Table of Contents
Quick Answer
Canada's AI governance in 2026 rests on the Voluntary Code of Conduct on the Responsible Development of Generative AI (September 2023), the Directive on Automated Decision-Making (federal public sector), PIPEDA, and Quebec's Law 25. The Artificial Intelligence and Data Act (AIDA), proposed as part of Bill C-27, did not pass before Parliament was prorogued in January 2025 and remains pending reintroduction.
- AIDA is not yet law but remains the template for federal AI regulation
- Voluntary Code signed by 20+ companies including BlackBerry, Cohere, OpenText
- Quebec's Law 25 imposes binding AI obligations in that province
What Is Canada's AI Regulatory Framework?
Canada's AI oversight is a mix of federal soft-law instruments and provincial statutes. The most important pieces in 2026 are:
- Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems (ISED, September 2023)
- Directive on Automated Decision-Making (Treasury Board of Canada, updated 2023)
- PIPEDA (Personal Information Protection and Electronic Documents Act)
- Quebec Law 25 (formerly Bill 64)
- Office of the Privacy Commissioner (OPC) Principles for Responsible Generative AI (December 2023)
The proposed AIDA would have introduced binding rules for "high-impact AI systems" with fines up to CAD 10 million or 3% of global turnover. It remains the reference model for future federal legislation.
Key Details / Requirements
Instrument
Type
Binding?
AIDA (proposed)
Federal statute
Not yet in force
Voluntary Code on GenAI
ISED code
No (but signatories commit)
Directive on ADM
Treasury Board directive
Yes (federal government)
PIPEDA
Federal privacy statute
Yes
Quebec Law 25
Provincial statute
Yes (Quebec)
OPC Principles for GenAI
Regulator guidance
Interpretive
Quebec Law 25 — AI Obligations
Obligation
Article
Inform individuals of automated decisions
Art. 12.1
Provide explanation of reasoning
Art. 12.1
Allow correction and human review
Art. 12.1
Fines up to CAD 25M or 4% of turnover
Penalties section
Real-World Examples / Case Studies
Air Canada Chatbot (2024) — A British Columbia Civil Resolution Tribunal held Air Canada liable for misinformation provided by its AI chatbot about bereavement fares, setting a precedent on liability for AI-generated statements.
Clearview AI — Declared non-compliant with PIPEDA and Quebec privacy law in a February 2021 joint investigation by the OPC and three provincial commissioners.
Tim Hortons — OPC found the chain violated PIPEDA by tracking users' geolocation via its app (June 2022) — a template for automated profiling cases involving AI.
What This Means for Businesses
Any organization operating AI in Canada in 2026 must:
- Comply with PIPEDA (or substantially similar provincial laws)
- If operating in Quebec: meet Law 25 automated-decision disclosure obligations
- Federal government contractors: meet the Directive on ADM's four-tier Algorithmic Impact Assessment
- If developing generative AI: consider signing the Voluntary Code of Conduct
- Watch for AIDA reintroduction in Parliament
Compliance Checklist
- Inventory AI systems and classify risk (use AIDA draft definitions as guidance)
- Complete an Algorithmic Impact Assessment for public-sector AI
- Publish an automated-decision notice where Quebec Law 25 applies
- Complete a PIPEDA Privacy Impact Assessment for high-risk AI
- Implement OPC's Principles for Responsible Generative AI
- Sign and publish adherence to the Voluntary Code of Conduct (optional but signals maturity)
FAQs
Q: Is AIDA in force?
No — Bill C-27 did not pass before the January 2025 prorogation. Reintroduction expected.
Q: What are the AIDA penalties?
Proposed: CAD 10M or 3% of gross global revenue; criminal offences up to CAD 25M or 5% of revenue.
Q: Does PIPEDA cover AI?
Yes — PIPEDA's ten principles apply to personal data processed by AI.
Q: What is the Directive on ADM?
A Treasury Board directive requiring federal departments using automated decision systems to complete an Algorithmic Impact Assessment.
Q: Does Quebec Law 25 apply to out-of-province companies?
Yes — if they process personal information of Quebec residents.
Q: Is the Voluntary Code of Conduct mandatory?
No — but signatories publicly commit and face reputational consequences.
Q: Which provinces have substantially similar privacy laws?
British Columbia, Alberta, and Quebec.
Conclusion
Canada's AI regime in 2026 is transitional — heavy on soft law federally, binding at the provincial level. Companies that adopt AIDA's principles now will absorb federal legislation with minimal disruption.
Get Canada-ready AI governance with Misar AI's AIDA + Law 25 templates.