Canada's AI rules after AIDA: what actually applies to your business

Ask a room of Canadian business owners what law governs their use of AI and most will name AIDA — the Artificial Intelligence and Data Act. AIDA does not exist. It died in January 2025, before it was ever passed, and the minister responsible has said it will not return as drafted. But "no AI act" does not mean "no AI rules." AI use in Canada is governed today by a patchwork of privacy law, provincial statutes, employment rules and sector regulators — several of them in force, with penalties attached. This post inventories what actually binds a Canadian business now.

Quick answer

• There is no Canadian AI act. AIDA, Part 3 of Bill C-27, died on the Order Paper when Parliament was prorogued on 6 January 2025.

• PIPEDA still governs how your business collects, uses and discloses personal information — including through AI tools — and you remain accountable for what your AI vendors do with it.

• Quebec's Law 25 is the strictest regime in the country and it is fully in force: it includes a specific duty to disclose decisions made exclusively by automated processing, and penalties up to $25 million or 4% of worldwide turnover.

• Ontario employers with 25 or more staff have had to disclose AI use in job postings since 1 January 2026.

• If you sell to banks or insurers, OSFI's Guideline E-23 takes effect 1 May 2027 and will reach you through your customers' contracts.

• A successor privacy bill (Bill C-36) was tabled in June 2026 and would add automated-decision transparency duties — but it is not an AI act, and it is not in force.

What happened to AIDA

Bill C-27, the Digital Charter Implementation Act, was introduced in June 2022 with three parts: the Consumer Privacy Protection Act (a PIPEDA replacement), a data-protection tribunal, and AIDA, which would have imposed risk-management, documentation and disclosure duties on "high-impact" AI systems. The bill spent 2023 and 2024 in committee and never finished. On 6 January 2025 Parliament was prorogued, and every bill that had not received Royal Assent — C-27 included — died on the Order Paper.

In June 2025, Evan Solomon, the Minister of Artificial Intelligence and Digital Innovation, said AIDA as drafted was "off the table" and that any replacement would be "light, tight, and right." No replacement AI act has been introduced. What Ottawa has done instead is narrower: in June 2026 the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act, a privacy bill that would replace PIPEDA and add transparency requirements for automated decision-making in significant decisions about individuals. It is worth tracking. It is not law, and it is not an AI act.

The rules that actually bind you now

1. PIPEDA — the federal privacy baseline

PIPEDA, Canada's federal private-sector privacy law, has no AI chapter. It does not need one to reach your AI use. Its ten fair information principles apply to personal information however it is processed: if staff paste customer or employee information into an AI tool, that is a use and a disclosure your organization is accountable for — including when the processing is done by a third-party provider on your behalf. The Privacy Commissioner of Canada has applied PIPEDA to AI systems in investigations and guidance, and expects organizations to be able to explain purposes, obtain meaningful consent, limit what is collected, and safeguard what they hold.

PIPEDA's weakness is enforcement, not coverage: the Commissioner investigates and publishes findings but, outside the breach-reporting rules, has no general power to fine. Treat that as a reason the reputational and customer consequences arrive before the legal ones, not as a reason the obligations are optional. Alberta and British Columbia have their own PIPAs that apply to much provincial private-sector activity, with their own consent rules.

2. Quebec Law 25 — the strictest bar in Canada, already in force

Quebec's Law 25 finished phasing in on 22 September 2024 and is the closest thing Canada has to a GDPR-grade regime. Three provisions matter most for AI use:

• Automated decisions (section 12.1). If a decision about a person is based exclusively on automated processing of their personal information, you must inform them — and, if they ask, tell them the personal information used, the reasons and the principal factors that led to the decision, and give them the opportunity to submit observations to a person who can review the decision. A fully automated rejection with no explanation and no human route is exactly what this section prohibits.

• Privacy impact assessments. A PIA is required before communicating personal information outside Quebec — which describes most US-hosted AI tools — and for projects to acquire, develop or overhaul information systems involving personal information.

• Privacy by default and portability. Technology that identifies, locates or profiles people must default to its most privacy-protective settings, and individuals can obtain their information in a portable format.

The penalties are real: administrative penalties up to $10 million or 2% of worldwide turnover, whichever is higher, and penal fines up to $25 million or 4%. If your business has Quebec customers or employees, Law 25 applies to you wherever your head office is.

3. Ontario's AI hiring disclosure rule — in force since January 2026

Ontario's Working for Workers Four Act (Bill 149) amended the Employment Standards Act, and its job-posting requirements (O. Reg. 476/24) came into force on 1 January 2026. Employers with 25 or more employees must state, in a publicly advertised job posting, whether artificial intelligence is used to screen, assess or select applicants. The regulation does not require naming the tool — but it does require the statement, and it sits in a package that also mandates compensation ranges, bans requiring Canadian experience, requires a statement on whether the vacancy is real, and requires telling interviewed applicants whether a hiring decision has been made within 45 days. If your Ontario hiring process uses an AI screening tool and your postings say nothing about it, that is a live compliance gap, not a future one.

