As of October 31, 2026, no Canadian province has a general AI statute in force. The AI-specific rules found in official sources are narrow: Quebec's notice duty for fully automated decisions, Alberta's notice at collection when a public body intends to put personal information into an automated system, Ontario's AI disclosure rule for publicly advertised jobs, and Manitoba's algorithmic pricing amendment, in force since July 1, 2026. Manitoba's public sector AI act was passed on June 1, 2026 but is not yet in force.
Key takeaways
- Quebec's privacy statutes require notice, an explanation on request, and a chance for human review when a decision rests exclusively on automated processing.
- Alberta's Protection of Privacy Act, in force since June 11, 2025, requires public bodies to disclose at collection any intention to use an automated system.
- Manitoba's Public Sector Artificial Intelligence and Cybersecurity Governance Act is not in force, and its duties apply only if regulations require them.
- British Columbia's two privacy statutes contain no automated decision duty in the text current to October 27, 2026, and the Commissioner has issued guidance instead.
- No AI-specific statute was found for Saskatchewan, Nova Scotia, New Brunswick, Newfoundland and Labrador, Prince Edward Island, or the territories.
What the review covered
The table lists statutes and regulator guidance that mention AI or automated decision systems, or that apply to AI use in a specific way. Where an official consolidation could be loaded, its text was searched for the terms artificial intelligence, automated decision, automated system, and algorithm. That search covered Alberta, British Columbia, Manitoba, Saskatchewan, Prince Edward Island, and Newfoundland and Labrador. The consolidated statutes for New Brunswick and Nova Scotia could not be loaded, so those rows rest on searches of government and commissioner pages. Federal law still applies in every province, as the PIPEDA and AI page explains. Wording such as "no AI-specific statute found" reports the result of these searches. It does not prove that no relevant rule exists. Court decisions, municipal bylaws, and professional regulator rules were not reviewed.
Province-by-province table
Each row names the main privacy or public sector law, the automated decision or AI provisions found, the regulator or government guidance, and the status on October 31, 2026.
| Province | Main privacy or public-sector law | Automated decision or AI provisions | Guidance | Status |
|---|---|---|---|---|
| Quebec | Act respecting the protection of personal information in the private sector; Act respecting access to documents held by public bodies and the protection of personal information | Private sector s. 12.1 and public bodies s. 65.2: notice no later than the time the decision is communicated when it rests exclusively on automated processing; on request, the information used, the reasons and main factors, and the right to correct it; a chance to submit observations to a staff member able to review the decision | Commission d'accès à l'information guidance; an impact assessment is recommended before deploying an algorithm-based decision system | In force. See Quebec Law 25 and automated decisions |
| Ontario | Freedom of Information and Protection of Privacy Act; Municipal Freedom of Information and Protection of Privacy Act; Employment Standards Act, 2000; Enhancing Digital Security and Trust Act, 2024 | Employers with 25 or more employees must disclose the use, if any, of AI to screen, assess, or select applicants in publicly advertised postings made on or after January 1, 2026. Public sector AI duties under the 2024 act apply only if prescribed by regulation, and an AI-specific regulation was not found in this review | Joint principles for the responsible use of AI from the Information and Privacy Commissioner and the Human Rights Commission, January 2026 | Job posting rule in force. See Ontario AI rules |
| Alberta | Protection of Privacy Act (public bodies); Access to Information Act; Personal Information Protection Act (private sector) | Protection of Privacy Act s. 5(2)(d): collection notice must state any intention to input the information into an automated system to generate content or make decisions, recommendations, or predictions. Section 6: accuracy efforts and retention for at least one year when information is used for a decision that directly affects a person, including a decision made using an automated system | Information and Privacy Commissioner report on responsible AI governance, July 15, 2025, recommending a standalone AI law | Act in force June 11, 2025. No AI-specific statute found in official sources as of October 31, 2026 |
