AI rules: US, Canada, EU
The rules that touch people and small businesses using AI, in plain language and with dates. This is general information, not legal advice.
Version 1.0 ·
Status as of October 28, 2026. Laws change quickly, so each line gives a date. This page is general information to help you find your way, not legal advice: for a decision that matters, read the official text or ask a lawyer.
Canada and Quebec
| Rule | Who it applies to | What it asks | Status |
|---|---|---|---|
| Quebec’s Law 25 (private-sector privacy law) | Every business that handles personal information in Quebec | Tell people when a decision about them is made only by an automated system, and explain it on request (section 12.1); assess privacy before adopting a tool that handles personal information (section 3.3); assess and sign an agreement before sending personal information outside Quebec (section 17) | In force, fully since September 22, 2024 |
| PIPEDA (federal privacy law) | Businesses in the rest of Canada that collect personal information in commercial activity | Consent, limited use and safeguards, including when the data goes into an AI tool | In force |
| Ontario job postings rule | Ontario employers with 25 employees or more | Say in public job postings if AI is used to screen, assess or select applicants | In force since January 1, 2026 |
| Federal AI law (AIDA, part of Bill C-27) | Was meant for “high-impact” AI systems | — | Died when Parliament was prorogued on January 6, 2025; not reintroduced |
| Bill C-36, Protecting Privacy and Consumer Data Act | Businesses across Canada | A new private-sector privacy law, with rules on automated decisions | Introduced June 15, 2026; at second reading, not law |
| Bill C-34, Safe Social Media Act | Online services, including AI chatbots used by children | Would create a Digital Safety Act | Introduced June 10, 2026; at second reading, not law |
| AI for All, the national AI strategy | Government policy | Federal goals for AI adoption, trust and computing power | Launched June 4, 2026; a policy, not a law |
| Directive on Automated Decision-Making | Federal government departments only | Impact assessment, notice and human review for automated decisions | In force; a useful model for any organization |
United States
| Rule | Who it applies to | What it asks | Status |
|---|---|---|---|
| Executive Order 14365 on a national AI policy framework | Federal agencies | Directs the government to challenge state AI laws it sees as too burdensome | Signed December 11, 2025; an executive order cannot by itself cancel a state law |
| Federal ban on state AI laws | — | A 10-year moratorium was proposed in 2025 | Removed by the Senate, 99–1, on July 1, 2025; no federal law since |
| California SB 53 (Transparency in Frontier AI Act) | Developers of the largest AI models | Publish a safety framework, report serious incidents, protect whistleblowers | In force since January 1, 2026 |
| Utah’s AI consumer protection law (amended by SB 226, 2025) | Businesses using generative AI with Utah consumers | Disclose AI use when a consumer asks, and up front in regulated professions and high-risk exchanges | In force; set to end July 1, 2027 unless extended |
| Illinois Human Rights Act amendment (Public Act 103-0804) | Employers in Illinois | No discriminatory use of AI in hiring and employment decisions; notify employees | In force since January 1, 2026 |
| New York City Local Law 144 | Employers using automated hiring tools for jobs in New York City | Yearly bias audit and notice to candidates | Enforced since July 5, 2023 |
European Union
The AI Act (Regulation (EU) 2024/1689) applies to anyone who offers an AI system in the EU or whose AI output is used there, which can include a Canadian business selling to European customers. In 2026 the EU changed its timetable with Regulation (EU) 2026/1744, in force since July 27, 2026.
| Date | What applies |
|---|---|
| August 1, 2024 | The AI Act enters into force |
| February 2, 2025 | Banned practices (such as social scoring, manipulative AI and emotion recognition at work or school) and the duty to support AI literacy among staff |
| August 2, 2025 | Duties for makers of general-purpose AI models |
| August 2, 2026 | Transparency duties: people must know when they are talking to a chatbot, and deepfakes must be labelled. Providers of systems already on the market have until December 2, 2026 to mark AI-generated content |
| December 2, 2026 | New ban on AI systems made to generate intimate images without consent or child sexual abuse material |
| August 2, 2027 | General-purpose models released before August 2, 2025 must comply |
| December 2, 2027 | Rules for high-risk AI used in areas such as hiring, credit, education and essential services (moved from August 2, 2026) |
| August 2, 2028 | Rules for high-risk AI built into regulated products such as machinery, toys and medical devices |
Copyright cases to know
| Case | Where | What it is about | Where it stands |
|---|---|---|---|
| Bartz v. Anthropic | US federal court, California | Training Claude on books, including copies from pirate sites | Training was ruled fair use in June 2025, but the pirated copies went toward trial. Settled for a US$1.5 billion fund; final approval July 20, 2026; first payments expected by November 15, 2026 |
| Kadrey v. Meta | US federal court, California | Training Llama on books | Meta won on fair use for training in June 2025; a claim about sharing the files by torrent was left open |
| Thomson Reuters v. Ross Intelligence | US Court of Appeals for the Third Circuit | Copying legal summaries to train a competing legal search tool | Not fair use (September 29, 2026). The tool did not generate text and competed directly with the original |
| Thaler v. Perlmutter | US Supreme Court | Can an AI be the author of a work? | The Court declined the case on March 2, 2026: in the US, copyright needs a human author |
| Toronto Star and other Canadian publishers v. OpenAI | Ontario Superior Court of Justice | Using Canadian news to train ChatGPT | On November 7, 2025, the court largely rejected OpenAI’s argument that the case belonged elsewhere; no decision on the merits |
No court has said in general that training AI on other people’s work is legal or illegal. So far the answer depends on the facts: how the copies were obtained, and whether the AI competes with the original.
Sources
- LégisQuébec: Act respecting the protection of personal information in the private sector
- Office of the Privacy Commissioner of Canada: principles for generative AI
- Ontario: publicly advertised job postings
- Innovation, Science and Economic Development Canada: AIDA, LEGISinfo: Bill C-36 and Prime Minister: AI for All
- California SB 53, Utah SB 226, Illinois Public Act 103-0804 and New York City: automated employment decision tools
- EUR-Lex: AI Act, Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744
- Anthropic copyright settlement, Kadrey v. Meta order and Third Circuit: Thomson Reuters v. Ross
- US Supreme Court docket 25-449 (Thaler v. Perlmutter) and Toronto Star v. OpenAI, 2025 ONSC 6217