Ontario has one AI statute, the Enhancing Digital Security and Trust Act, 2024, enacted as Schedule 1 of Bill 194 on November 25, 2024. Sections 1 to 16 of the Act have been in force since January 29, 2025, but its AI duties reach only the public sector entities that a regulation names, and no such AI regulation was identified in official sources as of October 31, 2026. The binding AI rule that does reach private employers is the requirement, effective January 1, 2026, to disclose AI screening in public job postings. The joint principles of the Information and Privacy Commissioner and the Ontario Human Rights Commission, published January 21, 2026, are voluntary.
Key takeaways
- Bill 194 received Royal Assent on November 25, 2024 (S.O. 2024, c. 24); its AI sections apply only to public sector entities and only once a regulation prescribes them.
- Two regulations under the Act took effect on July 1, 2026, covering cyber security and children's digital information; neither sets AI rules.
- Employers with 25 or more employees must disclose in a public job posting that AI is used to screen, assess, or select applicants, for postings made on or after January 1, 2026.
- The IPC and OHRC principles name six qualities for AI systems and are not binding; the ministry directive for ministries and provincial agencies is a separate, mandatory instrument.
Bill 194 and the Act it created
Bill 194, titled the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, had first reading on May 13, 2024, second reading on October 29, 2024, and third reading and Royal Assent on November 25, 2024. Schedule 1 enacts the Enhancing Digital Security and Trust Act, 2024, and Schedule 2 amends the Freedom of Information and Protection of Privacy Act. The Act covers institutions under the provincial and municipal freedom of information statutes (other than the Legislative Assembly), children's aid societies, and school boards. It defines an AI system as a machine-based system that infers from its input how to generate outputs such as predictions, content, recommendations, or decisions, and it counts publicly available, procured, and third-party systems alike. Private businesses are outside its scope. A summary of the Act is on the Ontario government's Act page.
What the AI sections require, and when
Section 5 allows regulations to require prescribed entities to inform the public about AI use, build an accountability framework, manage risk, follow prescribed requirements, and refrain from prohibited uses. Section 6 allows regulations to require disclosure and oversight by an individual in prescribed circumstances. Section 7 gives the Lieutenant Governor in Council the regulation power and section 8 lets the Minister set technical standards. Each duty switches on only when a regulation prescribes the entities and circumstances. Section 12 states that the Act creates no private law duty of care, and the Act's table of contents lists no offence or penalty provisions. Order in Council 361/2025, approved January 28, 2025, brought Schedule 1, sections 1 to 16 into force on January 29, 2025, and brought the Schedule 2 privacy amendments into force on January 29 and July 1, 2025. Pages on the e-Laws database could not be retrieved in this review, so these dates rest on the Order in Council and the government's Act page.
Regulations that exist as of October 31, 2026
The government's Act page, last updated October 22, 2026, lists two regulations under the Act, both taking effect July 1, 2026. O. Reg. 51/26 sets cyber security requirements for hospitals, colleges and universities, school boards, and children's aid societies: named security contacts, a maturity assessment every two years, and reporting of critical incidents within 72 hours of confirmation. O. Reg. 52/26 requires school boards to give plain-language notice when a student's personal digital information is shared with a third-party software application. Neither regulation sets AI rules. Ontario's AI overview page, updated July 14, 2026, says the province is still consulting on whether to set requirements for the broader public sector. No regulation under sections 5 to 8 was found, which means that, on the sources reviewed, the AI duties have not been applied to any entity.
The ministry directive
A different instrument already operates inside government. The Responsible Use of Artificial Intelligence Directive, issued under the Management Board of Cabinet Act, took effect December 1, 2024 for all ministries and provincial agencies. It requires a risk process before AI is used, an annual report of AI use cases and risks, a published list of use cases, and public disclosure where people interact with AI or AI affects decisions about them. Its page was last updated January 7, 2026. According to the government's AI overview page, it applies to the Ontario Public Service and provincial agencies and not to the broader public sector.
The IPC and OHRC joint principles
The Information and Privacy Commissioner of Ontario and the Ontario Human Rights Commission released their Principles for the Responsible Use of Artificial Intelligence on January 21, 2026. The six principles are valid and reliable, safe, privacy protective, human rights affirming, transparent, and accountable. They are aimed at public and broader public sector institutions that develop, provide, or use AI, run across the system lifecycle, and use the Act's definition of an AI system. Institutions are strongly encouraged to adopt them; they are not binding. The principles expect human oversight, risk and impact assessments, complaint channels, whistleblower protection, and review by an independent body with enforcement authority. The Commission's principles page carries the full document, and a letter to the head of the Ontario Public Service describes the principles as complementary to the ministry directive.
