organizations across Ontario's public sector and broader public sector, and the two commissions stated the principles will inform how they assess organizations' AI use. For a Northwestern Ontario municipality, library board, or public agency using or considering AI, these six principles are the clearest current benchmark for what the province's top privacy and human rights regulators expect.

The legal baseline today: MFIPPA applies to municipal AI right now

MFIPPA — Ontario's Municipal Freedom of Information and Protection of Privacy Act — is the existing law governing how Ontario municipalities handle personal information. It does not mention AI specifically, but it applies whenever a municipality collects, uses, or discloses personal information, including through AI tools. A chatbot handling constituent inquiries, analytics software processing permit data, or a scheduling tool with employee records — all fall under MFIPPA's existing obligations today. Ontario's Responsible Use of AI Directive is a separate, more detailed framework, but it covers provincial ministries and agencies, not municipalities. The IPC and OHRC principles bridge that gap.

The IPC and OHRC joint principles: released January 21, 2026

The joint principles document covers every stage of an AI system's lifecycle — from design and procurement through deployment and decommissioning. Municipalities can be developers, providers, or users of AI, and the principles apply at each stage. They are framed as strongly recommended, not legally required. But the IPC and OHRC stated the principles will "ground our assessment of organizations' adoption of AI systems" — making them the practical benchmark a privacy complaint or human rights investigation would be measured against. The Association of Municipal Managers, Clerks and Treasurers of Ontario (AMCTO) specifically flagged the principles as relevant guidance for Ontario's municipal sector.

What the six principles require, in practical terms

• Valid and reliable: Test the AI system against recognized standards before deploying it and reassess regularly. Input data quality directly affects output quality — a system trained or tested on data that does not represent the population it will be used on will produce unreliable results.
• Safe: Monitor systems actively for harm, including cybersecurity risk. Unexpected outputs should be visible, not hidden. Be prepared to pause or decommission a system that behaves unexpectedly.
• Privacy protective: Collect only the personal data the AI system actually needs. Inform individuals when their personal data is being used by AI. Provide access and correction rights for automated decisions — and for high-stakes decisions, offer an opt-out in favour of a human decision-maker.
• Human rights affirming: Proactively identify and address the risk of systemic discrimination. Audit training data for bias and correct it. Do not apply uniform AI-generated outputs across groups with different circumstances.
• Transparent: Publish plain-language descriptions of your AI systems — what they do, what data they use, and why. Notify people when they are interacting with AI or receiving AI-generated content. Keep internal technical records so that any decision can be explained.
• Accountable: Maintain human oversight, including human-in-the-loop controls for consequential decisions. Conduct privacy, human rights, and algorithmic impact assessments before deployment. Designate a responsible person for each AI system. Create a channel through which concerns can be raised.

What's coming: EDSTA and the AI regulations not yet issued

Bill 194 received Royal Assent in November 2024, enacting the Enhancing Digital Security and Trust Act (EDSTA). The Act covers both provincial and municipal institutions. Under the EDSTA, institutions using AI systems prescribed by regulation would be required to publicly disclose that use and maintain an accountability framework for it. Multiple legal analyses published in early 2026 confirm that as of that point, no AI regulations had been issued under the Act — meaning the AI-specific obligations are not yet in force. Two other EDSTA regulations came into force on July 1, 2026, covering cybersecurity and digital trust requirements, but neither addressed AI. The AI framework is waiting on a regulation to activate it. When that regulation is issued, it will apply to municipalities without any phase-in that has been announced.

A starting point for a Northwestern Ontario municipality

The City of Thunder Bay's Corporate Digital Strategy progress update, covering the period through September 2024, listed as a planned step the formation of an AI working group to evaluate use cases, risks, and policy requirements, reporting through its Information, Digital and Technology Governance (IDTG) Committee. For smaller municipalities across the Northwest — those without a dedicated IT governance structure — the IPC/OHRC principles document is the most accessible starting framework available without legal budget. The practical first step is an inventory: list every tool the organization currently uses that processes personal data or makes or assists a recommendation about a person, identify who is responsible for each, and ask whether staff and management could explain each system's purpose and data sources in plain language. That exercise maps directly onto the Transparent and Accountable principles, and it surfaces the gaps before a complaint or investigation does.

Principles for the Responsible Use of Artificial Intelligence — Ontario Human Rights Commission and Information and Privacy Commissioner of Ontario, released January 21, 2026: https://www.ohrc.on.ca/en/principles-responsible-use-artificial-intelligence | IPC/OHRC joint news release, January 21, 2026: https://www.ohrc.on.ca/en/news-center/privacy-and-human-rights-commissions-release-joint-principles-responsible-use-ai | AMCTO blog on the IPC guide for municipal audiences: https://www.amcto.com/network-community/blog/new-ipc-guide-principles-responsible-use-ai | Ontario government AI page (confirms the Responsible Use of AI Directive covers ministries and provincial agencies): https://www.ontario.ca/page/artificial-intelligence-ai-ontario | Lerners LLP analysis of the IPC/OHRC principles, January 2026: https://lerners.ca/insights/ai-governance-reimagined-ontario%E2%80%99s-new-joint-principles-for-the-responsible-use-of-artificial-intelligence | Gowling WLG on EDSTA/Bill 194: https://gowlingwlg.com/en-ca/insights-resources/articles/2026/artificial-intelligence-in-public-decision-making | City of Thunder Bay Digital Strategy page: https://www.thunderbay.ca/en/city-hall/digital-strategy.aspx | General information only — confirm specific legal obligations with municipal counsel.