Canada tried to legislate AI early and ended up with nothing on the books: AIDA, packaged inside Bill C-27, died at prorogation on 6 January 2025. That does not mean AI is unregulated in Canada. It means the rules live in the general law, privacy statutes first among them, with Quebec’s Law 25 imposing the only binding automated-decision rights in the country, and federal guidance filling gaps without teeth.
| Status | No dedicated federal AI statute (AIDA not enacted) |
|---|---|
| Binding today | PIPEDA; Quebec Law 25; human rights codes; sector rules |
| Soft law | Voluntary Code of Conduct on generative AI (2023); OPC principles |
| Background | ISED AIDA page |
What binds AI systems in Canada right now
Privacy law. Training data, prompts, and outputs containing personal information engage PIPEDA: identified purposes, valid consent, appropriateness under section 5(3), and safeguards. The Clearview AI finding settled that “publicly available” scraped data is not consent-free. The OPC has published principles for generative AI and joined G7 and global regulator statements pressing developers on lawful basis and transparency.
Quebec Law 25. The hard edge: exclusively automated decisions using personal information trigger mandatory disclosure, explanation on request (what data, what reasons, what factors), correction rights, and human review, in force since September 2023 and backed by penalties up to CAD 25 million or 4% of worldwide turnover, detailed in the Law 25 guide.
Everything else. Human rights legislation reaches discriminatory AI outcomes in hiring, housing, and services. OSFI’s model-risk guidance binds financial institutions. Product liability and negligence apply to AI-caused harm. Employment law constrains algorithmic management.
The AIDA design, and what returns
AIDA’s architecture (high-impact classification, risk assessment and mitigation, monitoring, public disclosure, incident reporting, a commissioner, and criminal provisions for reckless or fraudulent AI use) tracked the EU’s risk-based approach while leaving most substance to regulations, the criticism that stalled it in committee. Whether Canada reintroduces an AIDA-like statute or pivots to a lighter framework, the compliance assets that transfer are the same ones the EU AI Act demands: data governance records, impact assessments (see the combined DPIA/FRIA approach), human oversight design, and incident processes.
If your AI touches consumer-facing decisions, start with the binding layer: Quebec disclosure duties and privacy-law consent quality, and check what your digital properties collect for models and analytics with a free scan.