Canada's federal AI register counts 409 systems, 42 agencies, and not much you can audit

A University of Toronto research team read every entry in Canada's federal AI register, all 409 systems in its snapshot, and published the analysis for the 2026 ACM Conference on Fairness, Accountability, and Transparency ^[1][2]. The useful result is not the headcount but the omission: according to the authors, the register establishes that AI has been adopted while obscuring who exercises judgment, what training or staffing a system needs, and how uncertainty gets handled ^[11].

The team combined quantitative mapping with qualitative coding against the ADMAPS public-sector framework ^[3]. Eighty-six percent of listed systems were intended for internal operations ^[4], which works out to roughly 352 of the 409 ^[1]. This is back-office software: the register is largely a record of administrative plumbing, not of systems making decisions about citizens at the counter. Forty-four percent were in development and 39% in production ^[5], leaving about 17%, or roughly 70 systems, in neither of those two states ^[2]. Agencies are building and running at the same time.

Vendor dependence is where the register gets interesting and where it stops being comparable across institutions. The Ottawa Citizen reported on Aug. 14 that some agencies listed only internally developed tools while others leaned heavily on outside suppliers ^[6]. Lead author Dipto Das told the newspaper that Microsoft, OpenAI and Google appeared among those third parties ^[7]. Three of the four systems listed for the Canadian Radio-television and Telecommunications Commission were developed by Microsoft ^[8], which is 75% of that regulator's disclosed inventory ^[5]. One agency's profile is not the federal profile, and the study's own emphasis is on uneven reporting ^[16].

Coverage is the other limit. The register spans 42 organizations while the federal government has more than 200 departments and agencies ^[9], so at most about one in five federal bodies is represented, and probably fewer ^[3]. The Citizen also noted the register had grown to 412 entries since the 409-system snapshot ^[10], a net addition of three ^[4]. A separate March review by Evidence for Democracy covered the same register and recorded more than 400 uses across 42 agencies, and is not the study behind the August coverage ^[15].

The authors' warning is worth restating plainly: technical descriptions can make a system look like dependable tooling when the outcome actually depends on organizational choices and human review ^[12]. The fix is documentation depth, not more rows. An inventory that could be audited would name the responsible organization, vendor and hosting dependencies, lifecycle stage, data categories, human decision points, the validation process, and a route for contesting an outcome ^[13]. Counts establish how widely AI has spread; they say nothing about whether any given system is safe, effective or accountable ^[14].

Watch whether the register's schema gains human-decision and contestability fields rather than just more entries, and whether coverage moves past 42 organizations toward the 200-plus that exist ^[9][13]. Watch the CRTC specifically: a telecom regulator whose disclosed AI stack is three-quarters supplied by one vendor is a procurement question before it is an AI question ^[8][5].