Ontario: MFIPPA
Ontario municipalities: MFIPPA obligations apply to AI, whether you have a policy or not.
Ontario's Municipal Freedom of Information and Protection of Privacy Act sets rules for how local governments handle citizen data, including when staff use AI tools. From January 1, 2027, MFIPPA will also require a written privacy impact assessment before new personal information is collected, and breach reporting to the IPC.
IPC Ontario and MFIPPA: what changes on January 1, 2027
The Information and Privacy Commissioner of Ontario and the Ontario Human Rights Commission recommend that institutions carry out privacy and other impact assessments before using AI systems. Amendments to MFIPPA passed in 2026 (S.O. 2026, c. 2, Sched. 11) add new duties from January 1, 2027: a written privacy impact assessment before collecting personal information (s. 28(3)), reporting of privacy breaches to the IPC (s. 30.1), and IPC reviews of an institution's information practices (s. 38.1).
Key terms
MFIPPA
Municipal Freedom of Information and Protection of Privacy Act (Ontario)
Governs access to records and protection of personal information held by Ontario municipalities, school boards, police service boards, public library boards, boards of health and other local bodies. Limits how personal information is collected, used, disclosed, retained and disposed of, and its regulation requires documented measures to prevent unauthorized access to records.
IPC
Information and Privacy Commissioner of Ontario
Ontario's independent oversight body. Has published principles for the responsible use of AI with the Ontario Human Rights Commission, and guidance on privacy impact assessments. Investigates privacy complaints and, from January 1, 2027, may review a municipality's information practices.
AMO
Association of Municipalities of Ontario
Represents Ontario's 444 municipalities. Its 2024 annual conference included a keynote from the Information and Privacy Commissioner on AI and municipalities.
PIA
Privacy Impact Assessment
A written assessment of how personal information will be collected, used and protected. IPC guidance recommends one before using AI systems, and from January 1, 2027, MFIPPA s. 28(3) requires one before an institution collects personal information. Spencer Morley Consulting supports PIA preparation as part of the AI policy service.
The Ontario reality
Shadow AI is in your municipality. MFIPPA makes it your problem.
Ontario has 444 municipalities. Nearly a third of municipal leaders surveyed nationally say they have no formal AI policy. The same research that describes Canadian public sector AI use applies directly to Ontario local governments.
Sources: KPMG Canada, 2025, survey of 349 public servants; MNP 2025 Municipal Report, survey of 282 municipal leaders
What we do for Ontario municipalities
Five services. One framework. Built around MFIPPA and IPC Ontario guidance.
Every engagement is tailored to Ontario's specific legislative and regulatory environment. Delivered remotely, sized for small municipalities (townships, villages, and northern communities), not just large urban centres.
AI readiness assessment
A structured diagnostic of your municipality's current AI exposure, shadow AI risk, and MFIPPA compliance gaps, aligned with IPC Ontario's guidance on AI governance. Identifies which tools your staff are using, what citizen data is at risk, and what a MFIPPA-compliant response requires. Delivers a plain-language roadmap your council can approve.
Staff AI training & prompt engineering
Practical training on what Ontario municipal staff can and cannot do with AI under MFIPPA, specifically covering what constitutes personal information, when a PIA is needed (and required from January 1, 2027), and how to get genuinely useful output from sanctioned tools. Designed for non-technical municipal staff. Available remotely or on-site anywhere in Ontario.
AI adoption policy & procedures
A formal AI adoption policy grounded in MFIPPA and designed for Ontario council adoption. Reflects the IPC's principles for the responsible use of AI. Covers sanctioned tools, prohibited uses involving citizen personal information, the privacy impact assessment and breach reporting duties that start on January 1, 2027, and staff expectations. Written so a CAO can implement it without a law degree. Delivered as two documents: the AI Adoption Policy council adopts, and a companion AI Adoption Procedures document setting out how staff request and approve tools, what is logged, and the exact steps when a breach is suspected, so administration can revise procedures as tools change without returning to council each time.
See the AI adoption policy for public bodiesPrivate AI options
Some municipalities want AI that can work with sensitive information without using a public platform. We can explore whether a privately hosted option fits your situation. Any build would be scoped as a custom project, so we make no commitments until we understand what you need.
Agentic workflows
Municipal administrative automation: meeting minutes, council agendas, bylaw drafting, permit correspondence, report generation, ratepayer communications, built privacy-by-design with documented human oversight. Every workflow is scoped to MFIPPA data handling requirements and documented so it can stand up to an IPC review.
Ontario municipality FAQ
Questions from Ontario CAOs and municipal clerks
Our municipality uses Microsoft 365 and Copilot is starting to appear. Do we need to do anything?
Yes. IPC guidance recommends a privacy impact assessment before using AI tools that handle personal information, and from January 1, 2027, MFIPPA s. 28(3) requires a written assessment before new personal information is collected. Microsoft Copilot integrated into 365 works with municipal data, including emails, documents, and meeting records that may contain citizen personal information. The assessment should document what data Copilot accesses, how it is used, where it is stored, and what controls are in place. Spencer Morley Consulting's AI policy service includes PIA preparation support for exactly this situation.
We're a small township with one CAO. Is this realistic?
Yes, and this is the most common client context. A township with one CAO and limited staff has the same MFIPPA obligations as a larger municipality, with fewer internal resources to address them. Spencer Morley Consulting's Municipal AI Framework is specifically designed for this context: remote delivery, minimal time demands, and outputs the CAO can implement without additional expertise. The AI Readiness Assessment is the right starting point: it takes one or two structured conversations and delivers a clear picture of where you stand.
Has the IPC Ontario actually acted against municipalities for AI issues?
We are not aware of an IPC order against a municipality over AI. The IPC has published principles for the responsible use of AI and investigates privacy complaints under MFIPPA whatever technology is involved. From January 1, 2027, it may also review a municipality's information practices. A municipality without documented AI governance is in a weak position if a complaint touches AI-assisted processes, and proactive work costs far less than responding to an investigation.
Is ROMA (Rural Ontario Municipal Association) a relevant reference point?
Yes. ROMA, part of the AMO family, represents rural Ontario municipalities. Spencer Morley Consulting's Municipal AI Framework addresses the context many ROMA members share: limited staff, complex administrative obligations, and privacy legislation that applies in full regardless of size. If your municipality is a ROMA member, the framework applies directly.
Further reading
Ontario municipalities
New MFIPPA duties start January 1, 2027. Your staff aren't waiting.
MFIPPA already applies to AI use, and new privacy impact assessment and breach reporting duties start on January 1, 2027. Your staff are likely already using public AI tools with citizen data. Let's talk about where your municipality stands and what closing the gap actually requires.