AI law and policy in Canada

Canada was among the first countries to adopt a national AI strategy, in 2017, and its researchers helped create modern deep learning. Its approach to regulating AI has nonetheless been cautious and is still evolving. There is no AI-specific federal statute in force: the proposed Artificial Intelligence and Data Act died in January 2025, and the federal government has since emphasized adoption, investment and trust, with new privacy and online harms legislation as the main vehicles for protecting the public. This lesson explains the federal landscape, the rules governing government's own use of AI, provincial laws, the regulators that apply existing law to AI, and how organizations should navigate this evolving framework.

Federal legislation and policy

The Artificial Intelligence and Data Act (AIDA), introduced in 2022 as part of Bill C-27, would have regulated "high-impact" AI systems with requirements for risk assessment, mitigation, monitoring and transparency, enforced by an AI and Data Commissioner. It was criticized for leaving key definitions to future regulations and for limited consultation, and it died on the order paper when Parliament was prorogued in January 2025, along with the privacy reforms in the same bill. In May 2025, the federal government appointed Canada's first Minister of Artificial Intelligence and Digital Innovation, signalling a focus on adoption and economic benefit. A renewed national AI strategy announced in June 2026 emphasized trust, workforce support, sovereign compute infrastructure, support for Canadian AI companies and international coordination. Rather than reintroducing a broad AI act, the government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, in June 2026 (Lesson 4), and announced a separate online harms bill, describing these as the legal foundations for trust in AI. As of late 2026, Bill C-36 was before Parliament.

Government use of AI

The federal Directive on Automated Decision-Making, issued by the Treasury Board in 2019 and updated since, governs federal institutions' use of automated systems to make or support administrative decisions about people. It requires an Algorithmic Impact Assessment (AIA), a published questionnaire whose score assigns an impact level from I (little impact) to IV (very high impact), with escalating requirements: notice to affected people, peer review, quality assurance and testing for bias, human intervention in final decisions at higher levels, explanations of decisions, recourse, and publication of the assessment. The government has also issued guidance on federal use of generative AI. Several provinces govern public sector AI too: Ontario's Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 enables requirements for public sector entities to disclose AI use, manage risks and ensure accountability.

Impact assessments of this kind are a model for any organization: a structured questionnaire about the decision, the people affected, the data and the degree of automation produces a score, mitigation measures reduce it, and the resulting level determines the required safeguards.

# An algorithmic impact assessment: questionnaire answers produce a raw risk score,
# mitigation measures reduce it, and the result maps to an impact level with required safeguards.
risk_answers = {  # question: points
    "decision affects rights, benefits or liberty": 8,
    "fully automated without human review": 6,
    "uses personal information": 4,
    "affects vulnerable groups": 5,
    "model is complex or opaque": 3,
    "decision hard to reverse": 4,
    "large number of people affected": 3,
}
mitigations = {"human review of all adverse decisions": 5, "documented testing for bias": 3,
               "plain-language explanation to affected people": 2, "recourse and appeal process": 3}
raw = sum(risk_answers.values())
max_raw = 40
mitigated = raw - sum(mitigations.values())
share = mitigated / max_raw
level = 1 + sum(share > t for t in (0.25, 0.50, 0.75))
safeguards = {1: "basic notice", 2: "notice, peer review, documentation",
              3: "plus human review of decisions, bias testing, explanation", 4: "plus independent review and senior approval"}
print(f"raw risk score {raw} of {max_raw}; after mitigation {mitigated} ({share:.0%})")
print(f"impact level {level}: {safeguards[level]}")
for drop in ["human review of all adverse decisions"]:
    m2 = raw - (sum(mitigations.values()) - mitigations[drop])
    print(f"without {drop}: score {m2} ({m2 / max_raw:.0%}), level {1 + sum(m2 / max_raw > t for t in (0.25, 0.50, 0.75))}")

raw risk score 33 of 40; after mitigation 20 (50%)
impact level 2: notice, peer review, documentation
without human review of all adverse decisions: score 25 (62%), level 3

The system starts with a high raw risk score because it affects rights and is fully automated, but documented mitigations, including human review of adverse decisions, bias testing, explanations and an appeal process, bring it down to level 2. Removing human review alone pushes it to level 3, triggering stronger requirements. Assessments like this encourage designers to build mitigations in, and make the reasoning behind deployment decisions visible to reviewers and the public.

