Skip to main content

    AI by country · North America

    AI in Canada: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Canada know before starting with AI?

    Canada has no federal AI law as of 29 October 2026. The proposed Artificial Intelligence and Data Act died with Bill C-27 in January 2025, and its replacement bill, C-36, covers privacy but not AI as a separate topic. Today PIPEDA applies to most private companies, Quebec's Law 25 adds rules on automated decisions, and Ontario now requires AI disclosure in some job postings.

    At a glance

    Canada at a glance

    Key facts about Canada
    Data protection lawPIPEDA (federal, in force); Quebec's private sector act as amended by Law 25 (in force); Bill C-36 would replace parts of PIPEDA (in Parliament)
    RegulatorOffice of the Privacy Commissioner of Canada; in Quebec, the Commission d'accès à l'information
    AI policyNational AI Strategy, AI for All (June 2026). No federal AI law as of 29 October 2026
    Time zoneSix zones. Toronto UTC-4 and Vancouver UTC-7 until 1 November 2026, then UTC-5 and UTC-8 (India is 9.5 to 13.5 hours ahead of these)
    CurrencyCAD (Canadian dollar)
    Business languageEnglish and French

    Why now

    Why Canada is worth watching

    Each point links to the document it comes from.

    • Bill C-27, which contained the Artificial Intelligence and Data Act, died when the parliamentary session ended on 6 January 2025, still in committee.[5]

    • The government launched a National AI Strategy, AI for All, on 4 June 2026.[7]

    • Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced on 15 June 2026 and would add transparency for automated decision systems, including AI.[4]

    • A federal consultation on AI transparency ran from 23 July to 23 September 2026, covering labels for AI content, telling people they are dealing with AI, and incident tracking.[7]

    • Since 1 January 2026, Ontario employers with 25 or more employees must say in public job postings if they use AI to screen, assess or select applicants.[8]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Information Protection and Electronic Documents Act (PIPEDA)

    In force2000Collecting, using or sharing personal information needs the person's knowledge and consent, with limited exceptions (Schedule 1, clause 4.3). You stay responsible for data sent to a third party for processing, such as an AI vendor, and must protect it by contract (clause 4.1.3). Breaches with a real risk of significant harm must be reported to the Commissioner and to the people affected (section 10.1).[1]

    Quebec Act respecting the protection of personal information in the private sector, as amended by Law 25 (2021, c. 25)

    In force2021A business that makes a decision based only on automated processing of personal information must tell the person, and on request explain the data used, the main factors and the right to correct it. The person can ask a staff member to review the decision (section 12.1). Before sending personal information outside Quebec, a privacy impact assessment and a written agreement are needed (section 17). Administrative penalties reach CAD 10 million or 2% of worldwide turnover, and fines reach CAD 25 million or 4%.[2]

    Bill C-36, Protecting Privacy and Consumer Data Act

    Draft2026Introduced on 15 June 2026 and at second reading in the House of Commons when we checked. It would add transparency for automated decision systems, require a risk assessment before sending personal information outside Canada, and create a new Privacy and Consumer Data Commissioner. Proposed penalties reach CAD 10 million or 3% of global revenue, and CAD 25 million or 5% for the most serious offences.[4]

    Ontario Employment Standards Act, 2000: job posting rules

    In force2026For public job postings made on or after 1 January 2026, employers with 25 or more employees must disclose if AI is used to screen, assess or select applicants, including when a recruiter does it for them. A short statement is enough.[8]

    Where AI fits first

    Where AI fits first

    Banking and insurance

    Document intake, fraud alerts and claim summaries, with staff making the final call on credit and claims.

    In Quebec, a fully automated decision about a customer triggers the notice and review rights in section 12.1 of the private sector act.[2]

    Hiring and HR

    Scheduling, interview notes and answering candidate questions, rather than automatic rejection.

    Ontario job postings must disclose AI screening since 1 January 2026. Quebec's automated decision rules can also apply to hiring.[8]

    Customer service in English and French

    Bilingual assistants for common questions, with a clear handover to a person.

    The federal AI transparency consultation asked whether people should be told when they are dealing with AI. No rule had been proposed when we checked.[7]

    Software firms using offshore development

    Building and testing AI features with an outside team.

    Under PIPEDA you remain responsible for data you hand to a processor, and Quebec requires an impact assessment and written agreement before data leaves the province.[1]

    Your first steps

    Your first steps

    1. Work out which privacy laws apply to you: PIPEDA, Quebec's act, or another provincial law. Get advice if you operate in several provinces.
    2. List every decision about a person that your AI makes without human involvement, and set up the Quebec notice, explanation and review process for them.
    3. Run a privacy impact assessment before sending personal information to an AI provider outside Quebec, and sign a written agreement.
    4. Check your contracts with AI vendors so they protect the data you send them, as PIPEDA expects.
    5. If you hire in Ontario and have 25 or more employees, add an AI disclosure line to job postings where AI screens applicants.
    6. Prepare a breach process that can report to the Privacy Commissioner and the people affected.
    7. Follow Bill C-36 through Parliament, since its automated decision and transfer rules would change your duties.

