By Cameron A. Axford and Martin U. Wissmath

On July 15, 2025, the Office of the Information and Privacy Commissioner of Alberta (“AB IPC”) released its Comments from the Office of the Information and Privacy Commissioner Regarding Responsible AI Governance in Alberta (“Report”). The Report sets out recommendations about how Alberta might regulate artificial intelligence in the future, reflecting the AB IPC’s views on what an ideal legal and policy framework could look like if enacted.

The issues raised in the Report are relevant for charities and not-for-profits that handle personal information or are considering the use of AI tools in their operations. Importantly, the AB IPC stresses that even a robust privacy law regime on its own is not sufficient to address the full range of risks and challenges presented by AI, requiring a broader legal and policy response. The views of the AB IPC regarding AI regulation may become influential in other provinces and federally.

At the centre of the AB IPC’s Report is the suggestion that Alberta adopt a standalone AI law to complement existing privacy statutes. The AB IPC notes that current laws, including the Personal Information Protection Act (PIPA), the Health Information Act (HIA), and the new Protection of Privacy Act (POPA), provide only limited oversight of artificial intelligence. In the Commissioner’s view, AI is advancing too quickly and carries too many risks to be addressed solely through privacy law. Drawing on the federal government’s previously proposed Artificial Intelligence and Data Act (AIDA) and the European Union’s AI Act, the AB IPC argues that Alberta-specific rules would better reflect provincial jurisdiction over healthcare, commerce, and public services. The acceptance of these proposals would eventually have implications for charities and not-for-profits that use AI in their work.

For charities and not-for-profits (NFPs), one of the most significant themes in the AB IPC’s Report is the treatment of privacy and data stewardship. The Report emphasizes anonymization and de-identification as safeguards when personal or health information is used in AI systems. This is an important consideration for organizations that maintain donor databases, membership records, or sensitive client files. Although the AB IPC cannot impose new obligations on its own, its recommendations indicate where regulation may head in the future. Organizations in the sector would therefore be well advised to keep in mind that new expectations around the use of personal information with AI could emerge.

Another theme is governance. The AB IPC Report highlights fairness, transparency, accountability, and good governance as essential principles for AI oversight. These are values that align closely with the fiduciary duties of charity and NFP directors, who already bear responsibility for ensuring their organizations operate lawfully and ethically. The Report suggests that boards may need to think about AI use in the same way they think about data protection or cybersecurity, treating it as a governance matter that requires risk assessment and oversight. These recommendations reflect an evolving standard of care that boards may eventually be expected to meet if such rules are introduced.

The Report also notes the importance of public trust. Surveys conducted by the Commissioner show that Albertans are cautious about AI, particularly in healthcare and government services. Charities and NFPs rely heavily on the trust of donors, members, and communities. The AB IPC’s comments underline the risk that adopting AI tools without clear explanations and safeguards could undermine that trust, signalling that regulators are paying attention to managing public concern and perceptions of AI adoption, which matters as much to charities as to government.

Finally, the Report encourages engagement with its process. The Commissioner has invited government, health, and private sector stakeholders to provide input into the development of a framework for responsible AI governance. Although charities and NFPs are not the primary audience, the sector does have a perspective worth contributing. Advocacy organizations and umbrella groups may wish to consider participating in consultations, particularly to highlight the challenges of compliance for smaller organizations and the unique sensitivities of handling health or client data.

The AB IPC has outlined a possible direction for Alberta, but these remain suggestions at this stage. Still, they provide useful insight into how regulators are thinking about AI, and they give organizations an opportunity to prepare. Charities and NFPs that already collect or use personal information in ways that may intersect with AI should take note of these recommendations, both for risk management today and for planning ahead in case government decides to act on them in the future.

​Read the September 2025 Charity & NFP Law Update