Contact usGet started

Frameworks · Canada

AI governance frameworks and laws that apply in Canada

Canada has no AI-specific law in force. Organizations govern AI through federal and provincial privacy law, with Quebec's rules on automated decisions going furthest, while binding directives cover federal and Ontario public bodies and OSFI sets model risk expectations for financial institutions.

Who regulates AI here

Canada

Canada governs automated decisions in the federal public sector through a binding directive and impact assessment, with sector regulators setting expectations for industry.

LawPIPEDA and AIPIPEDA and the privacy commissioners' principles for generative AIHow PIPEDA and the privacy commissioners' generative AI principles apply to AI in Canada today, and what Bill C-36 would add for automated decision systems.PIPEDA in force. Commissioners' principles issued 7 December 2023. Bill C-36 at second readingPublic sector policyCanada Directive on Automated Decision-MakingDirective on Automated Decision-Making and the Algorithmic Impact AssessmentCanada's Directive on Automated Decision-Making binds federal institutions using automated decision systems, with a four-level Algorithmic Impact Assessment.In force, fourth-review amendments in effect since 24 June 2025Regulator guidanceOSFI Guideline E-23OSFI Guideline E-23, Model Risk Management (2027)OSFI Guideline E-23 sets model risk expectations for Canadian federally regulated financial institutions, including AI and ML models, from 1 May 2027.Final, effective 1 May 2027LawQuebec Law 25 automated decisionsQuebec private sector privacy act, section 12.1 on decisions based exclusively on automated processing (Law 25)Section 12.1 of Quebec's private sector privacy act, added by Law 25, requires notice of fully automated decisions, reasons on request and a chance of review.In force since 22 September 2023Voluntary frameworkCanada generative AI code of conductVoluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI SystemsCanada's voluntary code for advanced generative AI sets six principles with measures for developers and managers. What it asks of them and who has signed it.Voluntary, open for signature since September 2023Public sector policyOntario Responsible AI DirectiveOntario Responsible Use of Artificial Intelligence DirectiveOntario's Responsible Use of Artificial Intelligence Directive sets AI risk management, disclosure and reporting rules for ministries and provincial agencies.In effect since 1 December 2024LawOntario AI disclosure in job postingsOntario Employment Standards Act, AI disclosure in publicly advertised job postingsSince 1 January 2026, Ontario employers with 25 or more employees must state in public job postings when AI is used to screen, assess or select applicants.In force since 1 January 2026

All Canada frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in Canada

Frameworks elsewhere

Guides

Questions

Does Canada have an AI law?

No. The proposed Artificial Intelligence and Data Act died with Bill C-27 in January 2025. Bill C-36, introduced in June 2026, would modernize private sector privacy law and add duties for automated decision systems, but it does not include a standalone AI act and has not passed.

What is Canada's national AI strategy?

AI for All, announced by the Prime Minister on June 4, 2026. It has six pillars, starting with protecting Canadians and safeguarding democracy, and commits to modernizing federal privacy and online safety law.

Does the Directive on Automated Decision-Making apply to private companies?

No. It applies to federal institutions using automated systems to make or support administrative decisions. Vendors supplying those systems often meet its requirements through contract terms.

Does OSFI Guideline E-23 cover generative AI?

Yes. OSFI's definition of a model includes AI and machine learning methods without carving out generative AI, so a federally regulated institution using a large language model in a decision process should expect to treat it as a model from May 1, 2027.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us