Canada has no AI Act, and the reason that matters is not the absence itself but what the absence exposes. Every obligation currently binding a Canadian business over an AI system comes from a province, with two federal exceptions: one criminal provision about synthetic intimate images, and one supervisory guideline for financial institutions that does not take effect until 2027. Ottawa’s most detailed AI instrument binds roughly 97 government departments and nobody else.
Canada’s useful question is therefore not what the law says. The question is which border you are inside.
| Jurisdiction | Binds private business | Binds the public sector | Can it fine you? |
| Quebec | Law 25, ss. 8.1, 9.1, 12.1 | A-2.1 s. 65.2; IA-RI-2025-003-OP | Yes, to 2% or 4% of worldwide turnover |
| Ontario | ESA s. 8.4, job postings | A directive, plus a dormant statute | Yes, to $500,000 on prosecution |
| Alberta | Nothing AI-specific | POPA ss. 5(2)(d), 6 | No |
| BC and the rest | Nothing | Internal policy only | No |
| Federal | Criminal Code s. 162.1; OSFI E-23 from 2027 | Directive on Automated Decision-Making | No, not for AI |
The Artificial Intelligence and Data Act, Part 3 of Bill C-27, would have changed that, and was never enacted. The bill died on the Order Paper when Parliament was prorogued on 6 January 2025, and Parliament’s own LEGISinfo record still shows it frozen at committee with no royal assent date. A bill that dies on prorogation cannot resume; it has to be reintroduced from scratch, and no successor of general application has been.
One subsection explains why Ottawa is absent from your workplace
Canadian AI obligations make sense only once one structural fact is on the table, because it is rarely stated and it does more explanatory work than any list of rules.
Section 4(1)(b) of the Personal Information Protection and Electronic Documents Act applies the federal statute to information about an employee or job applicant only where the organisation collects it “in connection with the operation of a federal work, undertaking or business.” Banks, telecoms, broadcasters, airlines and interprovincial transport are inside. Almost every other employer in Canada is outside.
Two consequences follow. Ontario could not have regulated AI hiring through federal privacy law even if it wanted to, which is why the duty sits in the Employment Standards Act instead. And in Ontario and most of the country, an AI screening tool applied to job applicants is governed by no general private-sector privacy statute at all. Only Alberta, British Columbia and Quebec have laws the federal government has declared substantially similar, and only those three reach employee information in provincially regulated workplaces.
PIPEDA itself says nothing about automated decision-making, profiling, algorithmic transparency or explanation. Its fair information principles apply to personal data in a model exactly as they apply to personal data in a filing cabinet, and that is the whole of the federal private-sector position.
Quebec is the only province whose regulator can take your money
Canada’s only fineable AI exposure sits in Quebec, which has three provisions reaching AI products, all in force, and a penalty regime attached to one of them that would not look out of place in Brussels.
Section 12.1 of the Act respecting the protection of personal information in the private sector, in force since 22 September 2023, reads in full:
Any person carrying on an enterprise who uses personal information to render a decision based exclusively on an automated processing of such information must inform the person concerned accordingly not later than at the time it informs the person of the decision. He must also inform the person concerned, at the latter’s request, (1) of the personal information used to render the decision; (2) of the reasons and the principal factors and parameters that led to the decision; and (3) of the right of the person concerned to have the personal information used to render the decision corrected. The person concerned must be given the opportunity to submit observations to a member of the personnel of the enterprise who is in a position to review the decision.
Canadian summaries routinely collapse the three tiers sitting inside that. Notice is pushed without being asked for, at or before the moment the decision is communicated. The data, the reasons, the principal factors and parameters, and the correction right come on request. The opportunity to submit observations to a person who can actually review the decision is unconditional and is not framed as requiring a request.
Section 8.1, in force a year earlier on 22 September 2022, is the one AI product teams overlook. Anyone collecting personal information using technology with functions allowing a person to be identified, located or profiled must first inform them of the use of the technology and of “the means available to activate” those functions. Read that verb. The statute assumes identification, location and profiling are off unless the individual turns them on. Profiling is defined in the same section as collecting and using personal information to assess characteristics of a person, particularly work performance, economic situation, health, personal preferences, interests or behaviour, which covers most recommendation and scoring systems.
