A practical AI implementation guide for Ontario hospital boards A practical AI implementation guide for Ontario hospital boards

Artificial intelligence is already at work in Ontario hospitals, drafting clinical documentation, flagging deteriorating patients, reading medical images and scheduling operating rooms. Every hospital board is therefore already exercising AI oversight, deliberately or by default. Under the Public Hospitals Act and the Not-for-Profit Corporations Act, 2010, boards must govern the activities of the hospital — and, under Regulation 965, the Hospital Management Regulation, monitor them. AI is now one of those activities.

This guide began when preparation for an Ontario hospital’s 2026 accreditation survey revealed that none of the governance instruments the board relied on — accreditation standards, insurer risk taxonomies, its own enterprise risk framework — named AI as a matter requiring board oversight. The absence of a signal is not the absence of a duty. The regulatory environment is moving quickly: the first regulation under the Enhancing Digital Security and Trust Act, 2024 — the Cyber Security Regulation — took effect on July 1, 2026, with AI-specific regulations expected to follow, and federal private-sector AI legislation is now before Parliament.

This document is the product of extensive research and benchmarking. We reviewed the applicable legislation, the common law and current regulatory guidance; benchmarked the AI governance policies of leading academic hospitals in Canada, the United States and Europe; and canvassed the academic literature and industry guides. All of it was then distilled and customized for a single audience — Ontario hospital boards of directors — so that directors can work from a framework that is current, benchmarked against leading practice and calibrated to the legal duties and resources of Ontario hospitals.

The AI Board Policy framework included in the guide suggests that AI be governed in two deployment streams — operational efficiency AI and clinical AI — with every deployment classified into one of four risk tiers and named approval authority escalating from CIO/CTO to a prior board resolution for agentic AI. The framework addresses both categories of AI risk: the risks arising from the hospital’s own deployments, and the cyber risks created by AI systems and by AI-enabled threats from external adversaries. AI governance does not require directors to become AI experts; it requires AI fluency across the institution, built through structured recruitment, orientation, ongoing education, and monitoring and reporting that surfaces gaps before they become adverse events.

The guide’s implementation toolkit is ready to adapt on the advice of counsel. Included is a sample board AI governance policy and adoption resolution, terms of reference for a AI management committee, a board-reviewed AI inventory, annual and semi-annual reporting templates with 48-hour notification of material incidents, a vendor contracting framework, a 20-question board checklist and a 12-month governance build roadmap — calibrated across community, rural and northern, and academic health sciences centre hospitals.

Read the full guide — starting with the one-page executive summary and the 20 questions every board should put to management.

Osler’s Health Industry Group has a deep understanding of Canada’s legislative and regulatory environment, the technologies driving innovation in healthcare, and the governance and litigation challenges the sector faces. For further information, contact Michael Watts, Chair of the Health Law Practice, or Susan Newell, partner.