No single AI regulator exists — enforcement is split across privacy commissioners, the Competition Bureau, and provincial bodies, each covering a different slice of what AI actually does.
Short answer
Whichever regulator already covered the underlying activity before AI was involved. The Office of the Privacy Commissioner of Canada and its provincial counterparts enforce how personal information is handled; the Competition Bureau enforces what a business claims to the public; Québec's privacy regulator enforces its own automated-decision rule; and Canada's anti-spam law is enforced jointly by three federal bodies working together. There is no single “AI regulator” that owns all of it.
The Office of the Privacy Commissioner of Canada enforces PIPEDA against most Canadian businesses, and it does not operate alone on AI specifically: it co-authored its generative-AI principles jointly with its counterparts in every province and territory, and it has an open, active file in this space — “an open investigation relating to a particular generative AI service”. Québec is its own regime rather than a PIPEDA satellite: the Commission d'accès à l'information enforces Law 25's automated-decision provisions, which require telling a person when a decision about them is based exclusively on automated processing, a duty PIPEDA does not have in the same form. Alberta and British Columbia have their own provincial privacy regulators as well, and a business operating across provinces can face more than one of them at once.
If the issue is what an AI-related claim tells the public — that a product performs better because of AI, or that content is genuine when it was generated — the Competition Bureau is the body with jurisdiction, under the Competition Act's misleading-representation and performance-claim provisions. Its own discussion paper on AI and competition says plainly there is “still no universal definition for AI”, and that the Bureau “engages with the Office of the Privacy Commissioner (OPC)” to address AI's overlap with their separate mandates — a structural sign that AI enforcement in Canada is coordinated across agencies rather than concentrated in one.
Canada's anti-spam law is enforced jointly, with the Canadian Radio-television and Telecommunications Commission handling the telecommunications side, the Competition Bureau handling false or misleading commercial electronic messages, and the OPC handling any personal-information angle. The statute itself, the Electronic Commerce Protection Act, prohibits sending a commercial electronic message without consent — a rule that applies exactly the same way whether an AI tool drafted the message, personalized it, or selected the recipient list.
For the deeper question of whether AI use itself is even lawful in the first place, see this companion answer.
A diligence review maps exposure across the regulators that actually matter.
