Canada's AI-relevant law began as a research-funding strategy in March 2017 and has reached Bill C-36, introduced on June 15, 2026, without a standalone AI statute in between. The only AI-specific bill, the Artificial Intelligence and Data Act (AIDA) inside Bill C-27, lapsed when Parliament was prorogued on January 6, 2025. As of October 31, 2026, Bill C-36 is listed as being at second reading in the House of Commons, with no second reading debate recorded.
Key takeaways
- The Treasury Board Directive on Automated Decision-Making, launched on March 4, 2019, is the oldest binding AI-related rule, and it covers federal institutions only.
- AIDA was introduced on June 16, 2022 and lapsed with Bill C-27 after committee meetings that ran from September 26, 2023 to September 26, 2024.
- Quebec's Law 25 took effect in three stages, ending with the data portability right on September 22, 2024.
- Ontario's Bill 194 received royal assent on November 25, 2024, and the two regulations in force since July 1, 2026 do not address AI directly.
- Bill C-36 has not advanced past first reading in the official record.
Dated chronology, 2017 to 2026
The table lists each dated step in order. Where an official page gives only a month, the table does the same.
| Date | Event | Legal weight |
|---|---|---|
| March 2017 | Budget 2017 funds the Pan-Canadian AI Strategy at CAD 125 million, delivered by CIFAR | Research funding, no legal duties |
| March 4, 2019 | Treasury Board launches the Directive on Automated Decision-Making | Binding policy for federal institutions in scope |
| April 1, 2020 | New automated decision systems must comply with the Directive | Binding policy |
| November 17, 2020 | Bill C-11, the Digital Charter Implementation Act, 2020, introduced | Bill, never passed second reading |
| Fall 2020 to winter 2021 | Justice Canada consults on Privacy Act modernization | Consultation |
| June 16, 2022 | Bill C-27 introduced, containing AIDA | Bill |
| September 2022 | First Law 25 measures take effect in Quebec | Statute |
| April 24, 2023 | Bill C-27 completes second reading and goes to committee | Bill |
| September 2023 | Voluntary Code of Conduct for advanced generative AI issued; second Law 25 stage in Quebec | Voluntary code; statute |
| December 7, 2023 | Federal, provincial, and territorial privacy authorities publish generative AI principles | Regulator guidance |
| May 13, 2024 | Bill 194 introduced in Ontario | Bill |
| September 22, 2024 | Quebec data portability right takes effect, completing the Law 25 phase-in | Statute |
| November 25, 2024 | Bill 194 receives royal assent | Statute |
| January 29, 2025 | Sections 1 to 16 of the Enhancing Digital Security and Trust Act, 2024 take effect by Order in Council | Statute, AI duties apply only to prescribed entities |
| December 1, 2024 | Ontario Responsible Use of Artificial Intelligence Directive takes effect | Binding directive for ministries and agencies |
| January 6, 2025 | Parliament prorogued; Bill C-27 and AIDA lapse | Bill dies |
| June 24, 2025 | Amended Directive on Automated Decision-Making issued | Binding policy |
| January 21, 2026 | Ontario IPC and OHRC release joint principles on responsible AI use | Regulator guidance |
| April 2, 2026 | Treasury Board launches a review of the Privacy Act | Consultation |
| May 6, 2026 | Four privacy offices issue joint findings on OpenAI | Regulator findings |
| June 4, 2026 | AI for All national strategy launched in Toronto | Policy, no legal duties |
| June 15, 2026 | Bill C-36 introduced | Bill |
| June 24, 2026 | Deadline for existing automated decision systems to meet the amended Directive | Binding policy |
| July 1, 2026 | Two Ontario regulations under the Enhancing Digital Security and Trust Act, 2024 take effect | Regulation |
| October 31, 2026 | Bill C-36 listed at second reading, no debate recorded | Bill |
From research funding to the first binding rule
The Pan-Canadian AI Strategy came first. Budget 2017 proposed CAD 125 million to launch it, with the Canadian Institute for Advanced Research (CIFAR) delivering the program. CIFAR describes it as the first national AI strategy in the world and names three institutes: Amii in Edmonton, Mila in Montreal, and the Vector Institute in Toronto. It built research capacity and set no duties for businesses.
The first binding rule followed. Treasury Board launched the Directive on Automated Decision-Making on March 4, 2019, and new systems had to comply from April 1, 2020. The Treasury Board Secretariat lists amendments on April 1, 2021, April 25, 2023, and June 24, 2025. The 2023 amendments brought internal services such as hiring and security screening into scope and required the algorithmic impact assessment to be published before a system launches. Systems already running before June 24, 2025 had until June 24, 2026 to comply, and the directive is reviewed every two years.
