No single act regulates AI in Canada. Oversight comes from privacy statutes enforced by commissioners, a Treasury Board directive that binds federal departments, voluntary codes and regulator guidance, provincial public-sector rules, courts applying general law, and professional regulators. For most businesses the first regulator to check is the privacy commissioner with authority over the personal information involved, and for schools it is the provincial privacy commissioner and education authority.
Key takeaways
- As of October 31, 2026, Canada has no enacted AI statute. The Artificial Intelligence and Data Act lapsed on January 6, 2025.
- The Privacy Commissioner of Canada can recommend but not order. Enforcement under PIPEDA runs through the Federal Court.
- The Treasury Board Directive on Automated Decision-Making binds federal departments as policy, not as law.
- Voluntary codes and regulator principles create no legal duties but signal how privacy and human rights law will be applied.
- Provincial public-sector rules, such as Ontario's, matter most for schools, hospitals, and municipalities.
Regulators by level
The table separates what binds from what only guides. Entries describe AI-relevant parts of each regime as of October 31, 2026.
| Level | What is binding | Who enforces | What it covers for AI |
|---|---|---|---|
| Federal statutes | PIPEDA for private-sector commercial activity and federally regulated businesses; the Privacy Act for federal institutions. No AI act. Bill C-36 is proposed, not enacted. | Office of the Privacy Commissioner of Canada (OPC), which issues findings and recommendations; the Federal Court orders compliance | Personal information used to train or run AI systems: purpose, consent, accuracy, and safeguards |
| Federal policy for departments | Treasury Board Directive on Automated Decision-Making, a policy instrument that is not law | Treasury Board Secretariat; the Chief Information Officer of Canada can order reviews | Impact assessments, notice, explanation, testing, and monitoring for automated decision systems used by departments |
| Voluntary codes and regulator guidance | Nothing binding in itself: the Voluntary Code (September 2023), the commissioners' generative AI principles (December 7, 2023), OSFI Guideline E-23, Health Canada guidance on machine learning-enabled medical devices | Signatories for the code; privacy authorities for the principles; OSFI for federally regulated financial institutions; Health Canada for device licences | Accountability, safety, fairness, transparency, model risk management, and device change control |
| Provincial privacy laws | Quebec's private-sector privacy law as amended by Law 25; Alberta and British Columbia private-sector laws deemed substantially similar to PIPEDA | Commission d'accès à l'information du Québec (CAI); Alberta and British Columbia privacy commissioners | Notice of decisions based exclusively on automated processing (Quebec); privacy impact assessments before transfers outside Quebec; consent and safeguards |
| Provincial public-sector rules | Ontario's Enhancing Digital Security and Trust Act, 2024 and its regulations; the Ontario Responsible Use of Artificial Intelligence Directive; provincial access and privacy statutes | Ontario's Ministry of Public and Business Service Delivery and Procurement for the directive; provincial privacy commissioners for privacy law | AI use by ministries, agencies, school boards, and other public sector entities named by regulation |
| Courts and tribunals | Practice notices bind those who file in the court; general law such as negligence applies to AI errors | Judges and tribunal members | Disclosure of AI-generated filings; liability for chatbot statements |
| Professional regulators | Conduct rules of each profession, applied to AI use | Law societies and other professional colleges | Competence, confidentiality, and supervision when professionals use generative AI |
Why no single AI act exists
The Artificial Intelligence and Data Act was the closest attempt. It sat inside Bill C-27 and died with that bill when Parliament was prorogued on January 6, 2025. The OPC's 2024-25 annual report states that Canada's existing privacy laws continue to apply to new technologies such as generative AI. The June 4, 2026 AI for All strategy speaks of modern privacy and online safety laws and better AI transparency, and names no standalone act.
The live federal proposal is Bill C-36, a privacy bill that would amend PIPEDA and add transparency about automated decision systems. Its official status as of October 31, 2026 is second reading, with no debate recorded. The result is a patchwork in which AI is regulated through the rules that already govern personal information, public administration, consumer dealings, and professional conduct. The timeline sets out how that arrangement came about.
Federal privacy enforcement in practice
PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in commercial activities, and always to federally regulated businesses such as banks, airlines, and telecoms. The OPC's PIPEDA overview adds that not-for-profits and charities are generally outside the law unless they carry on commercial activity, and that municipalities, universities, schools, and hospitals are generally covered by provincial laws.
The OPC states that the Privacy Commissioner cannot make binding orders and must apply to the Federal Court within one year of the report of findings. It filed such an application on August 28, 2026 in a search engine de-listing matter. On AI specifically, the OPC, the CAI, and the British Columbia and Alberta commissioners issued joint findings on OpenAI on May 6, 2026. They found that collecting personal information from public sources to train GPT-3.5 and GPT-4 was overbroad and lacked valid implied consent. Details for businesses are on the PIPEDA and AI page.
Provincial and sector rules
Alberta, British Columbia, and Quebec have private-sector privacy laws deemed substantially similar to PIPEDA, so organizations under them are generally exempt from PIPEDA for information handled within the province. Cross-border flows remain subject to PIPEDA. Ontario has no general private-sector privacy statute of that kind, so PIPEDA covers commercial activity there.
The CAI's overview of Law 25 sets out the Quebec duty to inform a person when a decision is based exclusively on automated processing. For the public sector, the Ontario directive applies to ministries and provincial agencies, and two regulations under the 2024 Act took effect on July 1, 2026 for cyber security and school boards' handling of students' digital information.
Sector regulators add their own expectations. The Office of the Superintendent of Financial Institutions published Guideline E-23 on model risk management on September 11, 2025, effective May 1, 2027, and its definition of a model includes AI and machine learning methods. Health Canada's guidance for machine learning-enabled medical devices describes its current thinking and points to the Medical Devices Regulations as the binding requirements. Province-specific detail is on the provincial AI rules page.
