AI Regulation in Canada 2026: PIPEDA, Bill C-27, and Provincial Frameworks

Canada's federal AI legislation lapsed when Bill C-27 died on the order paper in 2025. But PIPEDA, Quebec Law 25, and sector regulators create real AI governance obligations now — and a successor AI bill is expected. The complete 2026 guide.

Key Takeaways

Bill C-27, which included the Artificial Intelligence and Data Act (AIDA), died on the order paper when Parliament was prorogued in January 2025. A new bill has not yet been introduced. However, AIDA's requirements signal the direction of Canadian AI regulation and organisations should build governance infrastructure consistent with its approach.
PIPEDA (Personal Information Protection and Electronic Documents Act) and provincial privacy laws (Quebec Law 25, Alberta PIPA) create current AI governance obligations — transparency, purpose limitation, and individual rights apply to AI data processing now.
Quebec's Law 25 (in force September 2023) includes specific provisions on automated decision-making and profiling that create obligations for organisations operating in Quebec — it is the most AI-specific privacy law currently in force in Canada.
The Office of the Privacy Commissioner of Canada has published guidance on AI and privacy that creates expectations for PIPEDA compliance — meaningful consent, transparency, and individual rights apply to AI systems processing Canadians' personal data.
Financial services AI in Canada is regulated by OSFI (banking and insurance) and IIROC (investment dealers) — OSFI's operational risk guidance and IIROC's technology risk framework both apply to AI systems.

"情報提供のみを目的としています。この記事は法律、規制、財務または専門的なアドバイスを構成するものではありません。具体的なアドバイスについては、資格を持つ専門家にご相談ください。"

Canada AI regulation in 2026 — where things stand

Canada's AI regulatory landscape in 2026 is a patchwork: a federal AI bill that was shelved, a province with fully operational AI-relevant privacy legislation, sector-specific rules, and a direction of travel that is clear even if the timeline is not.

Bill C-27 and AIDA — the federal picture

The Digital Charter Implementation Act (Bill C-27) was introduced in June 2022. It contained three parts: the Consumer Privacy Protection Act (CPPA) to replace PIPEDA, the Personal Information and Data Protection Tribunal Act (PIDPTA), and the Artificial Intelligence and Data Act (AIDA) — Canada's first proposed federal AI-specific law. AIDA would have established requirements for high-impact AI systems including risk mitigation measures, record-keeping, impact assessments, plain-language descriptions, and prohibitions on certain AI behaviours that may cause significant harm.

Bill C-27 was shelved in early 2025 and has not been enacted. However, the Government of Canada continues to signal interest in AI regulation. Budget 2025 announced $925.6 million over five years for large-scale AI infrastructure. The direction of travel — risk-based regulation of high-impact AI systems — is established even if the specific legislation and timeline remain uncertain.

Quebec Law 25 — already in force

Quebec's Law 25 (An Act to Modernize Legislative Provisions Respecting the Protection of Personal Information) is fully in force and imposes obligations directly relevant to AI. Organisations under Quebec's jurisdiction must: notify individuals when decisions are made via automated processing; provide individuals the opportunity to present observations to a person in authority; conduct privacy impact assessments before deploying AI systems that process personal information. Penalties reach C$25 million or 4% of global revenue.

For any organisation with Quebec customers or employees using AI, Law 25 creates active compliance obligations right now — not future obligations contingent on federal legislation.

Existing federal law that applies to AI

PIPEDA (Personal Information Protection and Electronic Documents Act) applies to private sector organisations handling personal information in commercial activities across Canada (except in provinces with substantially similar legislation). It requires consent, purpose limitation, and accountability — all applicable to AI processing personal data.

The Directive on Automated Decision-Making (2019) applies to federal government departments using automated systems for administrative decisions. It requires: algorithmic impact assessment; transparency requirements scaled to impact level; human-in-the-loop for decisions with higher impact; peer review for high-impact systems.

Canadian Human Rights Act and Employment Equity Act apply to AI in employment decisions. The Air Canada chatbot case (Moffatt v Air Canada, 2024 BCCRT 149) established that organisations are liable for commitments made by their AI systems.

What companies operating in Canada should do

Comply with Quebec Law 25 if you have Quebec customers or employees. Comply with PIPEDA for personal data processing. Implement AI governance practices aligned with the AIDA framework — even though AIDA hasn't passed, building compliance now positions you ahead. Monitor the federal legislative calendar for AIDA's potential reintroduction. For government contractors, comply with the Directive on Automated Decision-Making.