Bills C-11 and C-27
Bill C-11 was introduced on November 17, 2020. Its last recorded activity was debate at second reading on April 19, 2021, and the parliamentary session ended on August 15, 2021 without further stages.
Bill C-27 was first read on June 16, 2022 and carried AIDA as its AI component. According to Innovation, Science and Economic Development Canada (ISED), AIDA would have required businesses to address risks such as harm and bias in high-impact AI systems, with obligations scaling to risk and details left to regulations still in development. The House completed second reading on April 24, 2023. The Standing Committee on Industry and Technology met on the bill from September 26, 2023 to September 26, 2024 without completing its study. The session ended on January 6, 2025, and the Office of the Privacy Commissioner of Canada (OPC) states that the bill died on the order paper.
Voluntary code and regulator principles in 2023
With no statute in sight, 2023 produced two non-binding instruments. In September 2023, ISED issued the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems. It sets six outcomes: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity. ISED's page lists 46 signatories as of October 2026.
On December 7, 2023, the OPC and 13 provincial and territorial counterparts published principles for generative AI. There are nine, drawn from privacy law concepts such as legal authority and consent, necessity and proportionality, accountability, accuracy, and safeguards. The document states that the principles do not bind any specific investigations or adjudications, and that organizations remain responsible for following the laws that apply to them.
Quebec Law 25, 2022 to 2024
The Commission d'accès à l'information du Québec (CAI) describes Law 25 as a 2021 law, in force in stages. Its summary of the main Law 25 changes places sharing for research and commercial transactions in September 2022. September 2023 brought privacy impact assessments before transfers outside Quebec, stricter consent, and transparency notices at collection. The portability right followed on September 22, 2024.
The rule closest to AI requires an organization to tell a person when a decision is based exclusively on automated processing, no later than when the decision is communicated, and to let the person present observations to staff able to review it. The CAI page does not tie that rule to a phase date, and law-firm summaries that place it in September 2023 are not confirmed in official sources reviewed. The CAI states that administrative penalties for businesses could reach CAD 10 million or two percent of worldwide revenue. A fuller account is on the Quebec automated decisions page.
Ontario: Bill 194 and the 2024 to 2026 instruments
Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, was introduced on May 13, 2024. Second reading carried on October 29, 2024, and the bill was referred to the Standing Committee on Justice Policy. Third reading and royal assent both came on November 25, 2024 (Statutes of Ontario 2024, chapter 24).
Schedule 1 enacts the Enhancing Digital Security and Trust Act, 2024. Its part on the use of AI systems applies to prescribed public sector entities and leaves most rules to regulations. Order in Council 361/2025, approved on January 28, 2025, brought sections 1 to 16 of Schedule 1 into force on January 29, 2025, so the AI provisions are in force, although they bind only the public sector entities that a regulation names. Schedule 2 amends the Freedom of Information and Protection of Privacy Act.
Separately, the Ontario Responsible Use of Artificial Intelligence Directive took effect on December 1, 2024 for ministries and provincial agencies. Two regulations under the new Act, published on March 23, 2026, took effect on July 1, 2026. They cover cyber security and written notice before school boards disclose personal digital information about students under age 18 to third-party software operators. No AI-specific regulation was found as of October 31, 2026. The Ontario AI rules page follows these instruments in detail.
Strategy, privacy review, and Bill C-36 in 2026
The Information and Privacy Commissioner of Ontario (IPC) and the Ontario Human Rights Commission (OHRC) released joint principles on January 21, 2026. They set six qualities for AI systems: valid and reliable, safe, privacy protective, human rights affirming, transparent, and accountable.
On June 4, 2026, the Prime Minister launched AI for All in Toronto. The government's release lists modern privacy protections, an online safety regime covering social media and chatbot users, better AI transparency, and an expanded Canadian AI Safety Institute. It names no standalone AI act.
Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced by the Minister of Artificial Intelligence and Digital Innovation on June 15, 2026. On the parliamentary record for Bill C-36, the status reads "At second reading in the House of Commons," yet the second reading stage shows no activity and the latest event is first reading. A Charter Statement is listed as tabled on August 19, 2026. The bill would increase transparency about automated decision systems, including AI-powered ones. See the Bill C-36 page for its contents.
Privacy Act review and regulator findings
The Treasury Board Secretariat launched a review of the Privacy Act, which governs federal institutions, on April 2, 2026, and took comments until July 10, 2026. Its policy approaches paper proposes that institutions explain on request how an automated decision system supported a decision, and that people be notified when such a system starts using their data. A consolidated report is planned for winter 2026-27. On August 6, 2026, the Privacy Commissioner called enhanced transparency for automated decision systems a positive step.
