AI governance under Canadian federal and provincial privacy law

Canada regulates AI through the laws it already has. The federal attempt at an AI-specific statute, the Artificial Intelligence and Data Act, died with Bill C-27 on prorogation in January 2025. The national AI strategy, AI for All, announced by the Prime Minister on June 4, 2026, commits to modernizing privacy and online safety law rather than proposing a standalone AI act.

That puts privacy law at the centre of AI governance for most Canadian organizations, with public sector directives, financial regulation and workplace rules layered on top.

Federal privacy law applies to AI today

PIPEDA applies to private sector organizations that collect, use or disclose personal information in commercial activity. It contains no AI provision, but its ten fair information principles reach every AI system that handles personal information. In practice that raises a familiar set of questions.

• Purpose and consent. Has the organization identified why each AI system uses personal information, and does the consent people gave cover it? Reusing customer data to train or tune a model is where this most often goes wrong.
• Accountability. Who answers for personal information processed by an AI vendor on the organization’s behalf?
• Accuracy. Are inferences a model makes about people accurate enough for the decisions they feed?
• Openness and access. Can people find out how AI is used with their information, and see what it has inferred about them?

The federal, provincial and territorial privacy commissioners set out how these principles apply to generative AI in December 2023. Breaches of security safeguards through an AI system or vendor are reportable to the Office of the Privacy Commissioner where they create a real risk of significant harm.

Bill C-36, introduced on June 15, 2026, would replace PIPEDA’s privacy rules with the Protecting Privacy and Consumer Data Act. As introduced, it would require a general account of any automated decision system used to make predictions, recommendations or decisions that could have a legal or similarly significant effect on people, and an explanation of the outcome on request. It is at second reading and may change.

Provincial privacy laws, with Quebec going furthest

Alberta, British Columbia and Quebec have private sector privacy laws deemed substantially similar to PIPEDA, and organizations covered by them follow the provincial law for information handled within the province.

Quebec has the most developed rule on automated decisions. Section 12.1 of its private sector act, added by Law 25 and in force since September 22, 2023, requires an organization that makes a decision based exclusively on automated processing of personal information to tell the person no later than when it informs them of the decision. On request it must explain the information used, the reasons and principal factors behind the decision, and the right to correction, and give the person a chance to submit observations to someone who can review it. Law 25 also requires a privacy impact assessment for projects involving information systems that process personal information. The Commission d’accès à l’information enforces it.

Public sector AI is governed by directive

Federal institutions follow the Treasury Board Directive on Automated Decision-Making. Before an automated system that makes or supports administrative decisions goes into production, the institution completes and publishes an Algorithmic Impact Assessment, which sets an impact level from I to IV, and meets transparency, quality assurance, human involvement and recourse requirements that scale with it.

In Ontario, the Responsible Use of Artificial Intelligence Directive has applied to ministries and provincial agencies since December 1, 2024. It requires AI risk management across the AI lifecycle, an annual report of AI use cases and risks, a published list of use cases, and public disclosure where people interact with AI or AI affects decisions about them. Suppliers to either government should expect to be asked for the information these assessments need.

Financial institutions and the workplace

Federally regulated banks, insurers and trust and loan companies face OSFI Guideline E-23 from May 1, 2027. It treats AI and machine learning models as models, expecting an enterprise inventory, a risk rating for each and governance across the full life cycle, with particular attention to explainability, bias, autonomy and drift.

In the workplace, Ontario’s Employment Standards Act has required employers with 25 or more employees to disclose in publicly advertised job postings whether they use AI to screen, assess or select applicants since January 1, 2026.

What Canadian organizations can do now

The same groundwork serves the privacy laws in force, the public sector directives, OSFI and whatever Bill C-36 becomes.

1. Inventory every AI system and agent, including AI inside vendor products, with the personal information each uses and the decisions it touches.
2. Flag decisions based exclusively on automated processing, which trigger Quebec’s section 12.1 today and are the target of Bill C-36’s explanation duty.
3. Record purpose and consent for each system’s use of personal information, and check that your privacy policy describes it.
4. Run privacy and AI impact assessments for new systems. Quebec requires a privacy impact assessment for many of them, and OSFI expects a risk rating for every model.
5. Design a review route so a person can submit observations about an automated decision and have it looked at by someone with authority to change it.

Aicura’s register, data provenance, assessments, policies and oversight support this work, and Pro adds assessments against the NIST AI RMF and ISO/IEC 42001, the frameworks many Canadian organizations use alongside privacy law. Aicura gives support and guidance for your own judgement and your advisers’, and it does not decide how a privacy law applies to you.