Buy Ontario and US supplier restrictions: what hospitals can and can't buy in 2026
TL;DR
- Ontario hospitals must generally exclude a US business from new procurements at any value unless an exception applies.
- A US business is a supplier whose headquarters or main office is in the United States and that has fewer than 250 full-time employees in Canada.
- The two main exceptions are an only viable source that cannot be delayed, and services where at least 90% of the required delivery staff are located in Canada.
- The restriction follows the supplier entering the contract, not simply where a product was made. Existing Vendor of Record arrangements and extension options already included in an original agreement are outside section 4.3.
A routine software renewal can therefore turn into a procurement question before anyone reaches the privacy or security review. For hospitals buying SaaS, cloud or AI services, the useful starting point is not "Is this American technology?" but "Which legal entity are we contracting with, and does it meet Ontario's definition?"
Does the Buy Ontario US-business restriction apply to hospitals?
Yes. Ontario's Buy Ontario Procurement Directive applies section 4.3, the Procurement Restriction Policy for US businesses, to designated broader public sector organizations, including hospitals. It covers all new procurements of goods and services at any value and applies to invitational, open competitive and non-competitive methods.
Ontario first introduced the Procurement Restriction Policy on March 4, 2025. The province later incorporated it into the Buy Ontario Procurement Directive, issued under the Buy Ontario Act (Public Sector Procurement), 2025. The directive took effect on April 13, 2026.
| Date | What changed | What it means for an Ontario hospital |
|---|---|---|
| March 4, 2025 | Ontario introduced the US-business procurement restriction | Covered public-sector buyers began restricting new procurements from defined US businesses |
| April 13, 2026 | The Buy Ontario Procurement Directive took effect | The US-business rule now sits in section 4.3 alongside the wider Buy Ontario requirements |
| Current rule | Section 4.3 applies to new goods and services procurements at any value | Small purchases and non-competitive procurements can be in scope, not only major RFPs |
Municipalities have a separate Municipal Buy Ontario Procurement Directive. The section 4.3 US-business restriction discussed here applies to government and designated broader public sector entities; it should not be generalized to every Ontario public-sector buyer.
What to do: treat vendor status as an intake question, not a late-stage legal check. Before evaluating a new hospital purchase, identify the contracting entity and whether section 4.3 applies to that transaction.
What counts as a US business under Buy Ontario?
Ontario uses a two-part test: the supplier must have its headquarters or main office in the United States and have fewer than 250 full-time employees in Canada at the time of the procurement. Both conditions must be met.
The subsidiary rule matters. If the bidder or vendor is a subsidiary, the headquarters condition is met when that bidder or vendor is controlled by a corporation whose headquarters or main office is in the United States. A Canadian legal name or Canadian office therefore does not settle the question by itself.
These examples show how the test works at a high level:
| Illustrative supplier | US headquarters/control? | Fewer than 250 FTE in Canada? | Basic section 4.3 result |
|---|---|---|---|
| US-headquartered software company with 40 Canadian FTE | Yes | Yes | Meets the US-business definition |
| US-headquartered company with 600 Canadian FTE | Yes | No | Does not meet the definition |
| Canadian-headquartered independent supplier with 30 Canadian FTE | No | Yes | Does not meet the definition |
| Canadian subsidiary controlled by a US-headquartered parent, with 80 Canadian FTE | Yes, through control | Yes | Meets the definition |
| Non-US-headquartered supplier not controlled by a US-headquartered corporation | No | Depends | Does not meet the first part of the definition |
These are illustrations, not determinations about any named vendor. Corporate control and headcount should be established from the supplier's actual structure at the time of procurement.
Supply Ontario's Procurement Restriction Policy guide says a government or BPS entity can rely on a business's representation that it does not meet the definition. That makes a written supplier attestation more useful than trying to reconstruct a corporate structure from websites and LinkedIn profiles.
What to do: ask for the legal contracting entity, headquarters or main office, Canadian full-time employee count and, for a subsidiary, the identity and headquarters of the controlling corporation. Keep the representation with the procurement record.
Does the restriction follow the supplier or the technology?
The restriction follows the supplier entering into the contract, not the country where the underlying product was created. A US-origin product is not automatically prohibited simply because it is American, and section 4.3 does not extend the test to the supplier's subcontractors.
Supply Ontario's current FAQ is important for technology procurement because SaaS, cloud and AI supply chains rarely map neatly to one country. The company whose logo appears on the software may not be the legal entity contracting with the hospital.
A Canadian reseller can therefore create a different section 4.3 analysis from a direct contract with a US business. That does not mean a reseller automatically solves every procurement, privacy or security issue. The hospital still needs to assess the actual contracting structure and all other applicable procurement requirements.
This is also where procurement eligibility and data sovereignty diverge. A supplier that is not a US business under section 4.3 could still use US infrastructure or subprocessors. Conversely, a non-US vendor may be able to deploy inside a Canadian environment. Those facts can matter for PHIPA, privacy impact assessments, security controls and data-residency requirements, but they are separate from the section 4.3 definition. The governance-first voice AI evaluation covers that wider distinction.
