Why FIPPA matters for AI
FIPPA sets the baseline for how Ontario public institutions collect, use, disclose, and dispose of personal information. When an AI system touches personal data, all of those obligations travel with it. That sounds straightforward. The trouble is that AI systems move data in ways the original FIPPA framework did not contemplate: through third-party vendors, across training sets, and into outputs that can be difficult to audit.
The Information and Privacy Commissioner of Ontario has been clear that existing FIPPA principles apply to AI. They have also signalled that AI-specific guidance and expectations are coming. If you wait for every detail to be finalized, you will be behind. The privacy officers XPawn works with are building FIPPA-aligned AI practices today.
Five obligations FIPPA imposes, as they apply to AI
FIPPA does not codify these as a named five-principle framework. They are a working summary of the collection, use, and disclosure obligations FIPPA places on public bodies, framed for privacy officers who now need to apply those obligations to AI systems.
1. Authority to collect
Every piece of personal information your organization collects must be authorized by statute or for the administration of a program. AI does not change this. What changes is how easy it is to accidentally collect more than you need. An AI tool that ingests raw inputs and derives inferences may be collecting information your privacy officer never approved.
2. Purpose limitation
Information collected for one purpose cannot be reused for another without authority. AI models trained on your data, or feedback loops that improve a vendor's product, can quietly violate this principle. Vendor contracts need explicit terms about training, retention, and derivative uses. Boilerplate is not enough.
3. Data minimization
Collect what you need, nothing more. This is the principle AI stresses most. Large language models, in particular, do better with more context, and there is a natural temptation to feed them more. That temptation must be policed. Minimization should be designed into prompts, pipelines, and interfaces.
4. Accuracy
Personal information used by an institution must be accurate and complete to the extent needed for its purpose. AI outputs are not guaranteed to be accurate. If an AI-derived note enters a record of decision, your organization is still responsible for its accuracy.
5. Disclosure and transfer
FIPPA limits when personal information can be disclosed, especially across borders. Many AI vendors process data outside Canada. If your institution sends personal information to a US-based foundation model, you need a defensible path through FIPPA's disclosure rules, or you need to route through a Canadian residency tier.
XPawn's field observation: nine times out of ten, the FIPPA gap is in procurement. The clinical team picks a tool, operations approves it, and privacy gets the contract last. By then the FIPPA concerns are structural, not fixable through policy alone.
The AI-specific PIA
A standard Privacy Impact Assessment was not built for AI. It asks about collection, use, and safeguards. It does not ask about training, inference, hallucination rates, or prompt injection. An AI-specific PIA adds layers that address:
- Whether the vendor uses customer data for model training
- Where inference happens and where data rests in transit
- How accuracy is measured and reported back to the institution
- Whether the tool provides an audit trail sufficient for FOI requests
- How the institution will detect and respond to AI errors affecting individuals
XPawn delivers AI-specific PIA templates as part of our consulting engagements. They are designed to slot into existing privacy programs and be defensible to the Information and Privacy Commissioner if audited.
What privacy officers should do now
- Add AI-specific questions to your PIA template
- Require an AI questionnaire for every vendor contract, new or renewing
- Map where personal information currently leaves your network for AI processing
- Establish a standing AI review committee with IT, legal, and a clinical or operational lead
- Schedule quarterly reviews of the AI inventory
How XPawn helps
XPawn runs FIPPA-aligned AI privacy assessments as a fixed-scope engagement. We work alongside your privacy officer, not around them. The output is a set of living documents your team can maintain: PIA templates, vendor questionnaires, and a risk register that survives after we leave. For organizations looking for ongoing support, we offer quarterly advisory retainers. Learn more on our consulting page or contact XPawn.