# How is Canada regulating AI after the AI and Data Act died?

Date: 2026-02-21 · Author: Robert Scales · https://guidetoartificialintelligence.com/en/learn/canada-regulating-ai-after-ai-data-act/

**Answer:** Canada has no AI-specific law: the Artificial Intelligence and Data Act died with Bill C-27 when Parliament was prorogued in January 2025, and Ottawa has said it will not revive it as written. For now, AI in Canada is governed by existing laws, chiefly privacy law such as Québec's Law 25, plus a voluntary federal code of conduct.

Canada once looked set to be among the first countries with a national AI law. The Artificial Intelligence and Data Act, known as AIDA, was part of Bill C-27, the Digital Charter Implementation Act, 2022, which also proposed a new federal privacy law. The bill never finished its passage through Parliament. When Parliament was prorogued in January 2025 (a formal end to the session, which wipes out bills that have not passed), C-27 died with it.

A year later, there is still no federal AI statute. That does not mean AI is unregulated. It means the rules come from laws that were not written with AI in mind, from a voluntary code, and in Québec from a privacy law that speaks directly to automated decisions.

## What AIDA would have done

AIDA aimed at "high-impact" AI systems, those that could seriously affect people's lives. According to the federal government's description, businesses responsible for such systems would have had to identify and reduce risks of harm and bias as they designed, built and deployed them, keep records, and monitor the systems once in use. The heavier the risk, the heavier the duties. Much of the detail was left to regulations to be written later, and a new AI and Data Commissioner would have supported the minister in enforcing it.

## Where Ottawa stands now

Under Prime Minister Mark Carney, Canada has a Minister of Artificial Intelligence and Digital Innovation, Evan Solomon. He has said he will not bring back AIDA as written, though some of its ideas may carry forward, and he describes the approach he wants as "light, tight, right," meaning rules that avoid holding back Canadian companies.

In October 2025, speaking at a conference in Montréal, he said he would introduce legislation on data privacy, mentioning data transfers, the chain of custody for data, children's sensitive information and deepfakes (AI-generated imitations of real people). An AI task force ran a 30-day consultation sprint in the fall to help renew Canada's AI strategy, and the minister said thousands of people had filled in the public questionnaire. As of this week, neither that bill nor the renewed strategy has been tabled or published.

What does exist federally is a voluntary code of conduct for companies that develop and manage advanced generative AI systems, announced in September 2023. It gives Canadian companies a shared set of standards they can choose to adopt, and a way to show they develop and use generative AI responsibly. It is voluntary by design, meant to fill the gap until formal regulation arrives.

## Québec: the most concrete rules in the country

Québec's Law 25, adopted in September 2021 and phased in from 2022 to 2024, modernized the province's privacy law for businesses and public bodies. It is not an AI law, but several of its provisions apply directly to AI systems that use personal information. Here is a worked example of how it applies to an ordinary business decision.

| Scenario at a Québec business | Law 25 provision that applies |
|---|---|
| An online lender's system approves or refuses loans with no human involved | The person must be told the decision was automated and, on request, given the information and main factors used; they can ask a staff member to review it (s. 12.1) |
| A store uses software that profiles shoppers' preferences or behaviour | Customers must be told in advance that such technology is used (s. 8.1) |
| The business sends customer data to an AI service hosted outside Québec | A privacy impact assessment is required before the data is communicated (s. 17) |
| A new AI tool is built into a system that handles personal information | A privacy impact assessment is required for the project (s. 3.3) |

Penal fines for businesses can reach $25 million or 4% of worldwide turnover, whichever is greater. The Commission d'accès à l'information, Québec's privacy regulator, enforces the law.

> **Try it:** Pick one AI tool your workplace uses. Write down three facts: what personal information goes into it, where the provider processes that data, and whether any decision about a person is made without a human. Those three answers show which rules above are likely to matter.

## What rules apply to businesses today?

In short: the laws you already had. A business using AI in Canada must follow privacy law, federal or provincial depending on where and how it operates, along with consumer protection, human rights and employment law, which apply whatever tool produced a decision. Those laws look at what was done to people, not at which tool did it.

In Québec, the obligations are more specific, as the table shows: transparency about automated decisions and profiling, impact assessments before sending personal data elsewhere, and a person in charge of protecting personal information. Businesses elsewhere in Canada face less AI-specific detail but the same general principles: collect only what you need, say what you do with it, and protect it.

Beyond the law, the voluntary code offers a ready-made checklist for companies that build generative AI. And because the federal government has said new privacy legislation is coming, it is sensible to document now which AI tools you use, what data they touch and who is accountable for them.

This is general information, not legal advice. For a specific situation, a lawyer or the relevant privacy commissioner's guidance is the right next step.

## Sources

- Evan Solomon teases new AI laws as experts warn Canada is behind international peers: https://betakit.com/evan-solomon-teases-new-ai-laws-as-experts-warn-canada-is-behind-international-peers/
- Artificial Intelligence and Data Act: https://ised-isde.canada.ca/site/innovation-better-canada/en/artificial-intelligence-and-data-act
- Bill 64 (2021, chapter 25): An Act to modernize legislative provisions as regards the protection of personal information: https://www.publicationsduquebec.gouv.qc.ca/fileadmin/Fichiers_client/lois_et_reglements/LoisAnnuelles/en/2021/2021C25A.PDF