Enforcement also moved. On May 6, 2026, the OPC, the CAI, and the British Columbia and Alberta privacy commissioners issued joint findings on OpenAI under PIPEDA. They found that collecting personal information from public websites and licensed datasets to train GPT-3.5 and GPT-4 was overbroad, and that valid implied consent was missing for public-source training. They also found that accuracy requirements were not met. The public-source complaint was resolved conditionally.
What the record does not confirm
Several commonly repeated dates could not be matched to an official page. The Directive on Automated Decision-Making is often given an April 1, 2019 effective date, but the government's own timeline shows a March 4, 2019 launch and April 1, 2020 compliance. The day of the Voluntary Code release in September 2023 is not stated on the ISED page. The day of the first two Law 25 stages is given only as a month on the CAI page. Whether any regulation on public sector AI use has been filed under the Ontario Act also remains unconfirmed in official sources.
This page is general information, not legal advice. Bill status changes, so primary sources should be checked before relying on any date here. The wider picture is on the Canada AI regulation overview.
FAQ
Is there a federal AI law in force in Canada?
No. As of October 31, 2026, no standalone federal AI statute has been enacted. The Artificial Intelligence and Data Act lapsed with Bill C-27 on January 6, 2025, and Bill C-36 is a privacy bill that has not passed.
What was the first binding AI-related rule in Canada?
The Treasury Board Directive on Automated Decision-Making, launched on March 4, 2019. It is a policy instrument that binds federal institutions in its scope, not a statute that reaches private businesses.
Where does Bill C-36 stand?
The official parliamentary record lists the bill as at second reading in the House of Commons, but shows no second reading debate or vote. The latest recorded stage is first reading on June 15, 2026.
Has Ontario issued AI regulations under Bill 194?
Not as of October 31, 2026, in the sources reviewed. Two regulations took effect on July 1, 2026, covering cyber security and children’s digital information held by school boards, and neither is an AI regulation.
Related reading
- What Bill C-36 would change
- Quebec Law 25 and automated decisions
- Ontario's AI rules for the public sector
- Canada's overall approach to AI regulation
More in AI Law in Canada.
Last verified: October 2026
Sources
- Bill C-36, Protecting Privacy and Consumer Data Act, LEGISinfo, Parliament of Canada, 2026
- Bill C-27, Digital Charter Implementation Act, 2022, LEGISinfo, Parliament of Canada, 2022 to 2025
- Bill C-11, Digital Charter Implementation Act, 2020, LEGISinfo, Parliament of Canada, 2020 to 2021
- Artificial Intelligence and Data Act overview, Innovation, Science and Economic Development Canada, 2022
- Prioritizing privacy in a data-driven world, Annual Report 2024-25, Office of the Privacy Commissioner of Canada, 2025
- Growing Canada's Advantage in Artificial Intelligence, Department of Finance Canada, March 2017
- Pan-Canadian AI Strategy, CIFAR, 2017
- Responsible use of AI in government: progress, Treasury Board of Canada Secretariat, 2025
- Amendments to the Directive on Automated Decision-Making, Treasury Board of Canada Secretariat, 2023
- Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, Innovation, Science and Economic Development Canada, 2023
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada and provincial and territorial counterparts, December 7, 2023
- Principaux changements de la Loi 25, Commission d'accès à l'information du Québec, 2025
- Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, Legislative Assembly of Ontario, 2024
- Responsible Use of Artificial Intelligence Directive, Government of Ontario, 2024
- Ontario introduces cyber and educational technology regulations, Borden Ladner Gervais, March 2026
- Privacy and human rights commissions release joint principles for responsible use of AI, Ontario Human Rights Commission, January 21, 2026
- Prime Minister Carney launches AI for All, Prime Minister of Canada, June 4, 2026
- Government of Canada introduces legislation to protect Canadians' privacy in the digital age, Innovation, Science and Economic Development Canada, June 15, 2026
- 2026 Review of the Privacy Act: Policy Approaches, Treasury Board of Canada Secretariat, April 2, 2026
- Modernizing Canada's Privacy Act: What We Heard Report, Department of Justice Canada, 2021
- PIPEDA Findings #2026-002: Joint Investigation of OpenAI OpCo, LLC, Office of the Privacy Commissioner of Canada, May 6, 2026
- Submission on the Privacy Act modernization consultation, Office of the Privacy Commissioner of Canada, August 2026