🇨🇦 CanadaAIDAPIPEDA 11 min read

AI Compliance in Canada: AIDA, PIPEDA, and Provincial Laws 2026

Canada does not currently have a federal AI-specific law. The proposed Artificial Intelligence and Data Act (AIDA) died along with the rest of Bill C-27 when Parliament was prorogued on January 5, 2025 — it never received royal assent. A replacement framework is expected in 2026 but has not been reintroduced as of this writing. Quebec Law 25 is in full force and has requirements that exceed PIPEDA. Federal regulators in finance and insurance have issued AI-specific guidance. Here is what Canadian AI compliance actually looks like in 2026.

Updated April 2026 · by Aegis Firma Editorial

Canadian AI Regulatory Landscape 2026

PIPEDA (CPPA)

Federal — private sector

In force

Replacement legislation (Bill C-27 Part 1, the CPPA) died with the rest of Bill C-27 at prorogation, Jan 5, 2025 — PIPEDA (2000) remains the operative federal law

AIDA (Artificial Intelligence and Data Act)

Federal — high-impact AI

DEAD — died at prorogation Jan 5, 2025

Was Part 3 of Bill C-27; never received royal assent. No federal AI-specific statute currently in force. A replacement framework is expected in 2026 but has not been reintroduced

Quebec Law 25 (Law 64)

Quebec — all sectors

Fully in force since Sept 2023

Strictest data law in Canada; includes automated decision-making rights

Ontario Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act)

Ontario public sector AI

Passed 2024

Transparency requirements for AI in Ontario government and broader public sector

OSFI Guideline E-23

Federally regulated financial institutions

In force

Model risk management including AI/ML models; financial institutions must comply

Bill C-36 (Protecting Privacy and Consumer Data Act)

Federal — would replace PIPEDA Part 1

Pending — First Reading June 15, 2026

Not yet law. Would create a new Digital Safety and Data Protection Commission with real fining power and AI-specific consent/explanation duties. A privacy-law reform, not an AIDA-style AI statute — monitor but do not treat as binding yet

AIDA: the AI law Canada does not currently have

The Artificial Intelligence and Data Act (AIDA) was Part 3 of Bill C-27, introduced in Parliament in June 2022. It would have created Canada's first federal framework specifically for AI regulation, using a risk-based approach similar to the EU AI Act — but it died along with the rest of Bill C-27 when Parliament was prorogued on January 5, 2025, and never received royal assent. Canada currently has no federal AI-specific statute. The provisions below describe what AIDA WOULD have required — useful as a preview of what a replacement framework is likely to resemble, expected in 2026, but none of it is currently binding law.

AIDA is dead — not merely delayed

Bill C-27, including AIDA, died when the Canadian Parliament was prorogued on January 5, 2025 — all bills then pending in the House of Commons, including this one, were terminated. It was never reintroduced before this writing. The federal government has signalled a replacement framework is expected in 2026, but nothing has been formally reintroduced. Businesses have no current federal AI-specific statute to comply with — the provisions below are a preview of likely future requirements, not live law.

AIDA key provisions (as proposed — none of this is currently law)

High-impact AI systems

AIDA would have created a category of "high-impact AI systems" — defined by regulation, but expected to include AI used in consequential decisions about individuals (employment, credit, benefits, healthcare), AI with broad reach, and AI in critical infrastructure. Companies that develop or deploy high-impact AI systems would have had specific obligations.

Obligations for developers and deployers

For high-impact AI systems, the bill would have required: assess and mitigate risks (before and during deployment), monitor for risks on an ongoing basis, keep records of the assessment and mitigation measures, implement human oversight where risks cannot be mitigated, notify the designated Minister if the system is producing "material harm," and develop an AI governance program.

Transparency requirements

Would have required making publicly available a plain-language description of each high-impact AI system, including its intended purpose, the types of decisions it makes, and the measures taken to mitigate risks — somewhat less prescriptive than the EU AI Act's technical documentation requirements.

Prohibited conduct (as proposed)

AIDA would have prohibited: using AI in a reckless manner that causes serious harm to individuals, making AI available when knowing it will be used for fraud, and certain AI-enabled data processing (linked to the also-dead CPPA provisions). Criminal penalties would have applied to prohibited conduct.

