As of October 31, 2026, no AI-specific statute was found that governs how Canadian organizations use AI tools in general, so this checklist ties each item to a general law or regulator guidance that reaches chatbots, hiring tools, customer support, and marketing. The sources are PIPEDA and the federal and provincial privacy regulators' generative AI principles, Quebec's Law 25 duties, Canada's Anti-Spam Legislation (CASL), the Competition Act, and Ontario's job posting rule. This is general information, not legal advice, and completing the list cannot confirm compliance.
Key takeaways
- The regulators' generative AI principles say organizations should tell people when they interact with an AI tool, and that accountability for decisions stays with the organization.
- Ontario employers with 25 or more employees must disclose AI use to screen, assess, or select applicants in publicly advertised postings, and must keep the postings for three years.
- CASL covers commercial electronic messages whoever or whatever wrote them, and the sender has the burden of proving consent.
- Quebec adds duties for fully automated decisions, a designated person in charge of privacy, and an incident register.
- The Competition Act prohibits false or misleading representations in a material respect, including exaggerated claims about what an AI feature can do.
How to use this checklist
Each row names a legal source or a regulator document. Rows that cite a statute describe a rule in force on October 31, 2026. Rows that cite the generative AI principles describe regulator guidance, which sets expectations but is not a statute by itself, and each row says which kind it is. The list does not name or recommend any product or vendor, and it takes no position on which tools an organization should choose. It also leaves out sector rules for health care, finance, and education, which can add duties. Items are written as checks, so an unticked box signals a question to research, not a finding of non-compliance. For the wider picture, see the overview of Canadian AI regulation.
Which privacy law applies
The Office of the Privacy Commissioner lists Alberta, British Columbia, and Quebec as the provinces with private-sector privacy laws deemed substantially similar to PIPEDA. Organizations covered by those laws are generally exempt from PIPEDA for personal information handled within the province. PIPEDA still applies to cross-border transfers, to federal works and businesses, and to organizations in the three territories. No other province's private-sector law is on the Commissioner's list, so PIPEDA is the baseline for commercial activity elsewhere. A business that serves customers in several provinces can be subject to more than one regime. The provincial AI rules table shows what each province adds, and the PIPEDA and AI page explains the federal baseline.
Checklist 1: any AI tool that handles personal information
These rows draw on the ten PIPEDA principles and on the Commissioner's generative AI principles, issued December 7, 2023, which address organizations that use generative AI as well as developers.
| Check | What to confirm | Legal basis |
|---|---|---|
| Know what goes in | Staff do not enter personal or confidential information into prompts unless authorized, and the organization knows which tools staff use | Generative AI principles (guidance), on organizations using AI; PIPEDA principle: Safeguards |
| Purpose and necessity | The reason for the tool is written down, serves a purpose a reasonable person would consider appropriate, and the tool is likely to be effective, not only potentially useful | Generative AI principles: Appropriate Purposes, Necessity and Proportionality; PIPEDA principles: Identifying purposes, Limiting collection |
| Consent and notice | Where consent is the legal basis, it is valid and meaningful, and people can learn how their information is used with AI | Generative AI principles: Legal Authority and Consent, Openness; PIPEDA principles: Consent, Openness |
| Accountability | A named person is responsible for the tool, and responsibility for decisions stays with the organization rather than the automated system | PIPEDA principle: Accountability; generative AI principles: Accountability |
| Accuracy | Outputs are checked before use, especially when they inform decisions about people or are published | PIPEDA principle: Accuracy; generative AI principles: Accuracy |
| Safeguards | Protection matches the sensitivity of the information, including against prompt injection and similar attacks | PIPEDA principle: Safeguards; generative AI principles: Safeguards |
| Access and correction | A process exists to answer requests for access to, or correction of, personal information, including information in prompts and outputs | PIPEDA principle: Individual access; generative AI principles: Individual Access |
| Retention | A retention period is set, and prompts containing personal information are not kept longer than necessary | PIPEDA principle: Limiting use, disclosure, and retention; generative AI principles: Limiting Collection, Use, and Disclosure |
Checklist 2: hiring and screening tools
Ontario's disclosure rule is a statute. The other rows combine regulator guidance with Quebec's statute. More background is in the article on AI in hiring and on the Ontario AI rules page.