Section 9.1, in force with section 12.1, requires that any technological product or service offered to the public with privacy settings must have those settings at the highest level of confidentiality by default, without intervention by the user. Browser cookies are carved out. Nothing else is.
Quebec then attached enforcement. Section 90.1 lists the failures attracting a monetary administrative penalty, and paragraph (5) names the automated decision rule by number:
(5) does not inform the person concerned by a decision based exclusively on an automated process or does not give the person an opportunity to submit observations, in contravention of section 12.1
Section 90.12 caps that penalty at $50,000 for an individual and, in all other cases, $10,000,000 or 2 per cent of worldwide turnover for the preceding fiscal year, whichever is greater. A separate penal route in section 91 runs from $15,000 to $25,000,000, or 4 per cent of worldwide turnover, whichever is greater. Canada’s largest numbers attached to an AI-adjacent obligation sit in that provincial statute.
Two limits keep the Quebec position honest. Section 12.1 bites only where the decision is based exclusively on automated processing, so meaningful human involvement in the decision itself takes a system outside it. And the section confers no right to a human re-decision, no opt-out, no access to the model or its weights and no audit duty; “principal factors and parameters” is the entire explanation obligation. No penalty has ever been imposed under paragraph (5), three years after the power arrived.
Quebec regulates its own public bodies more tightly than Ontario regulates its own
Quebec public bodies carry a parallel statutory duty at section 65.2 of the Act respecting Access to documents held by public bodies, in materially the same terms as section 12.1, with observations to be submitted to a member of the public body’s personnel able to review the decision. Section 65.0.1 carries the profiling and geolocation notice across.
Quebec added a binding administrative instrument on top. The ministère de la Cybersécurité et du Numérique issued indication d’application IA-RI-2025-003-OP on 5 December 2025, setting governance, risk management and control measures for public bodies using generative AI, with a ministerial order the same month updating the statement of principles for responsible AI use. Article 23 lets a body stagger implementation over a maximum of six months, so the practical deadline fell in June 2026. Article 25 abrogated the March 2025 instruction that had suspended public bodies’ use of generative AI assistants altogether. Quebec turned the tap off, wrote the rules, and turned it back on.
Ontario made one disclosure compulsory, and the labour market moved
Ontario’s contribution is narrow, and has had more visible effect than anything else on this page.
Since 1 January 2026, section 8.4 of the Employment Standards Act, 2000 has read:
8.4 (1) Every employer who advertises a publicly advertised job posting and who uses artificial intelligence to screen, assess or select applicants for the position shall include in the posting a statement disclosing the use of the artificial intelligence.
Ontario put the definition in O. Reg. 476/24, adopting the OECD formulation: a machine-based system that, for explicit or implicit objectives, infers from the input it receives in order to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.
Ontario decides scope by two things people miss. Employers with fewer than 25 employees are outside the whole of Part III.1. And “publicly advertised job posting” excludes a general recruitment campaign with no specific position, a general help-wanted sign, a posting restricted to existing employees, and a posting for work to be performed outside Ontario, or outside and in Ontario where the outside portion is not a continuation of Ontario work. The last exclusion is the gate a national employer actually stands on, and it turns on where the work is, not where the company is.
Ontario requires far less than readers assume. No bias audit, no impact assessment, no publication of results, no notice at the decision stage, no explanation, no human review and no contestation route. Ontario’s own guidance confirms an employer need not describe the system; stating that AI is used to screen, assess or select is enough. The duty stops at selection, so AI in onboarding, performance management or promotion is outside it. Anyone comparing this to New York City’s bias-audit rule is comparing two different species of instrument. A companion provision, section 15(7.1), requires the posting and any associated application form to be kept for three years after public access ends, and that retention duty is the part a compliance team will actually have to build for.
Ontario enforces through employment standards officers: compliance orders under section 108, notices of contravention at $250, $500 and $5,000 for successive contraventions, and prosecution under section 132 reaching $500,000 for a corporation with more than one prior conviction. No enforcement action under section 8.4 has been reported.
