CPSO AI Policy Template: What Ontario Medical Clinics Need in Writing (2026)

Ontario physicians searching for a 'CPSO AI policy template' are usually reacting to the same three things: an AI scribe vendor pitching the clinic, a staff member already pasting patient details into ChatGPT, and a growing sense that the College expects something in writing. All three instincts are right. The College of Physicians and Surgeons of Ontario (CPSO) has published Advice to the Profession on using artificial intelligence in clinical practice, and Ontario's Information and Privacy Commissioner (IPC) released dedicated AI scribe guidance in January 2026. Neither hands you a policy. This guide explains what they expect and what a clinic policy must say to meet it.

What CPSO actually expects

CPSO's Advice to the Profession, 'Using Artificial Intelligence in Clinical Practice', replaced its earlier advice that covered only AI scribes and now spans scribes, intake and triage tools, and clinical decision support. Its central message is that AI changes nothing about who is responsible. There is no AI-specific law or College policy; instead, every existing expectation applies with full force, and the physician remains accountable for the record, the decision, and the patient's privacy.

• Obtain the patient's consent before recording a clinical encounter with an AI scribe, and explain what the tool does — for example, that it will listen to and summarize the conversation for documentation.
• Inform patients about how AI is being used in their care. Transparency is expected even where consent is not strictly required.
• Confirm that any AI tool handling patient information complies with the Personal Health Information Protection Act (PHIPA) and with CPSO's Medical Records Management, Medical Records Documentation, and Protecting Personal Health Information policies.
• Review every AI-generated note, summary, or recommendation before it enters the chart or influences care. AI output may be inaccurate, and the physician who signs the record owns its content.
• Retain clinical judgment. AI decision support may inform a decision; it may not make one.

What the IPC added in 2026

On January 28, 2026 the IPC published 'AI Scribes: Key Considerations for the Health Sector', with a companion checklist for health information custodians. It is the most concrete Canadian guidance on clinical AI to date, and it is explicitly a governance document: the IPC recommends that custodians establish a governance and accountability framework before adopting AI, not after. That framework is, in practice, your clinic's AI policy plus the procedures behind it.

• Governance: someone accountable for AI decisions in the clinic, with oversight that covers the whole lifecycle from procurement to decommissioning.
• Risk assessment: clear criteria for when a privacy impact assessment is required, and a way to monitor the tool after deployment, not just before.
• Vendor assessment and contracts: due diligence on where data is processed and stored, whether patient information is used to train models, retention periods, and the contractual safeguards that bind the vendor as your agent under PHIPA.
• Security safeguards appropriate to personal health information, including access controls and audit logs.
• Transparency with patients, and an ability to answer questions about how the tool handles their information.

The sections an Ontario clinic AI policy needs

A workable policy for a clinic of any size fits in a few pages. It should read as clinic rules, not as a summary of the regulators. These are the sections that map to what CPSO and the IPC expect:

• Scope: who the policy covers (physicians, nurses, allied staff, administrative staff, students, locums) and every kind of AI tool, including features built into your EMR.
• Approved tools: the specific AI tools the clinic has vetted for personal health information, and a rule that nothing else may touch patient data. Consumer chatbots on personal accounts are the most common breach and should be named as prohibited.
• Consent and notice: the script staff use to ask for consent before an AI scribe records, what happens if the patient declines, and how patients are told about AI use in general.
• Data rules: what may never enter an AI tool (anything identifying a patient, unless the tool is approved for PHI), and the requirement that approved tools have training opt-out enabled and a signed agreement with the clinic.
• Physician review: every AI-generated note is read and corrected before signing; AI decision support never substitutes for clinical judgment.
• Vendor process: who approves a new tool, what the assessment covers (data location, training use, retention, breach notification, PHIPA agent terms), and when a privacy impact assessment is required.
• Incident reporting: what staff do when patient information reaches an unapproved tool, including self-reporting without penalty, so incidents surface.
• Review date: AI tools and guidance are changing quickly; the policy names an owner and an annual review.

Mistakes that make clinic AI policies fail

• Banning AI outright while the EMR vendor quietly ships AI features inside the software staff already use.
• Treating the AI scribe's own privacy policy as the clinic's policy. The vendor's document protects the vendor.
• Writing consent language nobody can say out loud at the start of a fifteen-minute appointment.
• Forgetting administrative staff. Front-desk use of AI for patient messages and referral letters involves PHI just as clinical use does.
• Never collecting acknowledgments, which leaves the clinic unable to show a regulator that staff were told the rules.

The fast path

Our generator produces a complete clinic AI policy with Canadian privacy clauses, healthcare-specific data rules, and Canadian spelling when you select Canada as your jurisdiction, plus a vendor assessment checklist and a staff acknowledgment form in the full pack. Preview the entire document free before paying. It is a self-help template, not legal advice; have your privacy officer or counsel review it before adoption.