    AI services for Canada

    AI consulting and development for teams in Canada

    We work remotely with companies in Canada, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Until 1 November 2026 Toronto is on UTC-4 and India on UTC+5:30, so India is 9.5 hours ahead, and an Indian day of 9:30 to 18:30 ends at 09:00 in Toronto and 06:00 in Vancouver. There is no overlap in normal office hours for most of Canada; Halifax gets about one hour, from 09:00 to 10:00, until clocks change. We agree a short call early in your morning, which is evening in India, and send written updates each day.

    Questions

    Common questions about AI in Canada

    Does Canada have an AI law?

    No, not at federal level as of 29 October 2026. AIDA died with Bill C-27 in January 2025. The government ran an AI transparency consultation that closed on 23 September 2026 but had not tabled an AI bill when we checked.

    What replaced Bill C-27?

    Its privacy part returned as Bill C-36, introduced on 15 June 2026. It would amend PIPEDA and enact a new Protecting Privacy and Consumer Data Act. It has not passed.

    We use AI to approve applications automatically. What does Quebec require?

    Tell the person the decision was made by automated processing, at the latest when you tell them the decision. On request, explain the data and main factors used, and let them present their views to a staff member who can review it.

    Can we use an AI tool hosted in the United States or India?

    Yes, but PIPEDA keeps you responsible for the data and expects contractual protection. If the data comes from Quebec, you need a privacy impact assessment and a written agreement first.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Justice Laws Website, Government of Canada, 2026-09-30. Personal Information Protection and Electronic Documents Act (S.C. 2000…(laws-lois.justice.gc.ca)
      Full title and what we used it for

      Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), full text. Primary, current to 30 September 2026. Used for section 10.1, section 28 and Schedule 1 clauses 4.1.3 and 4.3.

    2. [2] Publications du Québec, 2021-09-22. Loi modernisant des dispositions législatives en matière de protection…(publicationsduquebec.gouv.qc.ca)
      Full title and what we used it for

      Loi modernisant des dispositions législatives en matière de protection des renseignements personnels (2021, chapitre 25). Primary, French text read in full and summarised in English. Used for sections 3.5, 12.1, 17, 90.12 and 91 of the private sector act as amended, and the coming-into-force dates (most provisions 22 September 2023). The consolidated act on LégisQuébec could not be opened.

    3. [3] Government of Canada (Innovation, Science and Economic Development Canada), 2026-06-15. Government of Canada tables new legislation to protect children's data,…(canada.ca)
      Full title and what we used it for

      Government of Canada tables new legislation to protect children's data, strengthen privacy and build trust in the digital economy. Primary news release. Used for the introduction of Bill C-36.

    4. [4] Government of Canada (Innovation, Science and Economic Development Canada), 2026-06-15. Backgrounder: Government of Canada introduces legislation to protect Ca…(canada.ca)
      Full title and what we used it for

      Backgrounder: Government of Canada introduces legislation to protect Canadians' privacy in the digital age. Primary. Used for the automated decision transparency measure, transfer assessments, the new Commissioner and proposed penalties. Bill stage checked on LEGISinfo (parl.ca, Bill C-36, 45th Parliament, 1st session): at second reading in the House of Commons.

    5. [5] Parliament of Canada, LEGISinfo, 2025-01-06. C-27 (44-1): Digital Charter Implementation Act, 2022(parl.ca)
      Full title and what we used it for

      C-27 (44-1): Digital Charter Implementation Act, 2022. Primary. Used for the last stage reached (committee) and the end of the session on 6 January 2025.

    6. [6] Parliament of Canada, LEGISinfo, 2026-10-29. C-36 (45-1): An Act to enact the Protecting Privacy and Consumer Data A…(parl.ca)
      Full title and what we used it for

      C-36 (45-1): An Act to enact the Protecting Privacy and Consumer Data Act. Primary, checked on this date. Used for the sponsor, introduction on 15 June 2026 and current stage.

    7. [7] Government of Canada (Innovation, Science and Economic Development Canada), 2026-07-23. Government of Canada launches public consultation on AI transparency(canada.ca)
      Full title and what we used it for

      Government of Canada launches public consultation on AI transparency. Primary. Used for the consultation topics, the closing date of 23 September 2026 and the launch of the AI for All strategy on 4 June 2026.

    8. [8] Government of Ontario, 2026-10-29. Your guide to the Employment Standards Act: Requirements related to pub…(ontario.ca)
      Full title and what we used it for

      Your guide to the Employment Standards Act: Requirements related to publicly advertised job postings. Primary government guide, checked on this date. Used for the AI disclosure rule, the 1 January 2026 start and the 25-employee threshold.

    This is general information, not legal advice. Federal and provincial rules are changing, Bill C-36 may be amended, and other provinces such as Alberta and British Columbia have their own privacy laws that we did not review. Check with a qualified Canadian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Canada?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score