Canada AI Regulation & Governance

ISED's Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, effective from 27 September 2023, commits signatory developers and managers of advanced generative AI systems to risk-management measures but creates no statutory obligation.

Derived: Probable Canada's proposed horizontal AI statute, the Artificial Intelligence and Data Act (Part 3 of Bill C-27), died when Parliament was prorogued on 6 January 2025, and no successor AI act had been introduced federally as at the run date.

Derived: Probable AIDA (Part 3 of Bill C-27), which would have created Canada's first comprehensive private-sector AI statute, died on the Order Paper when Parliament was prorogued on 6 January 2025, and as of the run date no successor AI act had been introduced.

Derived: Probable Under article 12.1 of Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, an enterprise that renders a decision based exclusively on automated processing of personal information must inform the individual concerned and allow them to submit observations.

Bill C-36 (Protecting Privacy and Consumer Data Act), which would repeal PIPEDA Part 1 and create the Digital Safety and Data Protection Commission of Canada, had its first reading on 15 June 2026 and remained pending second reading as of the run date.

Derived: Probable Canada's proposed Artificial Intelligence and Data Act (AIDA) died on the Order Paper when Parliament was prorogued on 6 January 2025, and no successor AI statute has been introduced, so Canada has no horizontal AI statute in force.

AIDA (Bill C-27 Part 3) died on prorogation on 6 January 2025 and no successor horizontal AI statute has been introduced.

Derived: Probable AIDA (Bill C-27 Part 3) died on the Order Paper when Parliament was prorogued on 6 January 2025, and no successor AI act has been introduced.

Derived: Probable AIDA (Part 3 of Bill C-27), which would have created Canada's first comprehensive private-sector AI statute, died on the Order Paper when Parliament was prorogued on 6 January 2025, and as of the run date no successor AI act had been introduced.

Derived: Probable AIDA (Bill C-27 Part 3) died on the Order Paper when Parliament was prorogued on 6 January 2025, and no successor AI act has been introduced.

Manitoba prohibited personalized algorithmic pricing toward Manitoba consumers without consent under an amendment to the Business Practices Act, Royal Assent 1 June 2026.

Derived: Probable AIDA (Part 3 of Bill C-27), which would have created Canada's first comprehensive private-sector AI statute, died on the Order Paper when Parliament was prorogued on 6 January 2025, and as of the run date no successor AI act had been introduced.

Derived: Probable Existing federal automated decision systems developed or procured prior to 24 June 2025 have until 24 June 2026 to comply with the updated requirements of the Directive on Automated Decision-Making.

Derived: Probable Under article 12.1 of Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, an enterprise that renders a decision based exclusively on automated processing of personal information must inform the individual concerned and allow them to submit observations.

Derived: Probable A joint investigation by Canada's federal Privacy Commissioner with Quebec's CAI and the British Columbia and Alberta commissioners (PIPEDA Findings #2026-002) found that OpenAI's usage policies do not permit automating high-stakes decisions in employment, financial or essential government-service contexts without human review, but do not affirmatively prohibit using its outputs to support decision-making in those areas.

The Directive on Automated Decision-Making requires a federal institution to complete and release an Algorithmic Impact Assessment, classifying the automated decision system into one of four impact levels with scaled mitigation requirements, before the system goes into production.

Derived: Probable AIDA (Bill C-27 Part 3) died on the Order Paper when Parliament was prorogued on 6 January 2025, and no successor AI act has been introduced.

Federal institutions must complete an Algorithmic Impact Assessment before putting an automated decision system into production, under the Directive on Automated Decision-Making.

The Directive on Automated Decision-Making requires institutions to give affected individuals notice of automation, publish an explanation, and provide recourse proportional to impact level.

Quebec's Law 25 (art. 12.1), in force since 22 September 2023, requires an enterprise to notify an individual when a decision about them is made exclusively through automated processing and to allow a review request.

ISED's Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, effective from 27 September 2023, commits signatory developers and managers of advanced generative AI systems to risk-management measures but creates no statutory obligation.

Derived: Probable AIDA (Part 3 of Bill C-27), which would have created Canada's first comprehensive private-sector AI statute, died on the Order Paper when Parliament was prorogued on 6 January 2025, and as of the run date no successor AI act had been introduced.

ISED's Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, effective from 27 September 2023, commits signatory developers and managers of advanced generative AI systems to risk measures but creates no statutory obligation and binds only signatories.

ISED's Voluntary Code of Conduct on advanced generative AI is a non-binding instrument in force since 27 September 2023, binding only its signatories.

Derived: Probable AIDA (Bill C-27 Part 3) died on the Order Paper when Parliament was prorogued on 6 January 2025, and no successor AI act has been introduced.

ISED's Voluntary Code of Conduct, effective 27 September 2023, commits signatory developers/managers of advanced generative AI systems to risk measures but creates no statutory obligation.

Derived: Probable AIDA (Bill C-27 Part 3) died on the Order Paper when Parliament was prorogued on 6 January 2025, and no successor AI act has been introduced.

Derived: Probable OSFI's Guideline E-23 on Model Risk Management, published 11 September 2025, extends model-risk governance expectations explicitly to AI/ML models used by federally regulated financial institutions and takes effect 1 May 2027.

Derived: Probable Manitoba's Public Sector Artificial Intelligence and Cybersecurity Governance Act received Royal Assent on 1 June 2026 but was not yet in force as of the run date, pending proclamation and implementing regulations.