Courts and professional regulators
Courts regulate AI through practice notices and ordinary law. The Federal Court's notice on AI in court proceedings, updated on May 7, 2024, asks filers to declare when AI directly generated content in a document. The Federal Court has also stated that, as of its September 29, 2025 interim policy, it will not use AI to make judgments or orders without public consultation first.
In Moffatt v. Air Canada, decided in February 2024 by the British Columbia Civil Resolution Tribunal, the airline was held liable for negligent misrepresentation after its website chatbot gave wrong fare information. Reports of the decision, which is a tribunal ruling and not a binding precedent for courts, agree on that outcome and on an award of CAD 650.88 plus interest and fees.
Professional regulators work through conduct rules. The Law Society of Ontario released a white paper on licensee use of generative AI at its April 25, 2024 Convocation, and its technology resource centre carries related practice material. Other professions have their own colleges, and the college for the relevant profession and province is the place to look.
Where to look first
The checklist below matches common situations to a first regulator. It is a starting point, not a complete compliance review.
- Business in Quebec: the CAI for personal information handled in the province, plus the Law 25 duties on automated decisions.
- Business in Alberta or British Columbia: the provincial commissioner for information handled inside the province, and the OPC for cross-border flows.
- Business elsewhere in Canada, including Ontario: the OPC under PIPEDA.
- Bank, insurer, airline, or telecom: the OPC, because federally regulated businesses are always under PIPEDA, plus OSFI for federally regulated financial institutions.
- Maker of an AI-enabled medical device: Health Canada.
- School or school board: the provincial privacy commissioner, the education ministry, and, in Ontario, the 2026 regulation on students' digital information.
- Federal department or agency: the Treasury Board directive and the OPC under the Privacy Act.
- Regulated professional: the professional college or law society.
The small business checklist turns these starting points into steps. This page is general information, not legal advice, and a lawyer or the text of the law should be consulted for a specific question.
FAQ
Which regulator should a small business check first when using AI tools?
The privacy commissioner with jurisdiction over the personal information involved: the Office of the Privacy Commissioner of Canada in most provinces, or the provincial commissioner in Quebec, Alberta, and British Columbia for information handled inside the province. A sector regulator may add rules for banking, insurance, or medical devices.
Can Canadian privacy regulators fine a company for AI misuse?
The federal commissioner cannot issue binding orders and must apply to the Federal Court to enforce recommendations. Quebec’s CAI can impose administrative monetary penalties on businesses, which it states could reach CAD 10 million or two percent of worldwide revenue. Bill C-36 would change the federal position if passed.
Are voluntary AI codes enforceable?
Not by themselves. The federal Voluntary Code of Conduct and the commissioners’ generative AI principles create no new legal duties. The commissioners’ principles state that they do not bind specific investigations, and organizations stay responsible for following the laws that apply to them.
Which rules apply to a school using AI?
Schools are generally covered by provincial public-sector laws, not by the federal private-sector privacy law. In Ontario, school boards also face a regulation in force since July 1, 2026 requiring written notice before disclosing students’ personal digital information to third-party software operators.
Does a court treat a chatbot’s mistake as the business’s responsibility?
In a February 2024 British Columbia Civil Resolution Tribunal decision, Moffatt v. Air Canada, the airline was held responsible for inaccurate information given by its website chatbot. A tribunal decision does not bind other courts, but it shows how general negligence principles are applied.
Related reading
- How PIPEDA applies to AI
- Provincial AI rules compared
- Small business AI compliance checklist
- Canada's overall approach to AI regulation
More in AI Law in Canada.
Last verified: October 2026
Sources
- PIPEDA in brief, Office of the Privacy Commissioner of Canada, 2026
- Prioritizing privacy in a data-driven world, Annual Report 2024-25, Office of the Privacy Commissioner of Canada, 2025
- News release on the Federal Court application, Office of the Privacy Commissioner of Canada, August 28, 2026
- PIPEDA Findings #2026-002: Joint Investigation of OpenAI OpCo, LLC, Office of the Privacy Commissioner of Canada, May 6, 2026
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada and provincial and territorial counterparts, December 7, 2023
- Bill C-36, Protecting Privacy and Consumer Data Act, LEGISinfo, Parliament of Canada, 2026
- Bill C-27, Digital Charter Implementation Act, 2022, LEGISinfo, Parliament of Canada, 2022 to 2025
- Prime Minister Carney launches AI for All, Prime Minister of Canada, June 4, 2026
- 2026 Review of the Privacy Act: Policy Approaches, Treasury Board of Canada Secretariat, 2026
- Directive on Automated Decision-Making: amendments and progress pages, Treasury Board of Canada Secretariat, 2023 to 2025
- Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, Innovation, Science and Economic Development Canada, 2023
- Principaux changements de la Loi 25, Commission d'accès à l'information du Québec, 2025
- Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, Legislative Assembly of Ontario, 2024
- Responsible Use of Artificial Intelligence Directive, Government of Ontario, 2024
- Ontario introduces cyber and educational technology regulations, Borden Ladner Gervais, March 2026
- Guideline E-23 Model Risk Management, Office of the Superintendent of Financial Institutions, September 11, 2025
- Pre-market guidance for machine learning-enabled medical devices, Health Canada, 2026
- Artificial intelligence, Federal Court of Canada, 2025
- Moffatt v. Air Canada, 2024 BCCRT 149, Civil Resolution Tribunal of British Columbia, 2024
- Licensee use of generative artificial intelligence, Law Society of Ontario, April 2024