| British Columbia | Freedom of Information and Protection of Privacy Act; Personal Information Protection Act | No automated decision or AI duty in either text, current to October 27, 2026. The only reference found lets the Commissioner comment on the implications of automated systems (FIPPA s. 42(1)(g), PIPA s. 36(1)(g)) | Commissioner guidance on AI scribes for healthcare organizations, January 28, 2026; joint generative AI principles, December 7, 2023; Ministry of Education and Child Care K-12 resources | No AI-specific statute found in official sources as of October 31, 2026 |
| Manitoba | The Freedom of Information and Protection of Privacy Act; The Business Practices Act | Public Sector Artificial Intelligence and Cybersecurity Governance Act (S.M. 2026, c. 43): where regulations require, prescribed public sector entities publish information about AI use, adopt an accountability framework, and manage risks (s. 4), with human oversight in prescribed circumstances (s. 5). Business Practices Amendment Act (S.M. 2026, c. 41): personalized algorithmic pricing used to raise an online retailer's or distributor's price is an unfair business practice | None found | Governance act assented June 1, 2026, not yet in force. Pricing amendments in force July 1, 2026 |
| Saskatchewan | The Freedom of Information and Protection of Privacy Act; The Local Authority Freedom of Information and Protection of Privacy Act; The Health Information Protection Act | No AI or automated decision term in the first two consolidations | Government of Saskatchewan directs employees to review its guidelines on the use of AI before using online AI tools | No AI-specific statute found in official sources as of October 31, 2026 |
| Nova Scotia | Freedom of Information and Protection of Privacy Act; replacement act with a stated effective date of April 1, 2027 | None found. The government's description of the replacement act does not mention AI or automated decisions | Information and Privacy Commissioner shared the December 2023 generative AI principles | No AI-specific statute found in official sources as of October 31, 2026 |
| New Brunswick | Right to Information and Protection of Privacy Act; Personal Health Information Privacy and Access Act | None found; the consolidated text could not be searched | Signatory to the December 2023 generative AI principles | No AI-specific statute found in official sources as of October 31, 2026 |
| Newfoundland and Labrador | Access to Information and Protection of Privacy Act, 2015 (ATIPPA, 2015) | No AI term in the Act. The Commissioner's October 9, 2026 review submission asks for an AI definition, algorithmic assessments before AI programs start, and a registry of AI impact assessments | Chief Information Officer policy Responsible Use of Artificial Intelligence Technology, April 17, 2025, for government departments | Policy in force; statutory review in progress |
| Prince Edward Island | Freedom of Information and Protection of Privacy Act | No AI term in the consolidation current to May 29, 2026 | Signatory to the December 2023 generative AI principles | No AI-specific statute found in official sources as of October 31, 2026 |
| Yukon, Northwest Territories, Nunavut | Territorial access and privacy statutes; PIPEDA for private-sector organizations | None found. Nunavut's Commissioner wrote in the 2023-24 annual report that the territory's information law has not kept pace with artificial intelligence | Territorial commissioners signed the December 2023 generative AI principles | No AI-specific statute found in official sources as of October 31, 2026 |
Quebec and Ontario in brief
Quebec is the main reference point for automated decision rules in Canada. Its private-sector and public-sector privacy statutes require notice, an explanation on request, and human review when a decision rests exclusively on automated processing. The Commission d'accès à l'information says administrative monetary penalties on businesses can reach CAD 10 million or two percent of worldwide revenue. Details sit on the page about Quebec Law 25 and automated decisions. Ontario has two live items: the job posting disclosure, and a public sector framework in the Enhancing Digital Security and Trust Act, 2024 that depends on regulations. The Ontario AI rules page covers both, along with the joint principles from the Information and Privacy Commissioner and the Human Rights Commission.