| Check | What to confirm | Legal basis |
|---|---|---|
| Posting disclosure (Ontario) | For a publicly advertised posting made on or after January 1, 2026 by an employer with 25 or more employees, the posting states the employer's use, if any, of AI to screen, assess, or select applicants. A general statement is enough, and the duty applies even when a recruiter does the screening | Employment Standards Act, 2000 (Ontario), as explained in the Ontario government guide to the Act |
| Employee count | Part-time and casual employees count as one each, across all Ontario locations and related employers. Internal-only postings, general hiring signs, and work performed outside Ontario are excluded | Same Ontario guide |
| Tell applicants about AI in decisions | People are told when AI is part of a decision, what safeguards apply, and what recourse exists, including human review | Generative AI principles (guidance) |
| Fully automated decisions (Quebec) | If a decision rests exclusively on automated processing, the person is informed no later than when the decision is communicated, is given on request the information used, the reasons, and the main factors, and can submit observations to a staff member able to review it | Quebec Act respecting the protection of personal information in the private sector, s. 12.1, as described by the Commission d'accès à l'information |
| Bias monitoring | Outputs are monitored for inappropriate uses or biased outcomes, problems are reported to the provider, and use that crosses a no-go zone stops | Generative AI principles (guidance) |
Checklist 3: chatbots and customer support
For customer-facing tools, the privacy regulators' expectations sit beside the Competition Act's rule on what an organization says about its own product. The Competition Bureau's March 20, 2024 discussion paper on AI and competition lists exaggerating what an AI product can do, wrongly claiming it outperforms a non-AI product, and falsely stating that a product uses AI as examples of false AI claims.
| Check | What to confirm | Legal basis |
|---|---|---|
| Say it is AI | People are told when they are interacting with an AI tool, along with the privacy risks and mitigations | Generative AI principles: Openness (guidance) |
| Human route | Where AI is part of a decision about a person, recourse including human review is available. In Quebec this is a statutory duty for exclusively automated decisions | Generative AI principles (guidance); Quebec private-sector Act, s. 12.1 |
| Customer data stays out of public tools | Customer personal information is not entered into publicly available AI tools unless authorized | Generative AI principles (guidance) |
| Honest capability claims | Marketing and chatbot scripts do not overstate what the AI does or claim AI use that does not exist | Competition Act, s. 74.01(1)(a): representations false or misleading in a material respect |
| Tested performance claims | Any claim about performance or efficacy, such as accuracy or resolution rates, rests on an adequate and proper test, with the burden of proof on the person making the claim | Competition Act, s. 74.01(1)(b) |
Checklist 4: marketing messages and claims
Text produced by an AI tool and sent to encourage a purchase is treated like any other marketing message. The Anti-Spam Legislation defines a commercial electronic message by its purpose, and its maximum penalty is CAD 1 million for an individual and CAD 10 million for any other person.
| Check | What to confirm | Legal basis |
|---|---|---|
| Consent before sending | Express or implied consent exists for each recipient before a commercial electronic message is sent | CASL, ss. 1(2) and 6(1) |
| Sender identification | The message identifies the sender and anyone on whose behalf it is sent, with contact information | CASL, s. 6(2) |
| Unsubscribe | An unsubscribe mechanism is included, and requests are acted on without delay and no later than 10 business days | CASL, ss. 6(2) and 11(3) |
| Proof of consent | Records show how and when consent was obtained, because the person claiming consent has the onus of proving it | CASL, s. 13 |
| Testimonials and reviews | No testimonial is used or altered without authorization, including AI-generated ones. The Bureau notes the prohibition applies whether or not AI is involved | Competition Act; Competition Bureau consultation report, January 27, 2025 |
| Synthetic voices, images, and video | AI-generated content does not create a false or misleading impression in a material respect | Competition Act, s. 74.01(1)(a) |
| Algorithmic pricing (Manitoba) | Online retailers and distributors subject to Manitoba's Business Practices Act do not use personalized algorithmic pricing to increase the price demanded from a consumer. In force since July 1, 2026 | The Business Practices Act (Manitoba), as amended by S.M. 2026, c. 41 |
Checklist 5: extra duties when operating in Quebec
The Commission d'accès à l'information summarizes the Law 25 changes for businesses and says administrative monetary penalties can reach CAD 10 million or two percent of worldwide revenue. The details of the automated decision rule are on the Quebec Law 25 page.
| Check | What to confirm | Legal basis |
|---|---|---|
| Person in charge | The person with the highest authority is responsible for personal information, any delegation is in writing, and the title and contact details are published | Quebec private-sector Act, as summarized by the Commission d'accès à l'information |
| Governance policies | Policies cover retention and destruction, staff roles, and a complaint process, and information about them is published online | Same |
| Profiling and identification features | People are informed before technology that can identify, locate, or profile them is used, and those functions are off by default | Same |
| Transfers outside Quebec | A privacy impact assessment is completed before personal information leaves Quebec, such as to a tool hosted elsewhere, and a written agreement governs the transfer | Same |
| Incidents | The Commission and affected people are notified of incidents presenting a risk of serious injury, and an incident register is kept and given to the Commission on request | Same |
Checklist 6: records to keep
Several of the duties above depend on being able to produce a document later. The retention periods below come from the sources named in each row.