What to do: run two separate checks. First determine whether the contracting supplier is eligible under the procurement rule. Then assess hosting, subprocessors, retention, security and privacy on their own evidence.
Are software subscriptions, small purchases and renewals covered?
New software procurements can be covered even when they are small, bought outside a formal RFP or purchased as an annual online subscription. Section 4.3 applies to new procurements of goods and services at any value and to invitational, open competitive and non-competitive procurement methods.
Supply Ontario's FAQ addresses the practical edge cases. Purchases below $5,000 and annual subscriptions to online services or platforms can be caught by the restriction. A net-new contract can also be covered even if the hospital already has a different active contract with the same US business.
There are two important boundaries. Section 4.3 does not apply when the hospital uses an existing Vendor of Record arrangement or other available arrangement. It also does not apply to a contract extension that was included in the original agreement.
That makes renewal language consequential. Exercising an option that was already part of the agreement is different from negotiating an extension the original contract never contemplated. Supply Ontario's FAQ treats an extension not included in the original agreement as a new non-competitive procurement.
For hospital IT teams, this means the policy can reach a department-level AI subscription or a routine SaaS renewal, not just a contact-centre transformation project.
What to do: maintain a renewal register for significant SaaS, telephony, contact-centre and AI contracts. Record the legal supplier, renewal date, existing extension rights and whether the next transaction will be a new procurement.
What are the two exceptions for a US business?
A hospital may procure from a US business when one of two circumstances in section 4.3 applies: the US business is the only viable source and the procurement cannot be delayed, or a services supplier commits to having at least 90% of the required staff delivering the contracted services located in Canada.
Only viable source and the procurement cannot be delayed
Both parts matter. A preferred product is not automatically an only viable source, and an only viable source does not by itself establish that the procurement cannot wait.
Supply Ontario's guidance identifies factors that can support an only-viable-source case, including unique skills or technology, exclusive rights or patents, sole availability, confidentiality requirements, insufficient alternatives, health and safety considerations, or demonstrated superior outcomes relating to health, safety or quality of life. The buyer must separately support why delay is not possible.
For a hospital, that second part might involve an immediate operational requirement, continuity of a critical service or a genuine health and safety concern. The facts need to support the case; urgency created by leaving a routine renewal until the last minute is not the same thing as a policy exception.
At least 90% of required service-delivery staff are in Canada
For a procurement of services, a US business can qualify for the second exception if it commits to having at least 90% of the staff required to deliver the contracted services located in Canada. Supply Ontario's guidance includes employees and contractors required for delivery.
For software and AI, the practical question is who counts as required delivery staff for the contracted service. Implementation may happen in Ontario, support in British Columbia and engineering in the United States. A hospital should not infer the percentage from a vendor's office locations.
What to do: if relying on an exception, obtain the supporting facts in writing and document the approval. Supply Ontario's guide describes records covering the justification, due diligence, market research, risk assessment and consultation so a later reviewer can understand why the exception was used.
How should a hospital assess an AI phone or cloud supplier?
Start with the transaction and contracting entity, then move to technology risk. Buy Ontario answers whether and how the hospital can procure from the supplier; it does not answer whether the proposed AI, cloud or phone service is suitable for patient information or hospital operations.
Consider an AI phone service for appointment reminders, rescheduling and common patient-access enquiries. The procurement sequence can be kept straightforward:
- Identify the legal entity that will sign the contract.
- Establish its headquarters or main office and, where relevant, the headquarters of its controlling corporation.
- Determine whether it has fewer than 250 full-time employees in Canada.
- If it meets the US-business definition, determine whether either section 4.3 exception actually applies and document the decision.
- Separately assess where patient data is processed, whether calls are recorded, which subprocessors are involved, retention, audit controls, security requirements and the hospital's privacy obligations.
The last step should not be collapsed into the first four. Procurement eligibility is not a certification of privacy, security or clinical suitability. A supplier can be eligible under Buy Ontario and still fail a hospital's technology review.
For a structured set of operational questions, the enterprise voice AI vendor evaluation framework covers security, integration, governance and deployment considerations.
What to do: make procurement status and technology assurance separate gates in the buying process. That keeps a clean supplier-eligibility decision from being mistaken for approval to handle patient data.
What other Buy Ontario preferences still apply after the US-business test?
Passing the section 4.3 test does not put every eligible supplier on equal footing. The wider directive also sets BOBI preferences for Ontario, Canadian and trading-partner businesses, with the applicable strategy depending on procurement value.
For designated broader public sector entities such as hospitals, the current thresholds are:
| Procurement value | BPS strategy under the directive |
|---|---|
| Below $139,000 | Give preference to Ontario businesses |
| $139,000 to below $368,000 | Give preference to Canadian businesses |
| $368,000 and above | Give preference to businesses of Ontario's trading partners and apply weighted domestic criteria |
| $50 million and above in specified sectors | Include the applicable Industrial Regional and Technology Benefit requirement |
Supply Ontario's BOBI guide for buyers explains how the strategies are applied and the relevant exceptions.
The useful mental model is two questions in order. First, is the supplier restricted under section 4.3? Second, among suppliers that can participate, what BOBI preference, procurement method and trade obligations apply?
