The Artificial Intelligence and Data Act died with Bill C-27 in January 2025 and has never come back. That is the part most summaries get right. The part they miss is that four instruments already govern automated decisions in Canada — and in May 2026 four privacy regulators applied the law Canada already had to the company behind ChatGPT.
Plain-language summary, not legal advice. Every instrument, date and status on this page was checked against a primary or first-party source on 2026-08-31.
On 6 May 2026 the Office of the Privacy Commissioner of Canada published PIPEDA Findings #2026-002, joint findings with the privacy commissioners of Québec, British Columbia and Alberta. The offices found that OpenAI had failed to obtain valid consent for the personal information it collected from the web and from user interactions, and identified failures on transparency, accuracy, retention and access. OpenAI committed to ten measures and the matter was recorded as conditionally resolved.
The statutes applied were PIPEDA, Québec's Private Sector Act, PIPA (British Columbia) and PIPA (Alberta) — every one of them written before the current generation of AI existed, and none of them an AI law. Read plainly: waiting for Canada to pass an AI Act is not a compliance strategy. The regulators did not wait.
Source: Office of the Privacy Commissioner of Canada, PIPEDA Findings #2026-002.
There is no single statute to point at, which is precisely why this is hard to look up. These are in force now. Read the two you are most likely to be caught by first — Québec if you make decisions about people, Ontario if you hire.
Where a decision is based exclusively on automated processing of personal information, the person must be told so no later than when they are told the decision — and on request, given the information used, the reasons and the principal factors and parameters that led to it, the right to have that information corrected, and the right to submit observations to a member of staff able to review the decision.
In force 22 September 2023. Applies to: Any private-sector enterprise making a decision about a person in Québec. Act respecting the protection of personal information in the private sector, CQLR c P-39.1, s. 12.1
Where artificial intelligence is used to screen, assess or select applicants, the posting must say so. Ontario's own guidance is that a detailed description is not required — stating that AI is used is enough.
In force 1 January 2026. Applies to: Ontario employers with 25 or more employees, on publicly advertised job postings. Employment Standards Act, 2000, s. 8.4; O. Reg. 476/24
A completed Algorithmic Impact Assessment before the system goes into production, with notice, explanation, human intervention and audit requirements scaled to the impact level it scores.
In effect since 2019; amended 24 June 2025, with existing systems given until 24 June 2026. Applies to: Federal institutions — and so, in practice, anyone selling them an automated decision system. Treasury Board of Canada Secretariat, Directive on Automated Decision-Making
A public body intending to use personal information in an automated system to generate content or to make decisions, recommendations or predictions must disclose that intention.
In force 11 June 2025. Applies to: Alberta public bodies. Protection of Privacy Act (Alberta) — The duty is confirmed by first-party and legal-sector sources; we could not verify a section number, so none is printed.
Consent, limits on collection and use, accuracy, retention, transparency and access rights — none of it written for AI, all of it applying to AI. This is the law the OpenAI investigation was decided under.
Long-standing. Applies to: Essentially every organisation handling personal information in Canada. PIPEDA; Québec's Private Sector Act; PIPA (British Columbia); PIPA (Alberta)
Discrimination on a protected ground is unlawful whether a person or a model produced the outcome. No technology defence is written into these statutes.
Long-standing. Applies to: Employers and service providers. Canadian Human Rights Act; the provincial human rights codes
Two bills would change all of this, and both are being described in the trade press as though they already had. Neither has passed. Both were at second reading in the House of Commons when this page was verified.
Would require organisations to disclose their use of an automated decision system and to give a person an explanation and a route to challenge the decision, overseen by a new commission with penalties reaching the greater of $10 million and 3% of global revenue.
First reading 15 June 2026 · at second reading. Would replace PIPEDA for the private sector. Source: Parliament of Canada, LEGISinfo.
Would enact a Digital Safety Act carrying a duty to protect children, crisis-intervention duties on AI chatbot services and a prohibition on a chatbot presenting itself as human, policed by a new Digital Safety Commission of Canada.
First reading 10 June 2026 · at second reading. Would cover regulated services, including AI chatbot services. Source: Parliament of Canada, LEGISinfo.
Canada's one attempt at a general AI statute. It reached committee and went no further; the session ended on 6 January 2025 and every bill on the order paper died with it. It has not been reintroduced.
Part 3 of Bill C-27, 44th Parliament, 1st session. Died with the session, 6 January 2025. Source: Parliament of Canada, LEGISinfo.
If a summary tells you Canada has an AI Act, or gives you a compliance date for one, check it against Parliament’s own bill status page. It is public, free, and settles the question in about a minute.
None of these instruments turns on where you are incorporated. They turn on whose decisions you are making — which is why a US company with a Toronto sales team and a Montreal customer list is inside three of them.
Credit, eligibility, pricing, hiring, renewal. If a decision runs on automated processing alone, section 12.1 attaches — and has since 2023.
If AI screens, assesses or selects applicants, the posting has to say so. Resume ranking and automated shortlisting both count.
Then federal or provincial privacy law already applies to whatever your models do with it. That is the law the OpenAI findings were made under.
Any yes? You are already inside Canadian AI regulation, whatever Parliament does next. All three no? You still need an AI policy — just not this one. And if Bill C-36 passes, question three becomes the one that reaches almost everybody.
Read the four automated-decision instruments side by side and they converge on the same evidence. Québec words it as notice and review, Ontario as a line in a posting, the federal Directive as an assessment — but a regulator asking any of them is asking to see the same four things.
An inventory naming every tool that touches a decision about a person, what it does, what personal information it uses, and a single accountable owner — a person, not a department.
A record that someone looked at what the tool could do to a person before it went live, and what was done about what they found. The federal Directive calls this an Algorithmic Impact Assessment; privacy regulators reach for the same evidence by another name.
Québec wants notice at the moment of the decision and an explanation on request. Ontario wants a line in the job posting. Both are provable or they are not, and a screenshot is not a record.
Québec gives the person a right to submit observations to a member of staff able to review the decision. That right is only real if the reviewer could actually change the outcome — and a rationale that can be rewritten afterwards is worth nothing.
Canada is a jurisdiction in the control library — three authored controls covering federal and provincial privacy duties, automated-decision transparency and algorithmic impact assessments, and human rights. It is included from Pro+. Enable the jurisdiction and every instrument comes with it, including the ones that pass after you subscribe.
Take the free scorecard →Every clause the platform writes cites one of these. The system retrieves controls; it never invents them — which is what makes the output defensible to an auditor rather than merely plausible.
Fifteen questions, about ten minutes, free. No account and no sales call. You get a banded score and a named list of the gaps behind it.
This page is a plain-language summary of Canadian federal and provincial instruments governing artificial intelligence and automated decision-making, verified against primary and first-party sources on 2026-08-31. It is not legal advice, it is not a substitute for advice from Canadian counsel, and GOVERNBOX.ai does not promise a regulatory outcome. GOVERNBOX.ai is a product of Gradient Descent LLC, an independent commercial company that is not affiliated with, endorsed by, or sponsored by the Government of Canada, any provincial government, or any privacy commissioner.