NOTE-01 · Sep 2026 · 6 min read
There is no Canadian AI Act. Here's what actually applies to you.
If you're waiting on Ottawa for AI rules, you'll wait a long time. The federal AI bill is dead — but that was never the whole story. Here's every law that actually governs AI in Canada right now, and the foreign ones that follow your customers across the border.
← All insightsWhat happened to AIDA
The Artificial Intelligence and Data Act was Part 3 of Bill C-27, tabled in 2022 alongside a new federal privacy law. It would have imposed risk assessments, monitoring, and record-keeping on 'high-impact' AI systems — hiring tools, lending models, biometric systems. It never got there. When Parliament was prorogued on January 6, 2025, Bill C-27 died on the Order Paper, and the April 2025 election buried it further. The new Minister of AI and Digital Innovation, Evan Solomon, has said AIDA will not return as drafted — any future framework will be, in his words, 'light, tight, right.' In June 2026 the government released its national AI strategy, focused on adoption and growth, with no new omnibus statute attached. A narrow private member's bill on deepfakes (C-277) exists, but it is narrow by design. Bottom line: there is no federal AI law in Canada, and none is imminent.
What binds you today
Start at home. PIPEDA — the federal private-sector privacy law, written in 2000 — still governs AI that processes personal data, and the Privacy Commissioner has published principles specifically for generative AI: meaningful consent, limiting collection, and accountability for outputs. Then there's Quebec's Law 25, fully in force, which requires organizations to notify individuals when automated decisions are made about them and to conduct privacy impact assessments beforehand — the closest thing Canada has to AI-specific regulation. Add sectoral rules (financial services, health), the federal Directive on Automated Decision-Making if you sell to government, and the contracts your enterprise buyers are already pushing down: many now require EU AI Act-style documentation from vendors regardless of where you're headquartered.
The foreign laws that follow your customers
This is the part most Canadian companies miss. The EU AI Act applies to you if you place AI systems on the EU market — or in some cases if your system's output is used there — regardless of where you're incorporated. Colorado's AI Act, in force since June 2026, reaches any deployer whose AI makes consequential decisions about Colorado residents. California's AI Transparency Act, operative since August 2026, reaches generative AI providers with a million-plus Californian monthly users. You don't need an office in these places. You need users.
What to do this quarter
- 1)Inventory every AI system you build, buy, or deploy — including the ones employees adopted without asking.
- 2)Map each system to the instruments above: which jurisdiction's rules touch it?
- 3)Close the Quebec Law 25 basics: automated-decision notices and privacy impact assessments.
- 4)If you touch the EU or plan to, classify your systems under the EU AI Act now — transparency duties are already in force.
Not sure where you stand? Take the free Exposure Check — five questions, three minutes.
Check your exposureThis note is general information, not legal advice.