Canadian hiring behaviour shifted measurably even though compliance has not been measured. Indeed Hiring Lab reported in July 2026 that the share of Ontario job postings mentioning AI-related terms rose from 9 per cent in October 2025 to 28 per cent seven months later, against a move from 4 to 12 per cent across the rest of Canada and a 7 per cent average in other advanced economies. Mentions rose in all 48 occupations tracked, with a median increase of 18 percentage points. Applications per posting were similar whether or not a posting mentioned AI, which suggests candidates either did not mind or did not notice. One disclosure duty tripled the visible AI footprint of a provincial labour market in under a year, and no regulator has published a compliance rate to sit beside it.
Ontario also passed an AI statute that binds nobody
The Enhancing Digital Security and Trust Act, 2024, Schedule 1 to Bill 194, has been in force since 29 January 2025 and defines an artificial intelligence system in the same OECD terms. Section 5 would require prescribed public sector entities, in prescribed circumstances, to publish information about their AI use, implement an accountability framework, manage risks and observe prohibitions. Section 6 would require disclosure and human oversight for specific uses.
Every duty is conditioned on regulations. Two regulations exist under the Act, O. Reg. 51/26 on cyber security and O. Reg. 52/26 on digital technology affecting people under 18, both effective 1 July 2026. Nothing has been made under sections 5 to 8. Because the AI sections reach only prescribed entities in prescribed circumstances, and none has been prescribed, no Ontario public body owes any AI obligation under the Act today.
Three provisions would blunt it even once regulations arrive. Section 12 creates no private law duty of care. Section 13 provides that non-compliance does not affect the validity of any decision, so an AI-tainted government decision is not voidable for breach. Section 14 makes any conflicting Act prevail. There is no offence, no administrative penalty, no order power, no complaint mechanism and no regulator.
What does bind the Ontario public service is a management directive: the Responsible Use of Artificial Intelligence Directive, effective 1 December 2024, requiring a five-step risk process, human oversight and public disclosure where AI directly affects citizens. The directive creates no appeal rights and reaches ministries and provincial agencies only, not municipalities, school boards or children’s aid societies.
Alberta legislated for its own government, and British Columbia has legislated nothing
Alberta brought its Protection of Privacy Act into force on 11 June 2025 alongside the Access to Information Act. Section 5(2)(d) requires a public body collecting personal information to give notice of its intention, if any, at that time to input the information into an automated system to generate content or make decisions, recommendations or predictions. Section 6 confirms that where information will be used to make a decision directly affecting an individual, including one made using an automated system, the body must make every reasonable effort to ensure accuracy and retain the information for at least a year.
Two drafting choices are worth noting. Alberta says automated system rather than artificial intelligence, and covers systems that generate content as well as those that decide, so generative tools are inside. And the duty is a front-end collection notice, not a decision-stage right: no explanation, no reasons, no factors, no opportunity to be heard. Alberta’s private-sector statute, PIPA, was not reformed and says nothing about AI.
Canada’s remaining provinces have a short answer, and it should be stated rather than implied. No province has an AI statute or an AI bill. British Columbia’s PIPA and FIPPA contain no automated-decision provision; what exists is internal policy on generative AI for public service employees, draft responsible-use principles, a responsible AI policy framework for the health sector published in June 2026, and a Minister of State for Artificial Intelligence and New Technologies, which is a portfolio rather than a regulatory instrument. Saskatchewan, Manitoba, Nova Scotia, New Brunswick, Prince Edward Island, Newfoundland and Labrador and the three territories have nothing AI-specific at all. No province has amended a human rights code to address algorithmic discrimination, no province requires a bias audit of a hiring tool, and no Canadian human rights tribunal has decided an AI case.
Two federal rules do reach business, and neither is AI regulation
Criminal law. Canada acquired its first in-force federal statutory provision naming AI on 18 July 2026, thirty days after the Protecting Victims Act received royal assent as S.C. 2026, c. 19. Section 162.1(2)(b) of the Criminal Code now defines an intimate image to include:
a visual representation that is made by any electronic or mechanical means, including by means of artificial intelligence software, and that shows an identifiable person who is depicted as nude, as nearly nude, as exposing their sexual organs or as engaged in explicit sexual activity, if the depiction is likely to be mistaken for a visual recording of that person
The non-consensual distribution offence therefore reaches synthetic imagery, a threat offence was added at section 162.1(1.1), and the maximum reaches fourteen years where aggravated sexual assault was being committed when the image was made. The statute never uses the word deepfake, which is why keyword searches of Canadian legislation for AI terms miss it. Canada legislated here against a specific abuse, not to impose a governance obligation on deployers, and the provision should not be read as one.