Existing law applied to AI

In the absence of an AI statute, existing laws and regulators carry most of the load:

• Privacy: the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial private-sector laws, enforced by the Office of the Privacy Commissioner and provincial commissioners, who have investigated facial recognition (Clearview AI) and issued guidance on generative AI (Lesson 4).
• Human rights: the Canadian Human Rights Act and provincial human rights codes prohibit discrimination in employment, services and housing, whether by people or algorithms (Lesson 5).
• Competition and consumer protection: the Competition Bureau has studied AI and algorithmic pricing and applies the Competition Act's rules on deceptive marketing, including false claims about AI.
• Sector regulators: OSFI (financial institutions), Health Canada (medical devices), Transport Canada and others regulate AI within their domains (Lesson 9).
• Standards and voluntary codes: the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems (2023), signed by many companies, and standards from the Standards Council of Canada and the Digital Governance Standards Institute.

Provincial and state laws

Provinces have acted in several areas. Quebec's Law 25, which modernized its private-sector privacy law with obligations phased in from 2022 to 2024, requires organizations that make decisions based exclusively on automated processing of personal information to inform the person and, on request, explain the information and factors used and allow them to submit observations to a person who can review the decision. Ontario requires employers with 25 or more employees to disclose in publicly advertised job postings whether AI is used to screen, assess or select applicants, from January 1, 2026, under its Working for Workers legislation, and has public sector AI rules. Other provinces regulate AI indirectly through privacy, employment and consumer laws. Because Canada lacks a federal AI statute, organizations operating across provinces must follow the strictest applicable rules, often Quebec's.

Canadian organizations that also operate in the United States or the European Union face those jurisdictions' rules as well, and in practice many Canadian companies align their AI governance with the EU AI Act and with US state laws to serve those markets.

The national framework question

Canada's debate is less about federal-provincial preemption than about whether a dedicated AI law is needed at all. Supporters of an AI act argue that privacy and human rights laws do not cover risks such as unsafe autonomous systems, and that Canada risks falling behind trading partners; others argue that existing laws, sector regulators and standards are sufficient and that premature regulation would hamper adoption. The constitutional division of powers also matters: the federal government regulates trade and commerce, criminal law and federally regulated industries, while provinces regulate property and civil rights, employment in most sectors, health and education, so comprehensive AI regulation would likely require both levels of government.

Navigating an evolving framework

In an environment where rules are changing and sometimes contested, organizations can take several practical steps:

• Track developments systematically: assign responsibility for monitoring legislation, regulatory guidance, enforcement actions and court decisions in each jurisdiction of operation.
• Build on principles that persist across regimes: inventories, risk assessment, documentation, testing, human oversight and notice are required or encouraged almost everywhere, so investments in them remain useful as specific rules change.
• Comply with the strictest applicable rule where feasible, rather than maintaining many variants.
• Pay close attention to government customers and regulated sectors, where rules are often more detailed and enforced through procurement and supervision.
• Engage in consultations: governments in both countries regularly seek input on AI policy, and practitioners can contribute technical expertise.

Who regulates what: a practical map

For any AI deployment, it helps to identify the regulators whose existing mandates reach it. A useful exercise is to list, for each system, the regulator of personal information (a privacy commissioner or consumer protection agency), the regulator of discrimination (a human rights commission or civil rights enforcement agency), the regulator of advertising and consumer claims, any sector regulator (banking, insurance, health, transport, telecommunications, securities), and any government customer whose procurement rules apply. Each has its own powers, guidance and enforcement priorities, and their publications on AI are among the best indicators of what they will expect. Where several regulators share jurisdiction, as with a bank's AI hiring tool, the organization must satisfy all of them, and coordinated guidance from regulators is increasingly common.

Because AI policy is evolving quickly, organizations also benefit from tracking signals beyond formal law: government consultations and strategy documents, statements by ministers and agency heads, enforcement actions in neighbouring jurisdictions, and standards development. These often show the direction of future requirements years before they become binding.