Not just Ottawa: AI governance at the provincial level

It's easy to talk about AI in government as if it all happens in Ottawa. Most of it doesn't. The decisions that shape an ordinary day — a hospital appointment, a child-welfare file, a benefit, a licence, a school placement — are made by provinces. If AI is going to do real good, or real harm, in the public sector, that's mostly where it will happen.

And the rules there are not vague. Ontario has FIPPA for public bodies and PHIPA for health information, and in early 2026 its privacy and human-rights commissioners jointly set out principles for trustworthy AI in the public sector. Québec has Law 25, one of the more demanding privacy regimes on the continent, with real obligations around automated decisions and a right to be informed; Bill 96 adds language requirements any citizen-facing system has to respect. These aren't drafts. They're in force.

Different province, same five questions

What's striking, working across these regimes, is how much they rhyme. The words differ — FIPPA, PHIPA, Law 25 — but underneath, each asks the same handful of things: was this person's information used for a purpose they'd recognise; can you explain how an automated decision about them was reached; was a human meaningfully involved; can someone contest it; and can you prove all of that afterward?

Those are the same questions a federal department faces, and the same ones a bank or a hospital faces. Which is the whole reason a governance layer is worth building once and configuring per jurisdiction, rather than rebuilt from scratch for every statute.

• Ontario — FIPPA for public bodies, PHIPA for health, and the privacy/human-rights principles for trustworthy public-sector AI.
• Québec — Law 25's rules on automated decisions and the right to be informed; Bill 96 on language.
• Everywhere — a human who can see, understand, and stop a decision before it becomes a fact about someone's life.

Where Eloryn fits

Eloryn's demo leans into exactly this. Alongside the federal examples, it governs an Ontario body and a Québec one, each held to its own law — FIPPA and PHIPA on one side, Law 25 and Bill 96 on the other — from the same underlying engine. The point isn't that the rules are identical; it's that the machinery for proving you followed them — identity, scoped permission, human oversight, an unforgeable record — is common, and only the specific obligations change.

Sovereignty isn't only a national word. A province deciding how AI treats its own residents is sovereignty too.

The provinces are where AI governance stops being abstract. It's one thing to publish principles; it's another to have a system that can demonstrate, on a specific file, that a specific resident was treated the way the law promised. That demonstrability — boring, verifiable, on demand — is the part I think matters most, and the part most worth building well.