The short answer
There is no AI-specific federal law in force in Canada today. The Artificial Intelligence and Data Act, part of Bill C-27, died when Parliament was prorogued in January 2025, and the national AI strategy launched in June 2026 does not propose a standalone AI law.
But AI is not a legal blank space. If an AI tool uses personal information, PIPEDA and provincial privacy laws apply. Quebec requires organizations to tell people when a decision about them is made exclusively by automated processing. Ontario requires many employers to disclose AI screening in job postings. And federal privacy reform with rules for automated decision systems has been introduced. The practical response is the same in every case: know where you use AI, protect the personal information it touches, keep people accountable for decisions and be able to explain what you did.
This article is general information, not legal advice. Your legal and privacy advisers should confirm how the rules apply to you.
What already applies to AI
Federal privacy law (PIPEDA)
PIPEDA governs how private-sector organizations collect, use and disclose personal information in the course of commercial activity, and it does not exempt AI. Consent, limiting collection to what is needed, accuracy, safeguards, openness and accountability all apply when personal information is used to train, prompt or run an AI system, including when that information is pasted into a third-party AI service.
In December 2023, the federal, provincial and territorial privacy commissioners published principles for responsible, trustworthy and privacy-protective generative AI. They are guidance rather than law, but they show how regulators read existing obligations: legal authority and consent, appropriate purposes, necessity and proportionality, openness, accountability, individual access, limits on collection and use, accuracy and safeguards. In May 2026, the commissioners also published findings from a joint investigation into OpenAI's ChatGPT, a reminder that they apply privacy law to AI developers.
Quebec's Law 25 and automated decisions
Since September 22, 2023, an enterprise that uses personal information to make a decision based exclusively on automated processing must tell the person no later than when it informs them of the decision. On request, it must also explain the personal information used, the reasons and the principal factors and parameters behind the decision, and the person's right to have the information corrected, and let them submit observations to a staff member who can review the decision. Quebec law also requires a privacy impact assessment for projects to acquire, develop or overhaul an information system that involves personal information, which can include AI projects.
Ontario job postings
Since January 1, 2026, Ontario employers with 25 or more employees that use AI to screen, assess or select applicants must say so in publicly advertised job postings. If your applicant tracking system ranks or filters candidates with AI, check whether this applies.
Sector and public-sector expectations
Federally regulated financial institutions, health organizations and public bodies have further expectations from their regulators and policies. Federal institutions follow the Treasury Board Directive on Automated Decision-Making, which also matters to vendors building systems for them.
What is coming
- Federal privacy reform. Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced in June 2026. As introduced, it would replace the privacy part of PIPEDA and require organizations to explain automated decision systems that could significantly affect people. It is before Parliament and not law; its details may change.
- National AI strategy. Canada's strategy, AI for All, launched in June 2026, focuses on adoption, privacy modernization, online safety and AI safety research rather than a new AI statute.
Rather talk it through? If you are not sure which of these rules touch your AI tools, we can map your AI use against them in a short review. Talk to a Promatics specialist
What to do now
You do not need to wait for new legislation. These steps reduce risk under today's rules and prepare you for what comes next:
- List the AI tools and features in use, including ones staff use without approval (shadow AI).
- For each, record what information goes in, where it is processed and whether the vendor uses it for training.
- Stop personal and confidential information from going into tools without suitable business terms.
- For information too sensitive for any outside AI provider, consider models hosted on servers you control, in a Canadian region.
- Identify any decisions about people (hiring, credit, eligibility, discipline) where AI plays a part, and keep a person accountable for each.
- If you operate in Quebec, check whether any decision is made exclusively by automated processing and prepare the required notice and explanation.
- If you hire in Ontario, check whether your recruiting tools use AI to screen or rank applicants.
- Run a privacy impact assessment for new AI projects that use personal information.
- Publish an AI acceptable use policy and train staff on it.
- Keep records: approvals, assessments and changes, so you can show what you did and why.
When to bring in help
A small organization using a few mainstream AI tools can often handle the basics with a clear policy and sensible settings. It is worth bringing in help when AI touches decisions about people, when you operate in several provinces, when clients or insurers ask for evidence of AI controls, or when you are building AI into your own products and services.
Our AI governance and security service inventories your AI use, sets proportionate rules, applies technical controls and documents it all in plain language, aligned with recognized frameworks such as the NIST AI Risk Management Framework. We work alongside your legal and privacy advisers, who remain responsible for legal interpretation. If you are just getting started, an AI readiness assessment covers governance as part of a broader plan.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada
- Act respecting the protection of personal information in the private sector (P-39.1), section 12.1, LégisQuébec
- Employment Standards Act, 2000, section 8.4, Government of Ontario (e-Laws)
- C-36, Protecting Privacy and Consumer Data Act, Parliament of Canada (LEGISinfo)
- Canada's National Artificial Intelligence Strategy: AI for All, Innovation, Science and Economic Development Canada
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.