AI adoption inside Canadian municipal government stopped being a side project sometime in the last year. The 2025 MNP Municipal Report, built with Leger from a survey of 282 municipal leaders across the country, found that 50 percent now rank AI as a top strategic priority, up from just 22 percent in 2024. That's a bigger year-over-year jump than cybersecurity, smart city work, or almost anything else on the priority list. Nearly a quarter of municipalities are already using AI in some form, and more than half say they're actively exploring or planning it.
Here's the part that should give councils pause: nearly one in three municipalities still has no formal guidelines for how AI gets used. That gap doesn't sit still while everyone waits for a policy to get written. It gets filled, usually by whatever vendor tool solves today's problem: a chatbot for the resident portal, a permitting system with AI triage built in, an AI layer bolted onto the customer service line. The MNP survey points at why municipalities lean on vendors instead of building their own rules first: half cite insufficient resources as a barrier, 44 percent point to complicated internal decision-making, 43 percent are working around legacy systems, and 36 percent say they simply don't have the in-house expertise to evaluate what they're buying. Under those constraints, the vendor's defaults become the municipality's policy by default.
What is Ottawa's new AI transparency consultation actually asking for?
In July, the federal government opened a public consultation on AI transparency, running through September 23, 2026, led by Evan Solomon in the newly created Artificial Intelligence and Digital Innovation portfolio. It's built around five questions: how to identify content that AI generated, how to disclose when someone is interacting with an AI system rather than a person, how to publish clear information about what an AI system does and how it was built, how to report serious AI-related incidents, and how to track what an AI agent actually did when it acted on someone's behalf. Solomon's framing was blunt: "AI adoption moves at the speed of trust."
None of those five questions are municipal-specific. But municipalities are exactly the kind of organization the questions describe: they run citizen-facing AI (resident chat, 311 lines, permit and complaint triage) through vendor platforms they didn't build and often can't fully explain. When federal expectations around disclosure and incident reporting harden, provincial regulators tend to follow within a year or two, and local government policy tends to follow the province. A municipality that waits for a finished rulebook before asking these questions of its vendors will be retrofitting contracts under a deadline instead of negotiating them from a position of choice.
What belongs in the next AI vendor contract
None of this requires waiting for a law. A procurement conversation with any AI vendor, whether it's a new one or a renewal, can cover the same ground the federal consultation is circling. Where is resident data stored, and who owns it once it's in the vendor's system? Can the vendor explain, in language a councillor could repeat to a resident, how the system arrives at a recommendation or a triage decision? Will they commit, in writing, to notifying the municipality within a defined window if something goes wrong, rather than finding out from a news story? And does the system keep a log of what an AI agent actually did, not just the answer it produced, so a records request or an audit has something real to point to? A vendor that answers those cleanly is telling you something useful. A vendor that gets vague is telling you something too.
The fix for the nearly one-in-three municipalities without formal AI guidelines isn't a hundred-page framework. It's getting IT, records management and legal into the same room before the next contract is signed, and asking the same handful of questions every time, consistently enough that the answers start forming a policy on their own. Municipalities that get in the habit now will find the eventual disclosure and incident-reporting rules easy to comply with, because they'll already be asking for that information as a matter of course.