Enforcement (as proposed)

A new AI and Data Commissioner would have been appointed to enforce AIDA, with administrative penalties up to $10M or 3% of global revenue, and criminal penalties for reckless harm-causing AI up to $25M or 5% of global revenue. None of this exists today — there is no AI and Data Commissioner and no AIDA penalty regime in force.

PIPEDA and AI: Current Obligations

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's current federal private-sector data protection law. It applies to any organization that collects, uses, or discloses personal information in the course of commercial activity. PIPEDA was not written for AI, but its principles apply directly to AI systems.

Accountability

Someone in your organization is responsible for PIPEDA compliance for each AI system. You need an AI system owner who can answer questions about data use.

Limiting collection

AI systems may only collect the personal information necessary for the stated purpose. Training data collected for one purpose cannot be used to train an AI for a different purpose without re-consent.

Consent

Most personal data used in AI requires consent. For sensitive uses (profiling, monitoring), meaningful consent is required — not buried in terms of service.

Individual access

Individuals can request access to their personal information held in AI systems — including what data exists, how it was used, and to whom it was disclosed.

Automated decision-making (OPC guidance)

The Office of the Privacy Commissioner (OPC) has issued guidance that individuals have the right to know when AI makes decisions about them, to receive a meaningful explanation of how the decision was made, and to have an error corrected.

OPC enforcement: The Office of the Privacy Commissioner has increased AI-related investigations. OPC investigated Clearview AI (facial recognition scraping) and found it violated PIPEDA. OPC investigated Tim Hortons' app for tracking location without meaningful consent. AI systems that profile individuals or make automated decisions about them are a growing enforcement priority.

Quebec Law 25: Canada's Strictest Data Law

Quebec's Law 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels), fully in force since September 2023, goes significantly further than PIPEDA. For companies with customers or employees in Quebec, Law 25 creates the most demanding Canadian compliance requirements — including provisions that look more like GDPR than PIPEDA.

Automated decision-making disclosure (Article 12)

Article 12 — Key AI Obligation

When a decision is based exclusively on automated processing of personal information and produces legal or significant effects, individuals must be notified. They have the right to: know what personal information was used, request human review of the decision, and submit observations. This is Canada's clearest analog to GDPR Article 22.

Privacy Impact Assessments (PIAs) mandatory

Mandatory before launch

Any project involving the collection, use, communication, or disclosure of personal information, or any IT system that processes personal information, must have a Privacy Impact Assessment conducted before launch. This applies directly to AI system deployments.

Data minimization and purpose limitation

Stricter than PIPEDA: personal information may only be collected for the explicit purpose stated in the privacy notice. Using data collected for one purpose in a new AI system requires a new PIA and updated privacy notice.

Breach notification

Breaches involving personal information must be reported to the Commission d'accès à l'information (CAI) and affected individuals "without delay" when there is a risk of serious harm.

What to do now

Complete a PIPEDA compliance review for all AI systems that process Canadian personal data. The OPC's guidance on automated decision-making provides the specific framework.

If you have Quebec customers or employees: conduct mandatory Privacy Impact Assessments (PIAs) for all AI systems before deployment. Implement Article 12 disclosure and human review mechanisms.

AIDA is dead, not just delayed — inventory your high-impact AI systems against its proposed scope anyway, since a 2026 replacement is expected to resemble it, and PIPEDA/Quebec Law 25 already require much of the same risk-assessment groundwork today.

For federally regulated financial institutions: ensure OSFI E-23 model risk management compliance applies to AI/ML models.

Appoint a Privacy Officer with authority over AI system reviews. Both PIPEDA and Law 25 require an accountable individual.

Prepare automated decision-making notices in both English and French for Quebec users.

Review data processing agreements with any AI vendors processing Canadian personal data.

Monitor Bill C-36 (tabled June 15, 2026) — it would replace PIPEDA with real enforcement powers and AI-specific consent/explanation duties, but is not yet law.

Check your Canadian AI compliance status

Aegis Firma covers PIPEDA, Quebec Law 25, and tracks AIDA's successor as it develops. Get your free risk report and see exactly which requirements apply to your AI systems.

Get my free risk report