Canada AI Regulation in 2026: What Happened to AIDA, What Bill C-36 Would Require, and the Quebec, Ontario, and OSFI E-23 Rules

Does Canada have an AI law?

Not a comprehensive one. As of November 2, 2026, Canada has no federal statute in force that regulates AI systems as such: the Artificial Intelligence and Data Act was never passed, and C-36, the privacy bill that followed C-27, is still at second reading. AI is regulated through privacy law, a few targeted provincial rules, sector guidance, and general laws on competition and human rights.

The rules attach to what a company does with personal information, job applicants, or customers, not to a risk tier. A US company can be covered without an office in Canada.

What happened to the Artificial Intelligence and Data Act, and what came next?

AIDA was Part 3 of Bill C-27, the Digital Charter Implementation Act, 2022, introduced June 16, 2022. According to the government’s companion document, it would have required businesses responsible for “high-impact systems” to identify, assess, and mitigate risks of harm and biased output, keep records, publish a description of the system, and notify the Minister of material harm. It left the meaning of “high-impact system” to criteria to be set in regulations.

The bill passed second reading on April 24, 2023 and was still before the House Standing Committee on Industry and Technology when the Governor General prorogued Parliament on January 6, 2025 (SI/2025-9). Government bills that have not received Royal Assent die at prorogation, although the House can reinstate a bill in the new session by unanimous consent or by motion. LEGISinfo records C-27’s final status as “At consideration in committee in the House of Commons” and shows no later stage.

Four developments since then matter. Bill status is as LEGISinfo showed it on November 2, 2026.

• May 13, 2025. Prime Minister Carney named Evan Solomon Minister of Artificial Intelligence and Digital Innovation.
• June 4, 2026. The Prime Minister launched Canada’s National Artificial Intelligence Strategy, AI for All. It is a strategy, not a statute.
• June 10, 2026. Bill C-34, the Safe Social Media Act, would enact a Digital Safety Act that would put a duty to act responsibly on operators of regulated chatbot services: chatbot services that meet a user threshold set by regulation or are designated by regulation (proposed Digital Safety Act, sections 7 and 48). It passed second reading on October 29, 2026 and is in committee.
• June 15, 2026. Bill C-36 would enact the Protecting Privacy and Consumer Data Act and repeal Part 1 of PIPEDA. It has completed first reading and no later stage.

C-36 does not revive AIDA’s regime for high-impact systems; it treats AI as a privacy matter. It defines an “automated decision system” as any technology that assists or replaces the judgment of human decision-makers, including machine learning and neural networks.

An organization would have to make available, in plain language, a general account of its use of any automated decision system to make predictions, recommendations, or decisions about individuals that could have a legal or similarly significant effect on them (section 62(2)(c) of the proposed Act; the section numbers below are also those of the proposed Act, not clauses of the bill). On request, it would have to explain such a prediction, recommendation, or decision, including the type and source of personal information used and the reasons or principal factors (section 63(4) and (5)), and let the individual make written representations to an employee able to review it (section 63(6)). For all contraventions found in any one investigation, the administrative penalty would be capped at the greater of $10,000,000 and 3% of gross global revenue (section 114). Separate fines of up to the greater of $25,000,000 and 5% of gross global revenue would apply on indictment to listed offences, including knowingly contravening certain duties and obstructing the Commissioner (section 145).

Which Canadian rules apply to AI in 2026?

Read the Status column first. The table mixes law in force with a bill that never passed, a pending bill, securities staff guidance, a guideline that takes effect in 2027, and a voluntary code.

Canadian AI-relevant rules, as of November 2, 2026

Rule	Who it reaches	What it says about AI	Status
Artificial Intelligence and Data Act (Bill C-27, Part 3)	Would have covered persons carrying out regulated activities involving AI systems	Risk measures, records, and public descriptions for high-impact systems	Not passed; session ended January 6, 2025
Bill C-36, Protecting Privacy and Consumer Data Act	Would cover organizations handling personal information in commercial activities	General account of automated decision systems; explanation on request; written representations	Proposal; at second reading (LEGISinfo, November 2, 2026)
PIPEDA	Organizations collecting, using, or disclosing personal information in commercial activities, outside matters governed by substantially similar provincial laws	Consent and appropriate purposes for training and use; no AI-specific section	In force
Quebec private sector privacy act, s. 12.1	Any person carrying on an enterprise	Notice of a decision based exclusively on automated processing; information on request; chance to submit observations	In force since September 22, 2023
Ontario Employment Standards Act, 2000, s. 8.4	Ontario employers, except those employing fewer than 25 employees on the day the posting is posted	Statement in a publicly advertised job posting if AI is used to screen, assess, or select applicants	Postings on or after January 1, 2026
Ontario Enhancing Digital Security and Trust Act, 2024	Ontario public sector entities prescribed by regulation	Public information, accountability framework, and risk management for AI use	In force January 29, 2025; no AI regulation listed by Ontario as of October 22, 2026
OSFI Guideline E-23	Federally regulated financial institutions	Enterprise model risk management, including AI/ML models and vendor models	Effective May 1, 2027
CSA Staff Notice and Consultation 11-348	Registrants, non-investment fund reporting issuers, marketplaces, and other market participants	Staff guidance on how existing securities law applies to AI systems; creates no new requirements	Published December 5, 2024
Directive on Automated Decision-Making	Federal institutions subject to the Policy on Service and Digital	Algorithmic Impact Assessment results published before production; notice; explanation; testing	In force; existing systems had until June 24, 2026 for the 2025 updates
Voluntary Code of Conduct on advanced generative AI	Organizations that sign it	Commitments on accountability, safety, fairness, transparency, human oversight, robustness	Voluntary; published September 2023