Prudential supervision. Guideline E-23, Model Risk Management (2027) was published by the Office of the Superintendent of Financial Institutions on 11 September 2025 with an effective date of 1 May 2027. The year is part of the title, distinguishing it from the 2017 instrument that applies until then. Scope widened from large deposit-takers to banks, foreign bank branches, life and fraternal companies, property and casualty companies, and trust and loan companies.
The decisive move is definitional. A model means an application of theoretical, empirical, judgmental assumptions or statistical techniques, including AI and machine learning methods, which processes input data to generate results. By putting AI inside the meaning of model, OSFI subjects it to the whole lifecycle discipline of identification, development, validation, approval, deployment, monitoring and decommissioning, rather than building a separate AI regime beside it. A guideline is not a regulation and its breach is not an offence; it is a supervisory expectation, escalated through staging, directions of compliance and capital consequences. Weaker than a fine, considerably stronger than advice, and for a Canadian bank or insurer it is the AI governance programme.
Sector adoption makes it consequential. The OSFI and FCAC risk report of 24 September 2024 recorded AI use rising from roughly 30 per cent of federally regulated institutions in 2019 to about 50 per cent in 2023, with 70 per cent expected by 2026. The Bank of Canada’s Financial System Survey of 28 May 2026 found nearly all respondents using AI, naming data quality and bias, cyber and privacy risk, and model risk and lack of explainability as the leading concerns, and describing AI as an amplifier of existing risk rather than a standalone threat. The Bank has no rule-making power here; prudential supervision belongs to OSFI and market conduct to FCAC.
Ottawa’s most detailed AI rules apply to Ottawa
The Treasury Board Directive on Automated Decision-Making is the most developed AI instrument in the country, and it governs government. Its current version dates from 24 June 2025, after the fourth review, and systems developed or procured before that date had until 24 June 2026 to meet the updated requirements.
The Directive requires an Algorithmic Impact Assessment completed, approved and published on the Open Government Portal before a system enters production, then scales obligations across four impact levels: peer review by one qualified expert at Level II rising to two at Level IV, a Gender-based Analysis Plus from Level II, recurring role-based training from Level III, and from Level III a requirement that the final decision be made by a human. Approval sits with an assistant deputy minister at the lower levels and the deputy head at the higher ones.
Reach is narrower than the detail suggests. The Directive applies to institutions subject to the Policy on Service and Digital, roughly 97 departments under the Financial Administration Act. Crown corporations are outside it. So is the Canada Revenue Agency, and so are the Canadian Armed Forces, though the Department of National Defence is inside. Agents of Parliament, including the Privacy Commissioner, are covered with carve-outs. A private vendor is touched only through contract, most directly by the requirement that departments retain rights to access, test, monitor and audit a proprietary system.
Treasury Board added a Guide on the Use of Agentic Artificial Intelligence on 22 May 2026, the only Canadian government instrument addressing agents. The guide rests on two principles, bounded autonomy and recoverability, and is guidance rather than a binding requirement; it tells readers to assess separately whether the Directive applies. For anyone deploying agents in Canada it is currently the closest thing to a published national expectation, and it has no legal force.
Courts have produced every consequence that regulators have not
No Canadian regulator has ever imposed a monetary penalty on anyone over an AI system. Canadian courts have.
Canadian copyright litigation starts with Toronto Star Newspapers Limited v. OpenAI Inc., 2025 ONSC 6217, decided by Kimmel J. on 7 November 2025. Six Canadian news organisations including the CBC sued ten OpenAI entities for infringement, circumvention of technological protection measures including robots.txt, breach of website terms and unjust enrichment. The Court dismissed the jurisdictional motion as against the six operating and parent entities, holding that the Ontario Superior Court has subject matter jurisdiction and that the United States is not the more convenient forum. Read that as a ruling on jurisdiction, not on the merits. No Canadian court has decided whether training a model on copyrighted works infringes, and none has addressed fair dealing for AI training, which leaves Canada behind the interim positions now reached in India and the United States.
