Artificial Intelligence Law in Canada

Introduction

Artificial intelligence (AI) law in Canada is an emerging and rapidly evolving field that sits at the intersection of privacy, human rights, competition, and administrative law. Canada has positioned itself as a global leader in AI research — home to the Vector Institute, the Mila – Quebec AI Institute, and the Alberta Machine Intelligence Institute (Amii) — yet its legislative response to AI governance remains a work in progress. The centrepiece of federal AI regulation is the proposed Artificial Intelligence and Data Act (AIDA), introduced as Part 3 of Bill C-27 in 2022 and still undergoing parliamentary scrutiny. This article examines the current and proposed legal framework governing AI in Canada, including federal legislation, provincial initiatives, and sectoral regulation.

The Artificial Intelligence and Data Act (AIDA)

The Artificial Intelligence and Data Act (AIDA), if enacted in its current form, would establish the first horizontal regulatory regime for AI in Canada. AIDA applies to persons responsible for high-impact AI systems in the course of international or interprovincial trade and commerce. The Act imposes obligations on both designers (those who develop or manage the development of an AI system) and deployers (those who make a high-impact system available for use).

Key obligations under AIDA include:

• Assessment and mitigation of harm and bias: Designers and deployers must identify, assess, and mitigate the risks of harm and biased output from high-impact systems.
• Transparency and documentation: Maintain records describing the system, its intended purposes, the data used, and the measures taken to mitigate risks.
• Anonymisation requirements: Use de-identified or anonymised data where feasible.
• Notification obligations: Report material risks of harm or biased output to the Minister of Innovation, Science and Industry.

AIDA contemplates the creation of an AI and Data Commissioner with significant enforcement powers, including the ability to order compliance, impose administrative monetary penalties of up to 3% of gross global revenue or C$10 million (whichever is greater), and recommend criminal prosecutions for certain offences such as knowingly placing a high-impact system on the market that causes serious harm.

The definition of high-impact AI system is central to AIDA’s operation. The Act provides an initial list of criteria — including systems that affect health, safety, fundamental rights, or the economic interests of individuals — and empowers the Governor in Council to make regulations designating specific systems as high-impact. As of 2026, the accompanying regulations have not yet been finalised, creating ongoing uncertainty about the scope of AIDA’s application.

AIDA and the EU AI Act: A Comparative Perspective

AIDA draws inspiration from the European Union’s AI Act (Regulation (EU) 2024/1689), which adopts a risk-based approach categorising AI systems into prohibited, high-risk, transparency-risk, and minimal-risk tiers. However, there are significant differences. The EU AI Act creates exhaustive lists of high-risk use cases (e.g., critical infrastructure, education, employment, law enforcement) and imposes extensive conformity assessment procedures, including independent third-party auditing. AIDA, by contrast, offers greater regulatory flexibility by empowering the Minister to designate high-impact systems through regulation. AIDA also lacks the EU’s prohibition on specific uses of AI (e.g., social scoring systems and real-time biometric surveillance in public spaces), although certain such uses may be regulated indirectly through Canadian human rights and privacy legislation.

PIPEDA Reform and AI

Canadian privacy law interacts closely with AI regulation. The Personal Information Protection and Electronic Documents Act (PIPEDA), SC 2000, c 5, is the federal private-sector privacy statute. Bill C-27 also proposes the Consumer Privacy Protection Act (CPPA), which would replace PIPEDA’s Part 1. The CPPA would introduce new provisions relevant to AI, including:

• De-identified information: A framework for the use of de-identified information, which would not require individual consent.
• Automated decision-making: A right to an explanation of how automated decisions were made — a provision with particular resonance for AI systems that render decisions affecting individuals.
• Data mobility and portability: Rights that may facilitate competition in AI-relevant data markets.

Provincial privacy laws that have been declared substantially similar to PIPEDA (in Quebec, British Columbia, and Alberta) continue to apply. Quebec’s Law 25 (formerly Bill 64), which came into force in stages between 2022 and 2024, includes specific provisions regarding automated decision-making and the right to be informed when a decision is based exclusively on automated processing.