Alberta: automated systems in a public sector privacy act
Alberta's Protection of Privacy Act came into force on June 11, 2025, according to the Government of Alberta. Two provisions in the King's Printer consolidation of the Protection of Privacy Act, current as of December 11, 2025, refer to automated systems. Section 5(2)(d) adds to the collection notice a statement of any intention to input the information into an automated system to generate content or make decisions, recommendations, or predictions. Section 6 requires reasonable efforts to keep personal information accurate and complete, and retention for at least one year, when it is used for a decision that directly affects a person, including a decision made using an automated system. Neither provision grants a right to human review. The Personal Information Protection Act, which covers most private-sector organizations, has no AI term in the consolidation reviewed (current as of September 1, 2025). The Information and Privacy Commissioner's July 15, 2025 report recommends a standalone AI law, and media reports that the government is drafting one could not be confirmed in official sources.
British Columbia: guidance and investigations instead of a statute
The consolidations of British Columbia's Freedom of Information and Protection of Privacy Act and Personal Information Protection Act, both current to October 27, 2026, contain no automated decision duty. The one related reference is a power for the Commissioner to comment on the implications of automated systems. Regulatory activity has come through guidance and investigations. On May 6, 2026, the Commissioner published the results of a joint investigation, with the federal, Quebec, and Alberta regulators, into the development of ChatGPT. In British Columbia, the office found that scraping personal information from the internet without individuals' knowledge or consent continues to fall short of the consent requirement in the Personal Information Protection Act. The Commissioner also issued guidance on AI scribes for healthcare organizations on January 28, 2026. For schools, the Ministry of Education and Child Care publishes Considerations for Using AI Tools in K-12 Schools (page last updated July 18, 2024). The classroom side is covered in the article on AI in education rules.
Manitoba: two 2026 statutes with different status
Manitoba's Business Practices Amendment Act (S.M. 2026, c. 41) was assented to on June 1, 2026 and took effect on July 1, 2026, according to the legislative history in the official consolidation. The Business Practices Act now defines personalized algorithmic pricing as pricing that uses an algorithm or automated processing to set, recommend, or vary a price for a specific consumer based on data about that consumer. The Act also states that an unfair business practice can occur through algorithms, data analytics, machine learning, or artificial intelligence. The Public Sector Artificial Intelligence and Cybersecurity Governance Act (S.M. 2026, c. 43) applies to prescribed public sector entities. The Manitoba Laws index on October 31, 2026 says it is not yet in force and will begin on proclamation. Its AI duties apply only if regulations require them, and no penalty provision was found. One secondary report describes the act differently, so the official index was relied on.
Saskatchewan, the Atlantic provinces, and the territories
Saskatchewan's two main access and privacy consolidations contain no AI or automated decision term, and the government instead directs its employees to review its guidelines before using online AI tools. Prince Edward Island's act, current to May 29, 2026, contains none either. Newfoundland and Labrador has the most policy activity in this group. Its government policy took effect on April 17, 2025, and the Commissioner's October 9, 2026 submission to the statutory review recommends a statutory AI definition and algorithmic assessments before public bodies start AI programs. Nova Scotia's replacement act has a stated effective date of April 1, 2027, and the government's description does not mention AI. For New Brunswick and the territories, no AI-specific statute was found. Private-sector organizations in the three territories are treated as federally regulated for PIPEDA purposes.
This article is general information, not legal advice. Statutes, regulations, and policies named here can change, and anyone with a specific compliance question should consult a qualified lawyer or the text of the law.
FAQ
Does any Canadian province have a general AI law in force?
No AI-specific statute was found in official sources as of October 31, 2026. The closest is Manitoba's Public Sector Artificial Intelligence and Cybersecurity Governance Act, which was passed on June 1, 2026 but is not yet in force and depends on regulations for its duties.
Which provinces require people to be told about automated decisions?
Quebec requires notice when a decision rests exclusively on automated processing, in both the private and public sectors. Alberta requires public bodies to state, when they collect personal information, any intention to input it into an automated system. Ontario requires employers with 25 or more employees to disclose AI use in publicly advertised job postings.