| Record | What to keep and for how long | Legal basis |
|---|---|---|
| Breach records | A record of every breach of security safeguards involving personal information, for 24 months after the day the breach is determined, including the reasoning when there was no real risk of significant harm | PIPEDA breach record-keeping, as explained by the Office of the Privacy Commissioner |
| Consent records | Evidence of express or implied consent for each recipient of marketing messages, showing how and when it was obtained | CASL, s. 13 |
| Job postings | Each publicly advertised posting, associated application forms, and revised versions, for three years after public access is removed | Ontario guide to the Employment Standards Act, 2000 |
| Performance claim tests | The test that supports each performance or efficacy claim | Competition Act, s. 74.01(1)(b) |
| AI documentation | Impact assessments, and which personal information was used to retrain or refine a system | Generative AI principles: Accountability (guidance) |
Proposals that are not law yet
Several items sometimes described as AI rules are proposals. Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced on June 15, 2026, and the Parliament of Canada page on October 31, 2026 showed no second reading activity; the Bill C-36 page tracks it. The Competition Bureau's January 27, 2025 report records stakeholder suggestions for AI content labelling, which are not current law. Alberta's Commissioner recommended a standalone AI law in July 2025, and Manitoba's public sector AI act is not in force. A checklist built on the law as it stands cannot rely on any of them, and each should be rechecked before a tool is deployed.
This article is general information, not legal advice. Statutes and guidance named here can change, and the checklist cannot confirm that any organization complies with them.
FAQ
Does a small business have to tell customers it uses an AI chatbot?
No statute requiring this was found as of October 31, 2026. The generative AI principles issued by the federal, provincial, and territorial privacy regulators say people should be told when they are interacting with an AI tool, but those principles are guidance. PIPEDA includes an openness principle, and the Competition Act prohibits representations that are false or misleading in a material respect.
Does the Ontario job posting rule apply to a company with 10 employees?
No. The rule does not apply to employers with fewer than 25 employees on the day the posting goes up. Privacy law and the other items in this checklist can still apply to a smaller employer.
Does CASL apply to marketing emails written by an AI tool?
Yes, if the message is a commercial electronic message. The definition in the Act turns on whether it is reasonable to conclude that one purpose of the message is to encourage participation in a commercial activity, not on who or what wrote it. The maximum penalty for a violation is CAD 1 million for an individual and CAD 10 million for any other person.
Does finishing this checklist show that an organization complies with the law?
No. The checklist points to sources, and it cannot assess an organization's facts, contracts, or sector rules. Compliance depends on the specific tools, data, provinces, and customers involved, and a qualified lawyer or the regulator's own guidance is the place to confirm it.
Related reading
- How PIPEDA applies to AI tools
- AI rules in each province and territory
- Quebec's automated decision duties
- Where Canadian AI regulation stands
More in AI Law in Canada.
Last verified: October 2026
Sources
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada and provincial and territorial counterparts, December 7, 2023
- PIPEDA fair information principles, Office of the Privacy Commissioner of Canada
- What you need to know about mandatory reporting of breaches of security safeguards, Office of the Privacy Commissioner of Canada
- Provincial laws that may apply instead of PIPEDA, Office of the Privacy Commissioner of Canada
- Requirements related to publicly advertised job postings, Your guide to the Employment Standards Act, Government of Ontario, 2026
- Canada's Anti-Spam Legislation (S.C. 2010, c. 23), current to September 30, 2026, Department of Justice Canada
- Competition Act (R.S.C. 1985, c. C-34), section 74.01, current to September 30, 2026, Department of Justice Canada
- Artificial intelligence and competition: Discussion Paper, Competition Bureau Canada, March 20, 2024
- Consultation on Artificial Intelligence and Competition: What We Heard, Competition Bureau Canada, January 27, 2025
- Principaux changements apportés par la Loi 25 and guidance for private enterprises on automated decisions, Commission d'accès à l'information du Québec
- The Business Practices Act, C.C.S.M. c. B120, consolidation current from July 1, 2026 to October 28, 2026, Government of Manitoba
- Bill C-36, 45th Parliament, 1st Session, Parliament of Canada, status checked October 31, 2026
- Comments from the OIPC regarding responsible AI governance in Alberta, Office of the Information and Privacy Commissioner of Alberta, July 15, 2025