The Directive on Automated Decision-Making

At the federal government level, the Directive on Automated Decision-Making (published by the Treasury Board Secretariat in 2019 and updated in 2023) governs the use of AI and automated systems by federal departments and agencies. The Directive applies to any system that uses automated decision-making — defined as a process where decisions are recommended or made by technological means — and classifies systems into four impact levels (I through IV) based on the severity of potential harms.

Requirements under the Directive include:

• Algorithmic impact assessment (AIA) before deployment.
• Peer review of the system’s design and data.
• Explainability and meaningful human review for decisions at higher impact levels.
• Reporting and transparency obligations, including public disclosure of the AIA.

The Directive reflects the federal government’s commitment to responsible AI and has influenced similar initiatives in provinces such as Ontario and Quebec.

The Pan-Canadian AI Strategy and Governance

Canada launched the Pan-Canadian Artificial Intelligence Strategy in 2017, allocating C$125 million (renewed with additional funding in 2022 and 2024) to support AI research, talent development, and commercialisation. The Strategy funds the three national AI institutes — Amii, Mila, and the Vector Institute — and supports the establishment of AI research chairs at universities across the country.

The Advisory Council on AI, established by the federal government, provides policy advice on AI governance, innovation, and public trust. The Council has published reports addressing AI and intellectual property, AI in the public sector, and the economic implications of AI adoption.

At the international level, Canada is a participant in the Global Partnership on Artificial Intelligence (GPAI), hosted at the OECD. Canada has also endorsed the OECD AI Principles, which promote AI that is inclusive, transparent, and accountable.

Sectoral Regulation of AI

Beyond general-purpose legislation, several sectoral regulators in Canada have begun addressing AI within their existing mandates:

• Financial services: The Office of the Superintendent of Financial Institutions (OSFI) has issued guidance on the use of AI and machine learning in financial services, focussing on model risk management, fair lending, and compliance with the Bank Act. The Financial Consumer Agency of Canada (FCAC) has issued guidance on the use of AI in consumer lending and underwriting.
• Health care: Health Canada regulates AI-enabled medical devices as Software as a Medical Device (SaMD), applying the Medical Devices Regulations (SOR/98-282). The Canadian Agency for Drugs and Technologies in Health (CADTH) has published health technology assessments of AI tools in clinical settings.
• Competition: The Competition Bureau has examined the implications of AI for pricing algorithms, collusion, and deceptive marketing, and has issued guidance on the application of the Competition Act to algorithmic conduct.
• Human rights: The Canadian Human Rights Commission and provincial human rights tribunals have begun to address algorithmic discrimination. The Canadian Human Rights Act, RSC 1985, c H-6, prohibits discrimination in service provision and employment, which applies to AI systems that produce discriminatory outcomes.

Privacy, Data, and AI

A central challenge in Canadian AI law is the legal framework for training data. The use of publicly available data to train AI systems raises questions about consent, lawful access, and copyright infringement. In 2023, the Copyright Act was not amended to address text and data mining (TDM), although the federal government has consulted on the issue. Canadian courts have yet to rule definitively on whether TDM for AI training purposes constitutes fair dealing under s. 29 of the Copyright Act, or whether scraping of publicly available personal information violates PIPEDA.

The Office of the Privacy Commissioner of Canada (OPC) has taken an active role, issuing guidance on AI and privacy, including the position that the use of personal information to train AI models generally requires meaningful consent unless a valid exception applies. The OPC has initiated investigations into major AI platforms and has emphasised that privacy by design must be integrated into AI development from the outset.

Conclusion

Canadian AI law is in a state of construction. AIDA promises a horizontal regulatory regime for high-impact systems, but its ultimate contours remain uncertain pending regulations and enactment. Meanwhile, existing privacy, human rights, and sectoral frameworks continue to apply, creating a complex patchwork of obligations. Canada’s approach — combining research investment with flexible, principle-based regulation — reflects a deliberate effort to balance innovation and public protection. As AI capabilities accelerate, the demand for a coherent, rights-protective legal framework will only intensify.