Canada has no AI-specific federal law in force: the Artificial Intelligence and Data Act (AIDA) died with Bill C-27 when Parliament was prorogued in January 2025, and the privacy bill tabled in its place in June 2026, Bill C-36, is still before Parliament. That does not leave AI unregulated. Canadian organisations already have to meet PIPEDA, the federal, provincial and territorial privacy regulators’ principles for generative AI, Quebec’s Law 25 rules on automated decisions and, for federally regulated financial institutions, OSFI’s Guideline E-23 from May 2027. The practical response is an AI governance programme built on today’s privacy law, backed by training so employees know what the rules mean in their daily work.
This guide is for CISOs, privacy officers, general counsel and HR and L&D leaders in Canadian organisations, and for global companies with Canadian operations, who need a clear picture of the rules and a plan to act on them.
What happened to AIDA, and what replaced it?
AIDA was introduced in 2022 as Part 3 of Bill C-27, alongside a new private-sector privacy law. It would have set obligations for “high-impact” AI systems. When Parliament was prorogued on 6 January 2025, Bill C-27 died on the order paper, and AIDA with it.
In October 2025, Canada’s Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, said he would not revive AIDA in its previous form. On 15 June 2026 the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act. It is a privacy bill rather than an AI act. According to the government’s announcement, it would: Our partner AccuroAI has written a useful overview of Canadian AI regulation after AIDA.
- replace the private-sector privacy rules in PIPEDA and recognise privacy as a fundamental right;
- require organisations to be transparent about their use of automated decision making for significant decisions about individuals;
- set higher standards for handling children’s information;
- create a new Digital Safety and Data Protection Commission of Canada; and
- allow penalties of up to the greater of $10 million or 3% of global revenue, and fines of up to $25 million or 5% for the most serious offences.
Bill C-36 had its first reading on 15 June 2026 and can still be amended, so treat its details as a direction of travel, not settled law. The point for planning is simple: transparency about automated decisions is coming at the federal level, and Quebec already requires it.
The rules that apply to AI in Canada today
PIPEDA and the regulators’ generative AI principles
PIPEDA applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activity, except where a province has a substantially similar law. Its fair information principles (accountability, identified purposes, consent, limiting collection, safeguards and openness, among others) apply to AI just as they do to any other processing.
In December 2023, the Office of the Privacy Commissioner of Canada and its provincial and territorial counterparts published Principles for responsible, trustworthy and privacy-protective generative AI technologies. The document sets out nine principles: legal authority and consent; appropriate purposes; necessity and proportionality; openness; accountability; individual access; limiting collection, use and disclosure; accuracy; and safeguards. It also names “no-go zones”, such as profiling that leads to unfair or discriminatory treatment and prompting AI systems to re-identify de-identified data, and it asks organisations to guard against threats like prompt injection, model inversion and jailbreaking.
The principles do not create new law, but they show how the regulators read existing law. They are directly relevant to everyday workforce use of tools such as ChatGPT, Microsoft Copilot or Gemini, where employees decide what personal information goes into a prompt.
Quebec’s Law 25: automated decision transparency
Since 22 September 2023, section 12.1 of Quebec’s Act respecting the protection of personal information in the private sector has required any enterprise that uses personal information to make a decision based exclusively on automated processing to tell the person concerned, no later than when it tells them of the decision. On request, the enterprise must also explain the personal information used, the reasons and principal factors and parameters behind the decision, and the person’s right to have the information corrected. The person must be able to submit observations to a staff member who is in a position to review the decision.
Law 25 also requires privacy impact assessments for projects to acquire, develop or overhaul information systems that involve personal information, which covers most new AI deployments. If you serve customers or employ people in Quebec, this is the strictest AI-relevant rule you face in Canada today.
The Voluntary Code of Conduct on generative AI
In September 2023, Innovation, Science and Economic Development Canada (ISED) launched the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems. Signatories commit to six outcomes: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness. It is voluntary, but many enterprise buyers now use its six outcomes as a checklist when they assess AI vendors and internal projects.
OSFI Guideline E-23 for financial institutions
OSFI published the final Guideline E-23: Model Risk Management (2027) on 11 September 2025. It takes effect on 1 May 2027 for all federally regulated financial institutions, including banks, foreign bank branches, insurers and trust and loan companies. AI and machine learning methods fall squarely within its definition of a model. OSFI expects:
- an enterprise-wide inventory of models, including AI models and third-party models;
- a risk rating for each model that drives how much review, documentation and monitoring it gets;
- controls across the full lifecycle, from design and data to deployment, monitoring and decommissioning;
- attention to explainability, bias, privacy and drift, with governance that matures as AI use grows; and
- staff with the skills to develop, review and challenge AI models.
Financial institutions have until May 2027, which is not long for a full model inventory that includes generative AI tools and AI features inside vendor software. AccuroAI’s AI security approach for financial services shows how discovery and policy controls can feed that inventory.