A vendor headquartered in Australia, the UK or the EU is not a US business merely because it sells into Canada. That does not automatically make it an Ontario or Canadian business, nor does it guarantee eligibility for a particular tender.
The same caution applies to Trillet. This article does not claim that Trillet qualifies for any specific Ontario procurement. A hospital should establish the contracting entity, headquarters, control, Canadian headcount and any other applicable requirements through the procurement process rather than infer them from a product website or deployment location.
What to do: do not stop the analysis after determining that a vendor is not a US business. Apply the BOBI and trade-agreement rules that correspond to the buyer, value and procurement.
Is Ontario's rule the same as Canada's federal procurement policy?
No. Ontario's section 4.3 restriction and Canada's federal procurement policies are different regimes with different scope and eligibility rules. An approach that works for an Ontario hospital should not automatically be copied into a federal tender or another province.
At the federal level, the Interim Policy on Reciprocal Procurement took effect on July 14, 2025. It limits access to certain federal procurement opportunities based on whether a foreign supplier's jurisdiction has applicable reciprocal trade-agreement access.
The federal Buy Canadian Procurement Policy Framework took effect on December 16, 2025 and provides the framework for policies prioritizing Canadian suppliers, materials and content in federal procurement.
"Eligible in Canada" is therefore too broad to be useful as a vendor claim. The answer depends on the public-sector buyer, jurisdiction, procurement value, applicable trade agreements and the particular policy being applied.
What to do: identify the buyer and governing procurement regime before applying any supplier-eligibility conclusion outside Ontario's designated BPS.
What should Ontario hospital procurement teams do now?
Hospital teams can operationalize section 4.3 with a small number of repeatable controls: supplier attestation at intake, corporate-control questions where needed, a renewal register, written exception evidence and a separate privacy/security gate.
A workable procurement file should make the following easy to answer:
- Which legal entity is signing the contract?
- Where is its headquarters or main office?
- Is it controlled by a US-headquartered corporation?
- How many full-time employees does it have in Canada?
- Is this a new procurement, an existing VOR/available arrangement, or an extension option already included in the original agreement?
- If an exception is being used, what evidence supports it and who approved it?
- After procurement eligibility is resolved, what separate privacy, security, hosting and data-residency requirements apply?
Review upcoming technology renewals before they become urgent. A renewal calendar gives procurement time to distinguish an existing contractual option from a new procurement and, where necessary, test the market rather than trying to construct an exception under deadline pressure.
The Enterprise Voice AI Guide provides the broader technical context for evaluating enterprise deployments once the procurement question is settled.
What to do: turn these questions into a standard vendor-intake and renewal workflow. When the facts are unclear, take the specific transaction to Supply Ontario or appropriate procurement counsel rather than stretching a general rule to fit it.
Frequently asked questions
Does the Buy Ontario Procurement Directive apply to hospitals?
Yes. The directive applies to designated broader public sector organizations, and section 4.3 applies the US-business procurement restriction to those entities. Hospitals should still confirm how their organization implements the directive through its own procurement controls.
Is a Canadian subsidiary of a US company automatically a US business?
Not automatically, but a Canadian subsidiary can meet the definition. For the headquarters part of the test, a bidder or vendor is treated as US-headquartered if it is controlled by a corporation whose headquarters or main office is in the United States. The supplier must also have fewer than 250 full-time employees in Canada.
Can a hospital buy a US product through a Canadian reseller?
Potentially. Supply Ontario's FAQ says the restriction applies to the supplier entering the contract rather than the product's origin, and it does not extend the test to subcontractors. The hospital still needs to assess the actual reseller arrangement and all other procurement, privacy and security requirements.
Does the restriction apply below $5,000 or to online software subscriptions?
Yes, a new procurement can be in scope regardless of value. Supply Ontario's FAQ specifically addresses routine purchases below $5,000 and annual subscriptions to online services and platforms.
Can a hospital renew or extend an existing contract with a US vendor?
It depends on the agreement. Section 4.3 does not apply to contract extensions included in the original agreement. An extension that was not contemplated in the original agreement can be treated as a new non-competitive procurement.
Does a hospital have to independently investigate every vendor's ownership?
The directive allows a government or BPS entity to rely on a business's representation that it does not meet the US-business definition. Hospitals should still collect enough information to support the procurement record, especially the contracting entity, headquarters, Canadian headcount and control where a subsidiary is involved.
Does the US-business restriction apply to municipalities?
Not under section 4.3 in the same way. Municipal sector entities are governed by the separate Municipal Buy Ontario Procurement Directive, which has its own scope and requirements.
Does passing the US-business test mean a software vendor is approved for patient data?
No. Section 4.3 is a procurement restriction, not a privacy, security or clinical certification. Hospitals still need to assess PHIPA and other applicable privacy requirements, security, hosting, subprocessors, retention and operational risk for the proposed deployment.
This article provides general information and is not legal advice. Procurement rules and guidance can change. Confirm a specific procurement against the current Buy Ontario Procurement Directive, Supply Ontario guidance and, where appropriate, procurement counsel.
