Canada AI regulation currently has no dedicated federal statute: the Artificial Intelligence and Data Act (AIDA), part of Bill C-27, was not enacted. Businesses remain bound by existing privacy laws and by provincial rules such as Ontario’s hiring disclosure.
This guide sets out how the federal approach developed, where it stands and which duties apply today. For the wider policy picture, see our ai regulation explained overview.
Why AIDA was framed as a first step
AIDA was designed as the opening layer of a regulatory system, not a complete rulebook. That design explains why it left so much detail for later, and why its failure to pass leaves so many questions open. It moved through four stages.
- Tabling. In June 2022 the Government of Canada tabled AIDA as part of Bill C-27, the Digital Charter Implementation Act, 2022. The federal Department for Innovation Science and Economic Development (ISED) drafted the act.
- Framing. ISED’s companion document called the proposed framework the first step towards a new regulatory system. Its stated aim was to regulate the most powerful uses of AI that pose a risk of harm, rather than every AI tool.
- Promised detail. The same document said the Government intended to build on the framework through an open and transparent regulatory development process, with consultations. The specific duties were therefore meant to come through later regulations.
- Parliament. The bill passed second reading on 24 April 2023, according to the University of Windsor law library’s regulation guide. Commentary at the time described it as before the Standing Committee on Industry and Technology.
The consequence is practical. A framework that relied on future regulations gave businesses a direction of travel but never reached the point of fixed, enforceable requirements. The next section explains where that left the bill.
Current status of the AI bill
The bill that carried AIDA was not enacted. The University of Windsor guide records it as not enacted at the dissolution of Parliament. A Cambridge Data & Policy article reports that, as of 6 January 2025, AIDA was no longer under review as Parliament was prorogued.
For a compliance team, this changes how to read earlier commentary. Articles written while the bill was in committee describe proposals, not law. Any federal AI statute would need to be introduced again, and nothing in the evidence here fixes its content or timing. Treat AIDA as a policy signal about where regulators were heading, not as a source of current legal duties.
High-impact systems and what they imply for duties
AIDA’s central concept was the high-impact system. Law-firm commentary notes that AIDA focuses on high-impact systems, in much the way the EU AI Act focuses on high-risk systems. ISED’s own wording, targeting the most powerful uses of the technology that pose a risk of harm, shows the same risk-based logic.
Because the act did not pass, no binding federal duties attach to high-impact systems today. That is the direct answer to the question of what those duties are. The useful question for a business becomes which benchmark to use for its own controls. The EU AI Act, which the same commentary uses as a comparison, imposes obligations on risk management, data governance, documentation and record-keeping, human oversight, cybersecurity, transparency and quality control. A developer building a system that could affect people’s rights or safety can use that list as a checklist for internal governance without treating it as Canadian law.
Obligations at a glance
Duties that bind Canadian organisations today come from privacy law and provincial rules. The table separates what is in force or passed from what was only proposed or is shown for comparison.
| Instrument | Status | What it requires or covers | Planning use |
|---|---|---|---|
| AIDA (Bill C-27), high-impact systems | Not enacted | No binding duties; framework aimed at the most powerful uses that pose a risk of harm | Read as a signal of regulatory direction, not a compliance obligation |
| EU AI Act (comparison only) | Foreign law, shown as a reference | Risk management, data governance, documentation and record-keeping, human oversight, cybersecurity, transparency, quality control | Use as a checklist for internal governance of higher-risk systems |
| Ontario Working for Workers Four Act, s 8.4(1) | Passed March 2024; commencement date not set when reported | Employers must include in a job posting a statement disclosing use of AI where it screens applicants | Confirm the commencement date before relying on or ignoring it |
| Quebec privacy law reforms | Privacy law reforms | Fully automated decision-making must be disclosed to individuals | Prepare plain-language notices for automated decisions affecting people in Quebec |
| Joint regulator guidance on generative AI | Issued December 2023 | Applies existing privacy laws to generative AI | Fold into privacy impact reviews of generative tools |
The table draws on the University of Windsor law library guide for AIDA’s status and the Ontario provision, and on Torys commentary for the EU comparison, Quebec, the Ontario passage date and the joint guidance.
One caution about the Ontario row: the first-province distinction relates to passing the law in March 2024, and the commentary reported that its commencement date had not been set. Passage and effect are different things, so check whether the provision is in force before treating it as a live duty.
Who enforces AI rules in Canada
With no AI statute, enforcement runs through existing laws rather than an AI regulator. Privacy regulators sit at the centre. Federal and provincial regulators, including the federal Office of the Privacy Commissioner, came together to issue joint guidance on generative AI, applying the privacy laws they oversee. ISED, which drafted AIDA, owns the federal policy file, but the pack contains no evidence that it holds enforcement powers over AI systems today.
Provincial rules carry their own obligations, which is why the Ontario and Quebec rows above matter for any organisation hiring or serving people there. A business operating across provinces should therefore expect several overlapping sources of duty rather than one national checklist.
What to do now
The commentary on Canadian and international AI regulation advises that businesses stay on top of these developments even before they are legally binding. The sections below turn that advice into choices for different readers.
Businesses deploying AI
Start with the laws that already apply. Privacy compliance is the nearest obligation for any system that handles personal data, and generative tools fall within the regulators’ joint guidance. Employers that screen applicants with AI should check Ontario’s disclosure provision. Organisations that make fully automated decisions about people should check Quebec’s disclosure rule. A business with no operations in either province can wait on those two points but should not ignore its own provincial privacy regulator.
Developers and vendors
Developers building higher-impact tools gain most from adopting documentation and record-keeping habits now, because those are the obligations the EU comparison names and the ones customers are likely to ask about. Keep records of data governance and oversight decisions in a form a reviewer could read later.
Citizens
For individuals, the visible protections are disclosure-based. Quebec’s reforms say fully automated decision-making should be disclosed, and Ontario’s provision lets job applicants know when AI is used to screen them. There is no federal right created by AIDA, since it was never enacted.
Related policy areas
Compliance planning for AI also touches adjacent questions. Training data and ownership are covered in AI and Copyright Law: What Creators and Businesses Need to Know in 2026 – Technopolicy, and the resource footprint of AI systems is examined in AI And Water: The Hidden Environmental Cost — How Much Water Does AI Consume In 2026? – Technopolicy.
Frequently asked questions
Is the joint regulator guidance on generative AI binding?
No. The guidance is non-binding, but it interprets existing, binding privacy laws, so ignoring it carries risk under those laws.
How does AIDA’s approach compare with the EU AI Act?
Both are risk-based. AIDA focused on high-impact systems, while the EU AI Act regulates high-risk systems and is already framed around concrete obligations such as human oversight and documentation.
Which department drafted AIDA?
The federal Department for Innovation Science and Economic Development (ISED) drafted it, and ISED’s companion document described the framework as the first step towards a new regulatory system.
Does Ontario’s rule cover every use of AI by employers?
No. It applies to job postings where AI is used to screen applicants, and it requires a statement disclosing that use.
