What Bill 194 is
Bill 194 does two distinct things. It enacts a new statute, the Enhancing Digital Security and Trust Act, 2024 (EDSTA), and it amends the Freedom of Information and Protection of Privacy Act (FIPPA). Together, these changes establish Ontario's clearest signal yet that AI cannot be treated as a shadow IT issue. Senior leadership, privacy officers, and boards are now on the hook for what AI tools their organization deploys and how those tools behave.
EDSTA itself covers three substantive areas that matter for AI leaders. The first is cybersecurity: entities must have programs, incident reporting, and attestations in place. The second is AI: when AI is used in ways that affect individuals, organizations are expected to maintain transparency, risk management, and accountability for those systems. The third is a distinct set of protections for digital information and technology related to children, which hospital, school board, and children's aid society clients will encounter as a separate compliance workstream. On top of EDSTA, the FIPPA amendments add mandatory privacy impact assessments before collecting personal information and breach reporting to the IPC.
Who it applies to
Bill 194's scope is specific. It captures:
- Institutions within the meaning of FIPPA (including provincial ministries, agencies, universities, colleges, and hospitals)
- Institutions within the meaning of MFIPPA (municipal and local public bodies)
- Children's aid societies
- School boards
If your institution is in this group, Bill 194 already applies to you. The question is how defensible your current AI practices would look if the IPC asked tomorrow.
What XPawn hears from clients: most public sector leaders know the law is in force. Few feel ready to defend their current AI inventory if asked to produce it tomorrow.
The AI obligations that matter most
1. You need an AI inventory
Regulators, privacy officers, and boards will want to see a defensible list of AI systems in use across your organization, including vendor tools, embedded features, and anything your staff may be using without central oversight. This is not optional. Building the inventory is often the first shock: organizations consistently find more AI in use than they expected.
2. You need risk classification
Not every AI tool carries the same stakes. A scheduling assistant is different from a clinical triage tool. Bill 194 expects you to classify AI systems by risk and apply controls proportional to that risk. Without a classification system, your governance cannot be prioritized or defended.
3. You need transparency where AI touches people
If AI is used to make or substantially inform a decision about a person, expect to explain that use. This does not always mean notifying every user of every feature, but it does mean having a clear record of where AI sits in your decision flows and being able to describe it when asked.
4. You need incident readiness
Cybersecurity provisions require incident programs that include reporting, escalation, and remediation. AI failures, including data leaks, hallucinations affecting decisions, and prompt injection attacks on public-facing tools, now fall within this frame. Your incident playbook needs to address AI, not just traditional IT.
A 90-day catch-up plan
Most organizations are not starting from zero. They are starting from a disorganized middle, with the statute already in effect. Here is the plan XPawn recommends for the first 90 days of catch-up work:
- Weeks 1 to 4: Build the AI inventory. Survey every department, review vendor contracts, audit embedded AI in existing software. Document in a single registry.
- Weeks 4 to 8: Classify each system by risk. Flag high-risk systems for immediate review. Validate that contracts include appropriate AI clauses.
- Weeks 8 to 12: Draft an AI governance policy keyed to Bill 194's expectations. Get privacy officer, legal, and executive sign-off. Brief the board.
What a privacy officer should do now
Privacy officers are the quiet backbone of Bill 194 readiness. A short list of high-leverage moves:
- Add an AI section to every new and renewed PIA
- Build a vendor AI questionnaire for procurement
- Hold quarterly AI review meetings with IT and clinical leads
- Subscribe to updates from the Ontario Ministry of Public and Business Service Delivery and Procurement, and from the Information and Privacy Commissioner of Ontario
Where XPawn can help
XPawn runs Bill 194 compliance reviews as a fixed-scope engagement. In four to six weeks, we produce an AI inventory, a gap analysis against Bill 194 obligations, and a prioritized roadmap your executive team can act on. For organizations that want ongoing support, XPawn also offers a monthly advisory retainer that includes regulatory horizon scanning, vendor reviews, and policy refreshes. Visit our consulting page or contact XPawn to talk through your situation.