Does PIPEDA still apply in provinces that have their own private-sector privacy law?
Alberta, British Columbia, and Quebec have private-sector laws deemed substantially similar to PIPEDA, so organizations covered by them are generally exempt from PIPEDA for information handled within the province. PIPEDA continues to apply to cross-border transfers, federal works and businesses, and organizations in the territories.
Do provincial AI rules apply to schools and school boards?
Public sector privacy statutes apply to public bodies, and Ontario's 2024 digital trust act lists school boards among covered entities, with AI duties applying only where regulations prescribe them. Manitoba's act covers entities prescribed by regulation, and no regulation has been found. British Columbia relies on ministry resources rather than a statute.
Related reading
- Canada's overall AI regulation status
- How PIPEDA applies to AI tools
- A compliance checklist for small organizations
- Which regulators oversee AI in Canada
More in AI Law in Canada.
Last verified: October 2026
Sources
- Protection of Privacy Act, Statutes of Alberta 2024, c. P-28.5, office consolidation current as of December 11, 2025, Alberta King's Printer
- About the Protection of Privacy Act, Government of Alberta, 2025
- Personal Information Protection Act, office consolidation current as of September 1, 2025, Alberta King's Printer
- Comments from the OIPC regarding responsible AI governance in Alberta, Office of the Information and Privacy Commissioner of Alberta, July 15, 2025
- Freedom of Information and Protection of Privacy Act (RSBC 1996, c. 165), current to October 27, 2026, BC Laws, King's Printer British Columbia
- Personal Information Protection Act (SBC 2003, c. 63), current to October 27, 2026, BC Laws, King's Printer British Columbia
- News release on the joint investigation into ChatGPT, May 6, 2026, Office of the Information and Privacy Commissioner for British Columbia
- PIPA and AI scribes: best practices for healthcare organizations in BC, Office of the Information and Privacy Commissioner for British Columbia, 2026
- Digital literacy and the use of AI in education: supports for British Columbia schools, Ministry of Education and Child Care, 2024
- The Business Practices Act, C.C.S.M. c. B120, consolidation current from July 1, 2026 to October 28, 2026, Government of Manitoba
- The Public Sector Artificial Intelligence and Cybersecurity Governance Act, S.M. 2026, c. 43, and Bill 51 text, Government of Manitoba and Legislative Assembly of Manitoba, 2026
- The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175, Government of Manitoba, 2026
- The Freedom of Information and Protection of Privacy Act and The Local Authority Freedom of Information and Protection of Privacy Act, Saskatchewan King's Printer
- Artificial intelligence, Taskroom, Government of Saskatchewan
- Province introduces modernized access and privacy legislation, Government of Nova Scotia, September 26, 2025
- Freedom of Information and Protection of Privacy Act, office consolidation current to May 29, 2026, Government of Prince Edward Island
- Access to Information and Protection of Privacy Act, 2015, and Responsible Use of Artificial Intelligence Technology policy, Government of Newfoundland and Labrador, 2025
- ATIPPA, 2015 Review: Submission of the Information and Privacy Commissioner, October 9, 2026
- Annual Report 2023-24, Office of the Information and Privacy Commissioner of Nunavut
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada and provincial and territorial counterparts, December 7, 2023
- Provincial laws that may apply instead of PIPEDA, Office of the Privacy Commissioner of Canada
- Requirements related to publicly advertised job postings, Your guide to the Employment Standards Act, Government of Ontario, 2026
- Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, Legislative Assembly of Ontario
- Principaux changements apportés par la Loi 25 and guidance for private enterprises on automated decisions, Commission d'accès à l'information du Québec
- Update on Children's Privacy and AI Legislation/Privacy Guidelines in Canada, Office of the Information and Privacy Commissioner of Saskatchewan, April 2026