Derived: Probable Although Ontario's Enhancing Digital Security and Trust Act's core framework took effect on 29 January 2025, no regulation prescribing the AI uses or public-sector entities bound by it had been made as of the run date, leaving its four AI duties inoperative in practice.

The federal Directive on Automated Decision-Making applies to automated decision systems in production used by federal institutions to make or assist administrative decisions, excluding research and test-environment systems.

Derived: Probable OSFI's final Guideline E-23 on Model Risk Management, taking effect 1 May 2027, captures all models used by federally regulated financial institutions, including AI, machine learning and generative AI tools, and requires enterprise-wide model inventory and risk-based governance.

Derived: Probable Manitoba's Public Sector Artificial Intelligence and Cybersecurity Governance Act applies to prescribed public sector entities and AI systems used in prescribed circumstances, with substantive transparency and accountability content left to regulations not yet made.

The federal Directive on Automated Decision-Making applies to production automated decision systems used by federal institutions for administrative decisions, excluding research and test systems.

Existing federal automated decision systems have until 24 June 2026 to comply with the Directive's updated requirements.

OSFI's Guideline E-23 on model risk management, covering AI/ML models at federally regulated financial institutions, takes effect on 1 May 2027.

Manitoba's Public Sector AI and Cybersecurity Governance Act received Royal Assent on 1 June 2026 but is not yet in force.

Ontario's EDSTA has been in force since 29 January 2025, but its AI-specific duties remain inoperative because no prescribing regulation has been made.

Federal institutions must complete an Algorithmic Impact Assessment before putting an automated decision system into production, under the Directive on Automated Decision-Making.

Manitoba's Public Sector Artificial Intelligence and Cybersecurity Governance Act received Royal Assent on 1 June 2026 but is not yet in force pending proclamation and regulations.

Manitoba prohibited personalized algorithmic pricing toward Manitoba consumers without consent under an amendment to the Business Practices Act, Royal Assent 1 June 2026.

Ontario's Enhancing Digital Security and Trust Act took effect 29 January 2025, but its AI-specific obligations remain inoperative pending regulations prescribing covered uses.

OSFI's final Guideline E-23 on model risk management, published 11 September 2025, takes effect 1 May 2027 and explicitly covers AI/ML models at federally regulated financial institutions.

The Government of Canada published a minimum-viable-product AI transparency register disclosing federal AI systems on 28 November 2025.

OSFI's final Guideline E-23 extends model risk management expectations to AI/ML models used by federally regulated financial institutions, taking effect 1 May 2027.

The Government of Canada published a Minimum Viable Product AI Register in November 2025 and a What We Heard Report on it in September 2026.

The Directive on Automated Decision-Making requires federal institutions to publish information on the effectiveness and efficiency of an automated decision system in meeting program objectives, on the Open Government Portal, on a periodic basis post-deployment.

The Government of Canada published a minimum-viable-product AI transparency register disclosing federal AI systems on 28 November 2025.

Derived: Probable Canada's proposed Artificial Intelligence and Data Act (AIDA) died on the Order Paper when Parliament was prorogued on 6 January 2025, and no successor AI statute has been introduced, so Canada has no horizontal AI statute in force.

Derived: Probable AIDA (Bill C-27 Part 3) died on the Order Paper when Parliament was prorogued on 6 January 2025, and no successor AI act has been introduced.

Derived: Probable Quebec's Law 25 empowers a CAI-designated person to impose administrative monetary penalties of up to C$10 million or 2% of worldwide turnover (whichever is greater) for breach of the automated-decision disclosure duty, with a separate penal-offence track reaching C$25 million or 4% of worldwide turnover.

Derived: Probable A joint investigation by Canada's federal Privacy Commissioner with Quebec's CAI and the British Columbia and Alberta commissioners (PIPEDA Findings #2026-002) found that OpenAI's usage policies do not permit automating high-stakes decisions in employment, financial or essential government-service contexts without human review, but do not affirmatively prohibit using its outputs to support decision-making in those areas.

A CAI-designated person has power to impose administrative monetary penalties for breach of Quebec's automated-decision disclosure duty.

Breach of Quebec's automated-decision disclosure duty can draw an administrative penalty up to CAD $10 million / 2% of turnover, or a penal fine up to CAD $25 million / 4% of turnover.

Derived: Probable The federal Privacy Commissioner, with Quebec's CAI and the BC and Alberta commissioners, found in a joint investigation that an AI provider's usage policies do not affirmatively prohibit using its outputs to support high-stakes decisions in employment, financial or government-service contexts.

Derived: Probable Existing federal automated decision systems developed or procured prior to 24 June 2025 have until 24 June 2026 to comply with the updated requirements of the Directive on Automated Decision-Making.

Derived: Probable OSFI's Guideline E-23 on Model Risk Management, published 11 September 2025, extends model-risk governance expectations explicitly to AI/ML models used by federally regulated financial institutions and takes effect 1 May 2027.

Derived: Probable Manitoba's Public Sector Artificial Intelligence and Cybersecurity Governance Act received Royal Assent on 1 June 2026 but was not yet in force as of the run date, pending proclamation and implementing regulations.

Manitoba's Public Sector Artificial Intelligence and Cybersecurity Governance Act received Royal Assent on 1 June 2026 but is not yet in force pending proclamation and regulations.