On professional conduct the record is complete and costly. In Reddy v Saroya, 2025 ABCA 322, decided 26 September 2025, the Alberta Court of Appeal found a factum citing seven non-existent authorities, six attributed to that court, and held that AI use in submissions requires meaningful human control and cross-referencing against reliable databases. The costs ruling followed in January 2026 at 2026 ABCA 20: reported at $17,550 plus GST, ordered personally against lead counsel rather than against the client. In Ontario, Ko v. Li ran to three decisions in 2025, ending on 4 December 2025 when Myers J. found that counsel had put non-existent precedent in a factum and in oral argument after relying on a chatbot without verification, creating a serious risk of a miscarriage of justice, and referred carriage of a criminal contempt to the Attorney General with an amicus appointed. No outcome of that referral has been reported. The Law Society of Ontario separately suspended the lawyer for six months in July 2026. The earlier British Columbia decision in Zhang v. Chen, 2024 BCSC 285, was the first Canadian costs award of this kind.
Canada’s whole enforcement record fits in two sentences. No company has been penalised in Canada for deploying an AI system. The only people who have paid money here over artificial intelligence are lawyers who filed citations a model invented.
The federal Privacy Commissioner found against OpenAI and could do nothing
The Office of the Privacy Commissioner of Canada concluded a joint investigation with Quebec’s Commission d’accès à l’information and the commissioners of British Columbia and Alberta on 6 May 2026. PIPEDA Findings #2026-002 held that the way OpenAI collected personal information from internet sources and third parties to train GPT-3.5 and GPT-4 was overbroad and therefore inappropriate under section 5(3), and that OpenAI did not have implied consent for it. The complaint dated from April 2023; the finding took three years. Well-founded conclusions were recorded on consent, openness, accuracy, access and correction, retention and accountability, and the matter was conditionally resolved through voluntary commitments.
PIPEDA Findings #2026-004, dated 11 June 2026, went considerably further. The Commissioner found against X Corp. and X.AI over Grok and Grok Imagine generating sexualised deepfakes of identifiable people, including non-consensual intimate imagery and child sexual abuse material, and recommended that Grok Imagine be suspended until safeguards could be shown effective, that a privacy impact assessment process be built within six months, and that annual third-party audits be submitted. The Commissioner recorded that finding as well-founded and, unlike the OpenAI matter, unresolved.
Neither Canadian finding carried a penalty, and neither could. PIPEDA gives the Commissioner no order-making power and no power to fine, as the office has itself said, and its escalation route is an application to the Federal Court under section 15, where the court rather than the Commissioner grants remedies.
Canada’s provincial regulators are the stronger ones, which is rarely said. When four regulators acted against Clearview AI in 2021, the binding orders of 14 December 2021 requiring collection to stop and images of Canadians to be deleted came from the three provincial commissioners in Quebec, British Columbia and Alberta. The federal Commissioner issued none, because it could not. Canada has issued no binding regulatory order about an AI system since, they concerned facial recognition rather than generative or decision-making AI, and they carried no money.
A regulator telling a company to withdraw a product and having no means to require it is the clearest available picture of Canadian AI enforcement.
What is coming, and what is only announced
Two Canadian government bills would move obligations to the federal level, and neither is law. Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced by Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, on 15 June 2026 and remains at second reading. C-36 would define an automated decision system broadly enough to cover rules-based systems, regression, predictive analytics, machine learning and neural networks; require a general account of any such system used to make predictions, recommendations or decisions with legal or similarly significant effect; require an explanation on request naming the type of personal information used, its source and the reasons or principal factors; and require an opportunity to make written representations to an employee able to review the outcome. Announced penalty ceilings run to $10 million or 3 per cent of global revenue, and $25 million or 5 per cent for serious offences.
Bill C-34, the Safe Social Media Act, was introduced on 10 June 2026 and is also at second reading. C-34 defines a chatbot service, imposes duties on operators of regulated chatbot services including intervention in crisis situations, and would require operators of regulated social media services to label synthetic content meeting criteria set by regulation. Narrow, then, and not general AI regulation.
A federal consultation on AI transparency opened on 23 July 2026 and closes on 23 September 2026, covering detection of AI-generated content, notification that a user is interacting with an AI system, disclosure about capabilities and limitations, serious incident tracking and monitoring of AI agents. Its discussion paper is explicit that legislation, standards, guidance and procurement requirements are all still on the table, which makes it the likelier channel for a binding federal transparency duty than either bill.