How does privacy law apply to AI in Canada?

PIPEDA applies to every organization in respect of personal information it collects, uses, or discloses in the course of commercial activities, and to personal information about its employees and job applicants that it collects, uses, or discloses in connection with the operation of a federal work, undertaking, or business (section 4(1)). Section 5(3) allows collection, use, or disclosure only for purposes a reasonable person would consider appropriate in the circumstances. Alberta, British Columbia, and Quebec have their own private-sector laws deemed substantially similar; PIPEDA still applies there to cross-border transfers and to federal works such as banks.

The federal, provincial, and territorial privacy regulators set out their reading of the law in their December 7, 2023 principles for generative AI: know and document legal authority, collect and use personal information only for purposes a reasonable person would consider appropriate, and ensure that system outputs that could have a significant impact on an individual or group are meaningfully identified as being created by a generative AI tool. The principles say they do not bind any specific investigations or adjudications.

Two 2026 findings show how the OPC applies PIPEDA to AI:

• OpenAI, May 6, 2026. The OPC and the Quebec, British Columbia, and Alberta regulators concluded that OpenAI’s initial training of ChatGPT did not comply with their respective privacy laws, citing among other issues overcollection and a lack of valid consent and transparency. Under PIPEDA the complaint was well-founded and conditionally resolved: the Commissioner found that the measures OpenAI had implemented and committed to, including significantly limiting the personal and sensitive information used to train new models, will address the concerns.
• X Corp. and xAI, June 11, 2026. On Grok-generated sexualized deepfakes, the OPC found contraventions of the consent principles (4.3 and 4.3.4) and section 5(3), and called the matter well-founded and not resolved at the date of the report. The companies disagreed with the conclusions and said that suspending Grok Imagine, as the OPC recommended, was not warranted; they committed to the OPC’s other recommendations.

What does Quebec require for automated decisions?

Section 12.1 of the Act respecting the protection of personal information in the private sector applies to any person carrying on an enterprise who uses personal information to render a decision based exclusively on an automated processing of that information. The enterprise must inform the person concerned of this not later than when it informs the person of the decision. At the person’s request, it must also inform the person of the personal information used, the reasons and the principal factors and parameters that led to the decision, and the right to have that personal information corrected. The person must be given the opportunity to submit observations to a member of the enterprise’s personnel who is in a position to review the decision.

The section came from An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25, often called Law 25). Most of that Act’s provisions, section 12.1 among them, took effect September 22, 2023. Section 3.3 also requires a privacy impact assessment for any project to acquire, develop, or overhaul an information system or electronic service delivery system involving the collection, use, communication, keeping, or destruction of personal information. For an enterprise that is not a natural person, the maximum monetary administrative penalty is $10,000,000 or, if greater, 2% of worldwide turnover for the preceding fiscal year (section 90.12). The Commission d’accès à l’information may inquire into an enterprise’s practices (section 81), and a person it designates may impose a monetary administrative penalty on anyone who fails to give the section 12.1 notice or the opportunity to submit observations (section 90.1).

What must Ontario employers disclose about AI in job postings?

Under section 8.4(1) of the Employment Standards Act, 2000, added by the Working for Workers Four Act, 2024 (Bill 149), every employer who advertises a publicly advertised job posting and who uses artificial intelligence to screen, assess or select applicants for the position must include in the posting a statement disclosing that use. Ontario’s guide says the rules generally apply to postings posted on or after January 1, 2026.

• Definition. O. Reg. 476/24 defines artificial intelligence as a machine-based system that, for explicit or implicit objectives, infers from the input it receives in order to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.
• Exemption. The job-posting rules do not apply to an employer that employs fewer than 25 employees on the day the posting is posted.
• Exclusions. The regulation excludes several kinds of posting, including general recruitment campaigns that do not advertise a specific position, postings restricted to existing employees, and postings for work to be performed outside Ontario.
• Records. Employers must retain copies of every publicly advertised job posting and any associated application form for three years after access to the posting by the general public is removed (section 15(7.1)).

What do Canadian financial regulators expect from AI models?

