When AI flags a threat, what happens next?
Months before the February 10, 2026, Tumbler Ridge mass shooting, a warning surfaced inside OpenAI.
According to B.C.’s lawsuit, the company’s monitoring system flagged the future shooter’s ChatGPT account, and safety reviewers recommended notifying police. The account was banned, but no warning reached the RCMP before the attack that killed eight victims.
OpenAI has acknowledged banning the account in June 2025. Its explanation, reported by CBC News, was that the activity did not meet its higher threshold for contacting police. The allegations about what employees recommended and why leadership declined remain unproven.
That distinction matters. A lawsuit is not a verdict. Still, the case raises a question Canadians should not have to wait years to answer: when an AI company identifies a credible threat of serious violence, what should it be required to do?
A warning needs somewhere to go
On September 21, B.C. and the Peace River South school board filed a civil complaint against OpenAI and Sam Altman in California. The complaint alleges failures involving threat reporting, product design and safeguards. It also includes a claim of aiding and abetting the shooting.
While this sounds like a criminal accusation. Here, however, it is a civil claim seeking to establish responsibility for harm. It is not a charge under Canada’s Criminal Code. Additionally, the complaint states that the chat logs have not yet been produced, but Mother Jones reporting described alleged exchanges.
Similarly, a lawsuit following the Florida State University shooting alleges that ChatGPT helped the shooter plan the attack, raising a parallel question about whether OpenAI’s conduct amounted to aiding and abetting the violence.
Deciding where a warning should go also means asking whether it is reliable. Canada Research Chair Kanika Samuels-Wortley describes how automated systems can misread racialized people. Her example involves a security camera, but it raises a concern for any reporting duty: an automated flag should prompt careful human assessment, not automatically trigger a police report.
What the Canadian law says
An obvious question is whether failing to report a threat is already a crime and whether the company behind a chatbot could face criminal charges. The answer is more complicated than it first appears.
Canadian law recognizes aiding and abetting under section 21 of the Criminal Code. It concerns intentionally helping or encouraging someone to commit an offence. However, the provision does not specifically address AI chatbots.
The Supreme Court’s 1999 decision in Smith v. Jones offers a useful precedent about confidentiality and danger. The Court held that solicitor-client privilege, the rule that keeps a lawyer's file confidential, can be set aside when there is a clear risk to an identifiable person or group, a risk of serious bodily harm or death, and the danger is significant. But the decision creates no general duty to report and does not address AI companies.
While the ongoing B.C. lawsuit may help examine corporate responsibility, a U.S. ruling would not automatically determine how Canadian courts decide similar cases. As AI is still relatively new and rapidly evolving, Parliament should establish clear Canadian standards that can adapt as the technology develops, rather than leave prevention to the outcome of civil procedures.
Why AI changes the question
A chatbot can do more than receive a threatening statement. Through repeated conversations, it can respond to a user’s ideas, reinforce beliefs and potentially assist planning.
In their 2026 editorial, forensic psychiatrists Joseph R. Simpson and Joseph M. Pierre discuss concerns about chatbots validating delusions, encouraging harmful behaviour and becoming involved in cases of violence. It also references both the Tumbler Ridge, and Florida State University shooting. In the Florida case, the accused allegedly consulted ChatGPT about weapons and when campus would be busiest. This example raises concerns about how a chatbot’s tailored responses could help turn harmful intentions into concrete plans.
Chatbot use alone cannot establish dangerousness. Companies that review flagged conversations may hold information that supports assessment by trained professionals. The question is what reasonable action should follow when it points to a credible threat.
Parliament has an opening
Bill C-34, the proposed Safe Social Media Act, would regulate chatbot services. Under section 51, a service would have to interrupt a conversation when a user expresses an intention to cause death or serious bodily harm and direct the user to crisis services where they can reach a human being. That could connect someone with help, but sections 51 to 53 do not expressly require companies to notify police.
Michael Geist, a University of Ottawa law professor, notes that the government resisted mandatory police reporting. He argues that requiring AI companies to report private conversations would undermine privacy and encourage corporate surveillance. Under section 58(1)(f)–(g), chatbot companies would have to describe their police-reporting criteria and practices in their digital safety plans. Section 128 would require a review to begin within three years of that section taking effect, with a report recommending whether police reporting should become mandatory.
No reporting rule can guarantee that harm will be prevented. But a safety system needs more than the ability to raise a flag. It needs clear rules about when companies must act, what steps they should take and who is responsible for those decisions.
What should happen next?
Parliament should clarify when AI companies must report credible threats of serious violence. Lawsuits can examine responsibility after an attack, but companies also need clear rules about what to do before harm occurs. Those rules should include:
A clear threshold. Reporting should be limited to credible, specific threats of death or serious harm to oneself or others.
Human review before escalating. Trained staff should assess the threat and record their decision, their reasons and who made the call.
Consequences for failing to act. Companies that unreasonably fail to report a threat should face civil liability or regulatory penalties.
A clear way to reach Canadian authorities. Companies based outside Canada should know whom to contact. Independent oversight should check whether reporting decisions are justified and whether certain groups are unfairly flagged.
The goal is to prevent violence before it happens. In Tumbler Ridge, OpenAI identified concerning activity; the lawsuit alleges that its response was inadequate. Canada needs clear laws connecting the recognition of a credible threat with timely action.
Jamy De Luna, B.A. Candidate in Criminology, is an Undergraduate Research Member at the Applied Justice Lab and is a third-year Criminology student at Kwantlen Polytechnic University.