Three well-publicised Canadian instruments carry no legal force whatever. The Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, launched in September 2023 with 47 signatories, states that it does not change existing legal obligations and has no statutory basis, no regulator, no audit and no penalty. Canada’s National Artificial Intelligence Strategy, *AI for All*, launched on 4 June 2026, is a policy document with six pillars, substantial money and no AI act in it. The Canadian Artificial Intelligence Safety Institute, announced 12 November 2024 with $50 million over five years and another $50 million in June 2026, sits inside Innovation, Science and Economic Development Canada with no enabling statute, no regulatory powers and no published model evaluations; it is a research body, and calling it a safety regulator misdescribes it.
Canada signed the Council of Europe Framework Convention on Artificial Intelligence on 11 February 2025 and has not ratified it. Note the wider position too: the Convention requires five ratifications including three Council of Europe member states, the European Union is so far the only party, and the treaty has not entered into force for anyone.
Two numbers that sit oddly beside each other
*AI for All* sets a target of raising business AI adoption from 12 per cent to 60 per cent by 2034. One week after it launched, Statistics Canada reported on 11 June 2026 that 19.2 per cent of Canadian businesses had used AI to produce goods or deliver services over the twelve months preceding a survey collected between 1 April and 6 May 2026, up from 6.1 per cent in the second quarter of 2024. Two arms of the same government published adoption baselines seven points apart in the same month. Use the Statistics Canada figure, which carries a reference period and industry detail: information and cultural industries at 42.3 per cent, finance and insurance at 40.4 per cent, construction at 9.2 per cent.
Two more numbers frame Canadian risk. IBM’s Cost of a Data Breach Report for Canada, released 29 July 2026, put the Canadian average at a record CA$7.11 million, with 28 per cent of organisations reporting an AI-generated attack. And Mila and Bain reported in January 2026 that Canada hosts about 10 per cent of the world’s top AI researchers while attracting under 2 per cent of global AI venture capital. The country builds the talent, imports the governance expectations, and enforces almost none of its own.
Why so much published guidance still says AIDA is coming
Canadian buyers arrive confused partly because the ranking answers are wrong, including the official one.
The Innovation, Science and Economic Development Canada page for the Artificial Intelligence and Data Act is still live, still ranks at or near the top for the obvious queries, and still says the Act “would set the foundation” for responsible AI and that businesses “will be required” to comply. Its only marking is the standard Government of Canada archival banner: no notice that the bill died, no mention of prorogation, no pointer to what applies instead. The companion document is the same. Both show modification dates after January 2025, so both were touched after the bill died and left saying what they say.
Commercial coverage is not much better. A major international firm’s regulatory tracker, dated December 2024 and still ranking, speculates in the future tense about whether the bill will pass before the election and notes that otherwise it “will die on the order paper.” A compliance directory page titled for 2026 states that AIDA “has not yet been enacted into law,” which tells an enterprise reader to prepare for something that cannot arrive without being reintroduced. Of ten pages read across the main queries, six presented AIDA as live, pending or merely paused, and three of those six had been published or updated after the bill died.
The more useful finding is what none of them cover. Across thirteen ranking pages, not one covered more than two of the provisions set out above, and none covered the privacy findings against OpenAI or X. The most accurate page in the set correctly says there is no general framework and then names no operative section at all.
What a Canadian AI programme should be able to evidence
Canada has five obligations binding today and a sixth arriving in 2027. All of them are satisfied by records that either exist or do not.
| Obligation | Jurisdiction | Live from | Evidence required |
| Law 25 s. 12.1 | Quebec, private | 22 Sep 2023 | Notice at or before the decision; data, reasons and principal factors on request; a logged opportunity to submit observations to someone able to review |
| Law 25 ss. 8.1, 9.1 | Quebec, private | 22 Sep 2022 / 2023 | Profiling and geolocation notice, with activation controls off by default; privacy settings at highest confidentiality |
| ESA s. 8.4 | Ontario, private | 1 Jan 2026 | The disclosure as published, plus posting and application form retained three years under s. 15(7.1) |
| POPA ss. 5(2)(d), 6 | Alberta, public | 11 Jun 2025 | Collection notice recording intended automated use; accuracy effort and one-year retention |
| Criminal Code s. 162.1 | Federal | 18 Jul 2026 | Generation controls and takedown records for synthetic intimate imagery |
| OSFI E-23 (2027) | Federal, FRFIs | 1 May 2027 | Model inventory including AI and ML, validation records, monitoring and decommissioning evidence |
Quebec is where most programmes will fail first, because the observations right is procedural and leaves no trace unless someone builds one. A screenshot of a notice banner does not show that a named person capable of reviewing a decision received and considered a representation. Proof there is a workflow record, and it has to exist before a complaint arrives rather than after.