OSFI published Guideline E-23, Model Risk Management (2027), on September 11, 2025, effective May 1, 2027. It applies to federally regulated financial institutions, including banks, foreign bank branches, insurers, and trust and loan companies. It defines a model to include AI/ML methods that process input data to generate results. It is a principles-based guideline that sets out OSFI’s expectations: institutions should identify and track all models in use, including vendor and third-party models, keep the models with non-negligible inherent risk in a model inventory, assign each model a risk rating, and scale model lifecycle governance to that rating.

For capital markets, CSA Staff Notice and Consultation 11-348 of December 5, 2024 explains how staff interpret existing securities law for AI systems used by market participants, including registrants, non-investment fund reporting issuers, and marketplaces. It states that it does not create any new legal requirements or modify existing ones.

What rules cover AI used by governments?

The Treasury Board Directive on Automated Decision-Making binds federal institutions subject to the Policy on Service and Digital, for any automated decision system in production used to make an administrative decision or a related assessment about a client. Before production, the institution must complete and approve an Algorithmic Impact Assessment and publish its final results in an accessible format on the Open Government Portal (section 6.1.1). The Directive binds the institution, not its vendor; where the system is used under a proprietary licence, the institution must retain the right to access, test, and monitor the system, including all released versions of proprietary software components, in case that is necessary for a specific audit, investigation, inspection, examination, enforcement action, or judicial proceeding, subject to safeguards against unauthorized disclosure (section 6.2.6.1).

In Ontario, the Enhancing Digital Security and Trust Act, 2024, enacted by Bill 194 (S.O. 2024, c. 24), applies to public sector entities such as provincial and municipal institutions, children’s aid societies, and school boards. Its AI sections came into force January 29, 2025 (Order in Council 361/2025), but its duties to inform the public, adopt an accountability framework, and manage risk apply to the entities and circumstances prescribed by regulation, and they bind those public sector entities, not the private companies that sell to them. Ontario’s EDSTA page, updated October 22, 2026, lists two regulations in effect from July 1, 2026, on cyber security (O. Reg. 51/26) and on school boards’ handling of students’ digital information (O. Reg. 52/26), and no regulation on AI use.

Do competition and human rights law reach AI?

Yes, without naming it. Section 52(1) of the Competition Act prohibits knowingly or recklessly making a representation to the public that is false or misleading in a material respect to promote a product or business interest, “by any means whatever.” Section 74.01(1)(a) makes the same kind of false or misleading representation reviewable conduct in civil proceedings, without the knowledge or recklessness element.

The Canadian Human Rights Act makes it a discriminatory practice, “directly or indirectly,” to refuse to employ an individual or to differentiate adversely in relation to an employee on a prohibited ground (section 7), and to deny, or differentiate adversely in providing, goods, services, facilities, or accommodation customarily available to the general public on a prohibited ground (section 5). The Act applies within the legislative authority of Parliament (section 2); ask counsel which provincial human rights law governs matters outside it.

Does Canadian AI regulation reach a US company?

It can. The OPC applies PIPEDA to organizations outside Canada where there is a real and substantial connection to Canada; in the X Corp. and xAI findings it relied on factors including services offered to users in Canada, the collection of personal information about people in Canada, and transfers of that information between Canada and the United States, and it said a physical presence in Canada is not required for services delivered by website or app.

A US employer that uses AI to screen, assess, or select applicants for a publicly advertised job to be performed in Ontario must make the section 8.4 statement unless it employs fewer than 25 employees on the day of posting; Ontario’s guide says employees at every Ontario location are counted; whether employees outside Ontario count is a question for Ontario counsel. A company making exclusively automated decisions about people in Quebec should ask Quebec counsel whether section 12.1 reaches it before relying on having no Quebec office.

What should a company with Canadian users or staff do now?

• List every AI system that processes personal information of people in Canada and record the purpose a reasonable person would consider appropriate
• Document consent or other legal authority for personal information in training data, following the OPC’s OpenAI and X findings
• Identify decisions about people in Quebec that are based exclusively on automated processing and build the section 12.1 notice, explanation, and review steps
• Add the section 8.4 statement to publicly advertised Ontario job postings where AI screens, assesses, or selects applicants, unless the employer has fewer than 25 employees on the day of posting, and keep each posting and application form for three years after public access ends
• For a federally regulated financial institution, identify and track AI and vendor models, rate their risk, and keep those with non-negligible inherent risk in the model inventory before May 1, 2027, as OSFI expects
• Draft the general account and explanation process C-36 would require, and track the bill on LEGISinfo
• Review AI-generated marketing claims against sections 52 and 74.01 of the Competition Act

How this fits the other guides: the AI compliance guide is the hub for cross-border AI laws. Compare Ontario’s posting duty with the employment and HR guide, E-23 with the financial services guide, and AIDA’s high-impact regime, which never passed, with the EU AI Act guide.

This guide is general information as of November 2, 2026, not legal advice. Confirm the current text with the regulator or counsel admitted in the relevant province before acting.

By industry: all 8 industry pages