AI disclosure in job postings
The Working for Workers Four Act, 2024 (S.O. 2024, c. 3, Royal Assent March 21, 2024) added job posting rules to the Employment Standards Act, 2000, including a statement disclosing the use of AI to screen, assess, or select applicants. Order in Council 1546/2024 set January 1, 2026 as the start date, and O. Reg. 476/24 supplies details. The Ministry of Labour guide says the rules apply to external postings for a specific position advertised to the general public, by employers with 25 or more employees on the day of posting. A short statement is enough, and it is required even if a third party does the screening. Enforcement options include compliance orders, notices of contravention with monetary penalties, and prosecution, with corporate fines of up to CAD 100,000 for a first conviction.
Measures compared
| Measure | Binding or voluntary | Applies to whom | In force |
|---|---|---|---|
| Enhancing Digital Security and Trust Act, 2024, AI sections 5 to 8 | Binding statute, but duties arise only when a regulation prescribes entities | Provincial and municipal institutions, children's aid societies, school boards | Sections 1 to 16 since January 29, 2025; no AI regulation identified |
| O. Reg. 51/26 and O. Reg. 52/26 under the Act | Binding | Hospitals, colleges and universities, school boards, children's aid societies (cyber security); school boards (student data notice) | July 1, 2026; not AI-specific |
| Responsible Use of Artificial Intelligence Directive | Mandatory directive for government | Ministries and provincial agencies | December 1, 2024 |
| IPC and OHRC Principles for the Responsible Use of Artificial Intelligence | Voluntary | Public and broader public sector institutions using AI | Published January 21, 2026 |
| AI disclosure in publicly advertised job postings (Employment Standards Act, 2000) | Binding | Employers with 25 or more employees posting publicly | January 1, 2026 |
Criticism of the framework
Two original documents record objections to the Bill as introduced. The Law Commission of Ontario released a submission on June 25, 2024 with 11 recommendations on human rights, fair decision-making, transparency, accountability, risk management, and prohibited uses. At the Standing Committee on Justice Policy on November 14, 2024, Commissioner Patricia Kosseim asked for an independent oversight role for her office, for the core principles of valid, reliable, safe, privacy protective, transparent, accountable, and rights-affirming AI to be written into the statute, and for prohibited uses to be listed there. The text of Schedule 1 as passed leaves principles and prohibitions to future regulations and does not mention the Commissioner. Existing privacy and human rights law continues to apply to AI use in the meantime. This article is general information, not legal advice.
FAQ
Does Ontario have a law regulating AI?
Yes, but narrowly. The Enhancing Digital Security and Trust Act, 2024 sets a framework for public sector AI use. Its AI duties apply only once regulations prescribe entities, and none were identified as of October 31, 2026.
Does Bill 194 apply to private businesses?
No. It covers provincial and municipal institutions, children's aid societies, and school boards.
Must Ontario employers disclose AI use in job ads?
Yes, if the employer has 25 or more employees on the day of a public posting for a specific position and uses AI to screen, assess, or select applicants. The rule applies to postings made on or after January 1, 2026.
Are the IPC and OHRC principles mandatory?
No. Institutions are strongly encouraged to adopt them, and they carry no penalty of their own.
Which regulations exist under the Act?
Two, O. Reg. 51/26 on cyber security and O. Reg. 52/26 on digital technology affecting individuals under 18, both effective July 1, 2026. Neither addresses AI use.
Related reading
- AI rules across the provinces
- Canada's overall approach to AI regulation
- Quebec's rules on automated decisions
- AI in hiring and human resources
More in AI Law in Canada.
Last verified: October 2026
Sources
- Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, Royal Assent version, Legislative Assembly of Ontario, 2024
- Order in Council 361/2025, Government of Ontario, January 28, 2025
- Enhancing Digital Security and Trust Act, Government of Ontario, updated October 22, 2026
- Artificial Intelligence (AI) in Ontario, Government of Ontario, updated July 14, 2026
- Responsible Use of Artificial Intelligence Directive, Government of Ontario, updated January 7, 2026
- Principles for the Responsible Use of Artificial Intelligence, Ontario Human Rights Commission and Information and Privacy Commissioner of Ontario, January 2026
- IPC-OHRC Principles and the OPS AI Directive, letter, Ontario Human Rights Commission, 2026
- Bill 149, Working for Workers Four Act, 2024, Legislative Assembly of Ontario, 2024
- Order in Council 1546/2024, Government of Ontario, December 2024
- Requirements related to publicly advertised job postings, Your Guide to the Employment Standards Act, Ministry of Labour, Immigration, Training and Skills Development, 2026
- Standing Committee on Justice Policy, transcript JP054, Legislative Assembly of Ontario, November 14, 2024
- LCO Releases Bill 194 Submission, Law Commission of Ontario, June 25, 2024