Govern365 is built for that shape of problem: holding the mapping from a provision to the artefact that proves it, so the record stands rather than being reconstructed. One control usually answers several regimes, so an organisation operating in Quebec, Ontario and the European Union can evidence section 12.1, section 8.4 and the EU AI Act transparency duties from a single set of records, and a federally regulated financial institution can point the same validation file at OSFI E-23 and at ISO/IEC 42001. Our AI compliance evidence guide sets out the artefact types, and the global AI regulation tracker places Canada beside the other regimes with their real commencement dates.
Sequence a Canadian programme by border. Automated decisions about people in Quebec carry the only monetary exposure in the country and come first. Hiring in Ontario at 25 employees or more is a one-line disclosure and a three-year retention duty, and only the second part needs building. Federally regulated financial services means E-23 and 1 May 2027. Selling to the federal government means the Directive reaches you through contract. Everywhere else in Canada, nothing AI-specific binds a private employer today, which is a reason to design to the strictest province rather than a reason to wait.
Frequently asked questions
Does Canada have an AI law?
Not a general one. The Artificial Intelligence and Data Act was never enacted and died when Parliament was prorogued on 6 January 2025. The only in-force federal provision expressly naming artificial intelligence is Criminal Code section 162.1(2)(b), covering AI-generated intimate images since 18 July 2026. Every other obligation binding a Canadian business comes from a province.
Is AIDA still coming?
No. A bill that dies on prorogation cannot resume; it must be reintroduced from scratch, and no successor AI statute has been introduced. Government pages describing AIDA in the future tense remain online but the bill has no legal status.
Which Canadian regulator can fine a company over AI?
Only Quebec’s Commission d’accès à l’information, under section 90.1(5) of the private-sector privacy Act, for breach of the automated decision rule in section 12.1. The administrative penalty reaches $10 million or 2 per cent of worldwide turnover, and a separate penal route reaches $25 million or 4 per cent. No such penalty has been imposed.
Does federal privacy law cover AI used on employees?
Only at federal works, undertakings and businesses. PIPEDA section 4(1)(b) limits employee and applicant coverage to banks, telecoms, broadcasters, interprovincial transport and similar. Alberta, British Columbia and Quebec have substantially similar provincial laws that do reach employees; most of the country has none.
What does Ontario’s AI job posting rule require?
A statement in a publicly advertised job posting disclosing that AI is used to screen, assess or select applicants, in force since 1 January 2026 for employers with 25 or more employees. Ontario requires no bias audit, no explanation and no candidate notice at the decision stage. Postings for work performed outside Ontario are excluded, and postings must be retained for three years.
Does Quebec’s automated decision rule apply to AI-assisted decisions?
Only where the decision is based exclusively on automated processing. Meaningful human involvement in the decision takes a system outside section 12.1, though section 8.1 on profiling and geolocation and section 9.1 on privacy by default may still apply.
Do British Columbia or the other provinces regulate AI?
No. Outside Quebec, Ontario and Alberta no province has an AI statute or an AI bill. British Columbia has internal public-service policy on generative AI and a health-sector framework, neither of which binds private business. No province has amended a human rights code to address algorithmic discrimination.
When do Canadian banks have to govern AI models?
OSFI Guideline E-23, Model Risk Management (2027), takes effect on 1 May 2027 and brings AI and machine learning inside the definition of a model. Until then the 2017 guideline applies. A guideline is a supervisory expectation rather than law, enforced through supervisory review rather than fines.
Has any company been penalised in Canada for an AI system?
No. No monetary penalty has ever been imposed on any organisation in Canada over an AI system. The only binding regulatory orders were the three provincial orders against Clearview AI on 14 December 2021, which carried no penalty. The only money anyone has paid over AI in Canada came from costs awards against lawyers who filed fabricated citations.