4. OSFI Guideline E-23 — if finance is your customer

The Office of the Superintendent of Financial Institutions published the final version of Guideline E-23 — Model Risk Management on 11 September 2025. It takes effect 1 May 2027 for all federally regulated financial institutions — banks, insurers, trust and loan companies — expanded well beyond the deposit-taking institutions the 2017 version covered. Its definition of "model" expressly includes AI and machine learning methods, and it expects institutions to maintain a model inventory, risk-tier their models, and govern them across their lifecycle.

E-23 binds financial institutions, not you. Its reach to everyone else is contractual: a bank or insurer that must inventory and govern every model it relies on will ask its vendors and service providers how their AI works, who oversees it, and what evidence exists. If financial institutions are among your customers, expect E-23 questions in your inbox before May 2027.

5. Government rules that reach suppliers

The Treasury Board Directive on Automated Decision-Making binds federal institutions, not private companies: it requires algorithmic impact assessments and matching transparency, human-oversight and recourse measures before a federal institution uses AI for administrative decisions. Its private-sector reach is procurement — departments flow those expectations into the contracts of the vendors who supply or operate the systems. Separately, ISED's Voluntary Code of Conduct on generative AI (2023) remains the federal government's main AI policy reference for industry. It is voluntary and creates no legal duties — but its measures (transparency, human oversight, accountability) are a reasonable preview of what any future Canadian regime will ask for, and its signatories include companies like Cohere, OpenText, BlackBerry and Telus.

6. The law that was already there

Two more sources of AI obligations predate the AI debate entirely. Human rights codes, federal and provincial, prohibit discrimination in employment and services — an AI screening tool that produces discriminatory results engages them regardless of intent. And ordinary liability law treats your AI's statements as yours: in Moffatt v. Air Canada (2024), a tribunal held the airline liable for wrong fare information its website chatbot gave a customer, rejecting the argument that the chatbot was a separate entity responsible for its own words. There is no "the AI said it" defence in Canada.

The inventory on one page

Rule	Who it binds	What it requires for AI use	Status
PIPEDA	Most Canadian businesses	Privacy principles applied to AI processing of personal information; accountability for AI vendors	In force
Quebec Law 25	Anyone handling Quebecers' information	Automated-decision disclosure + explanation + human review; PIAs; privacy by default	In force (fully, since Sep 2024)
Ontario ESA posting rules (Bill 149)	Ontario employers, 25+ staff	Disclose AI screening in public job postings	In force since 1 Jan 2026
OSFI E-23	Federally regulated financial institutions	Model inventory incl. AI/ML, risk-tiering, lifecycle governance	Effective 1 May 2027
Treasury Board ADM Directive	Federal institutions	Impact assessments, transparency, oversight — flows to vendors by contract	In force
ISED generative AI code	Voluntary signatories	Transparency, oversight, accountability measures	Voluntary
Bill C-36	Would bind most businesses	Privacy overhaul + automated-decision transparency	Proposed — not in force

What to do while Ottawa decides

Nothing in the patchwork asks for an AI department. What it asks for, repeatedly and in different words, is the same short list: know which AI tools you use and what information goes into them; disclose meaningful AI use where people are affected by it; keep a human responsible for important decisions; and be able to show your work. Those are working practices, and they are also the substance of the Ethicality AI Use Standard (EAUS) — which is why documented, certified AI governance is the practical way to be ready for the successor regime, whatever shape "light, tight and right" turns out to be. Businesses selling into Europe have a second, harder-edged set of duties — see the EU AI Act for Canadian companies and the deployer guide.

Frequently asked questions

So there is no Canadian AI law at all?

There is no dedicated federal AI statute. There is a good deal of law that applies to AI use — privacy, employment, human rights, sector regulation — which is a different thing from no law.

We have fewer than 25 employees. Are we exempt?

From the Ontario job-posting rule, yes. From PIPEDA, no. From Law 25, if you handle Quebecers' information, no. The 25-employee threshold applies to one rule in the patchwork, not to the patchwork.

We don't operate in Quebec. Does Law 25 matter to us?

If you have customers, users or employees in Quebec whose personal information you handle, Law 25 applies to that information — including the automated-decision rule and the assessment required before their information is sent outside Quebec, which most AI tools involve.

Will AIDA come back?

Not as drafted — the responsible minister has said so. The live federal vehicle is Bill C-36, a privacy bill with automated-decision transparency provisions, still before Parliament. Plan against the rules in force; track C-36; don't design against provisions that may change in committee.

Our customers keep asking about our AI governance. Which rule is that?

Usually none of them directly — it is the flow-down effect: OSFI-regulated institutions preparing for E-23, public-sector buyers under the Treasury Board Directive, and EU customers under the EU AI Act all push their obligations into supplier questionnaires. The answer they are looking for is documented practice, which is what certification evidences. More on who we are at What is Ethicality, and common questions in the FAQ.

Governed is a state you can reach this quarter

Canada's AI rules are a patchwork, but the patches point the same direction. Get certified and an independent assessment checks the practices — disclosure, human accountability, protection of confidential information — that every regime in this inventory is converging on. The assessment is free; you pay only if certification is issued.