A five-step AI governance checklist for Canadian organisations
1. Map AI use and the decisions it touches
- List the AI tools employees use, approved or not, and the AI features switched on inside existing SaaS.
- Flag any use that makes or supports decisions about individuals, such as hiring, credit, pricing or eligibility.
- For Quebec operations, identify any decision based exclusively on automated processing.
2. Set rules grounded in privacy law
- Write an AI acceptable use policy that names approved tools and sets clear data red lines for prompts.
- Document the legal authority and purpose for each AI use that involves personal information, in line with the OPC principles.
- Run a privacy impact assessment before deploying new AI systems, as Law 25 requires in Quebec.
3. Put controls where the risk is
- Steer staff to enterprise AI tenants and away from personal accounts.
- Use prompt-level data loss prevention to stop personal information and confidential data reaching public AI tools.
- Log what AI agents can access and do.
Our partner AccuroAI provides workforce AI governance that discovers AI use across the organisation and applies policy at the prompt, which gives privacy and security teams the evidence regulators expect.
4. Build transparency in before you are forced to
- Prepare plain-language notices for automated decisions and a process for explaining them on request.
- Give people a route to a human reviewer.
- Track Bill C-36 so you can adjust when its final automated decision rules are settled.
5. Train by role, and keep records
- Every employee: approved tools, data red lines, how to check AI output and how to report a mistake. Our Safe AI at Work programme covers this baseline.
- Privacy, legal, risk and compliance teams: PIPEDA, Law 25, the OPC principles and E-23 applied to real AI use cases, through our AI Governance & Compliance training.
- Executives and boards: AI risk appetite, accountability and the questions to ask management, covered in AI Risk & Strategy for Leaders.
- Keep completion records by role. They are useful evidence of accountability under PIPEDA and of the staff skills OSFI expects.
If you want a quick view of where you stand before you start, AccuroAI’s AI governance readiness assessment is a useful first step.
Frequently asked questions
Is there an AI law in Canada in 2026?
There is no AI-specific federal law in force. AIDA died with Bill C-27 in January 2025, and its successor, Bill C-36, is a privacy bill that was still before Parliament at the time of writing. AI use is governed by existing law, mainly PIPEDA, provincial privacy laws such as Quebec’s Law 25, human rights and consumer protection law, and sector rules such as OSFI’s Guideline E-23.
Does PIPEDA apply to employees using ChatGPT or Copilot?
Yes, where the organisation is subject to PIPEDA and personal information is involved. If an employee enters customer personal information into an AI tool, the organisation remains accountable for that information, including its safeguards and any onward use by the provider. That is why approved tools, prompt rules and training matter.
What does Quebec’s Law 25 require for AI decisions?
If a decision about a person is based exclusively on automated processing of their personal information, the enterprise must tell them, explain the information and main factors used if they ask, and let them submit observations to someone who can review the decision. The rule has applied since 22 September 2023.
Does OSFI Guideline E-23 apply to generative AI?
Yes. E-23 defines models broadly and expressly includes AI and machine learning methods. Federally regulated financial institutions need to include AI models, including vendor models, in their model inventory and risk rating by 1 May 2027.
Is the Voluntary Code of Conduct mandatory?
No. It is voluntary and applies to organisations that sign it. Its six outcomes are still a practical benchmark for internal AI governance and vendor due diligence.
Build AI governance your teams can follow
Product Innovation Academy runs corporate AI governance, AI security and AI literacy training for Canadian organisations, with AI Security & Governance programmes delivered in partnership with AccuroAI. We tailor each programme to your sector, provinces of operation and the tools your people use. Request a proposal to get started.
Sources
- Office of the Privacy Commissioner of Canada, “Principles for responsible, trustworthy and privacy-protective generative AI technologies”, 7 December 2023. priv.gc.ca
- Office of the Privacy Commissioner of Canada, “The Personal Information Protection and Electronic Documents Act (PIPEDA)”. priv.gc.ca
- Innovation, Science and Economic Development Canada, “Government of Canada tables new legislation to protect children’s data, strengthen privacy and build trust in the digital economy”, 15 June 2026. canada.ca
- Gowling WLG, “Bill C-36: Timeline of developments”, 2026. gowlingwlg.com
- BetaKit, “Evan Solomon teases new AI laws as experts warn Canada is behind international peers”, 24 October 2025. betakit.com
- Innovation, Science and Economic Development Canada, “Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems”, September 2023. ised-isde.canada.ca
- Office of the Superintendent of Financial Institutions, “Guideline E-23: Model Risk Management (2027)”, 11 September 2025. osfi-bsif.gc.ca
- Blakes, “OSFI Releases Final Guideline E-23 for Model Risk Management and AI Use by FRFIs”, September 2025. blakes.com
- Légis Québec, “Act respecting the protection of personal information in the private sector” (CQLR c P-39.1), section 12.1. legisquebec.gouv.qc.ca
- McCarthy Tétrault, “Key operational considerations ahead of the major Law 25 entry into force phase”. mccarthy.ca