This is a question with a precise, checkable answer, and it changes depending on exactly how it’s asked. Is there a Canadian law specifically about AI, or does any Canadian law apply to a business using AI? Those have different answers, and conflating them is the single most common way this topic gets written up wrong.
Key takeaways
Start with the precise version of the question: is there a Canadian statute whose specific subject is artificial intelligence, currently in force? As of this writing, no. That is a narrower and more useful claim than either Canada has no AI regulation or Canada is about to regulate AI — both of which overstate what the public record actually supports.
Parliament’s own bill-tracking page, LEGISinfo, records Bill C-27 — “An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts,” short title the Digital Charter Implementation Act, 2022 — as follows, read from the page on August 27, 2026: “The information below relates to a prior session,” specifically “C-27, 44th Parliament, 1st session — Monday, November 22, 2021, to Monday, January 6, 2025,” with current status “At consideration in committee in the House of Commons” and latest recorded activity “second reading and referral to committee on Monday, April 24, 2023.” First reading completed June 16, 2022; report stage and third reading are both listed as not reached; the Senate never received it. This article deliberately does not state whether AIDA, the AI-specific part of that bill, is or is not currently in force — the source above is quoted precisely, and dated, because that determination is not something to guess at from a status page, and no authoritative source states it plainly either way as of the date given.
The absence of an AI-specific statute does not mean AI use is unregulated in Canada — it means AI use is governed by general-purpose laws that were not written with AI specifically in mind but apply to it anyway. The clearest example is the federal private-sector privacy statute. PIPEDA s.5(1) requires every organization to comply with the obligations in Schedule 1, and Schedule 1’s clause 4.1.3 states directly: “An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.” That single clause already answers the practical question most businesses are really asking when they wonder whether it is legal to put customer data into an AI tool. The AI vendor processing the data does not inherit the compliance burden, and does not relieve the organization of it either.
Québec’s Law 25 adds a specific, additional obligation that PIPEDA does not contain in the same form: a right to be informed when a decision is based exclusively on automated processing of personal information, and a right to have that decision explained and to submit observations. This is a genuinely separate Québec-specific rule, not a provincial restatement of PIPEDA, and it should never be described as if it applied nationally — the same is true of any suggestion that PIPEDA covers the same ground Law 25 does, since it does not.
The statute itself: section 12.1 of the Act respecting the protection of personal information in the private sector requires that a business using personal information “to render a decision based exclusively on an automated processing” must inform the person concerned “not later than at the time it informs the person of the decision”, and on request disclose the information used, the reasons and factors, and give the person “the opportunity to submit observations” to staff able to review it. Unlike the guidance layer covered next, this one has teeth: section 90.12 caps the administrative monetary penalty at $50,000 for a natural person and, in other cases, $10,000,000 or 2% of worldwide turnover, whichever is greater.
Two further sources are frequently mistaken for law and are not. Canada’s federal, provincial and territorial privacy commissioners jointly published Principles for responsible, trustworthy and privacy-protective generative AI (dated May 6, 2025 on the page), which interpret how existing privacy law — PIPEDA and its provincial equivalents — applies to generative AI specifically; it is guidance issued under existing authority, not a new statute. Separately, ISED’s Voluntary Code of Conduct, dating to September 2023, is exactly what its name says: voluntary, binding only its signatories, and explicit that it “does not in any way change existing legal obligations.” Neither document is a law; both describe how existing law and voluntary practice apply while a dedicated statute remains unsettled.
A business asking whether it can get in legal trouble for how it uses AI in Canada should look at PIPEDA (and Law 25 in Québec) first — those are the enforceable rules that already apply, regardless of what happens to any future AI-specific bill. A business asking whether there is a Canada-specific AI compliance regime the way the EU has the AI Act should read the LEGISinfo page above directly rather than accept a secondhand claim about it, because that status can change and the exact wording matters. The two questions have different, both-checkable, answers, and this article has sourced both.
The claim to avoid, and the one that’s defensible
Avoid: “Canada’s AI Act requires…” or “AIDA came into force in…” — neither is supported by the public record as of this reading. Defensible: No dedicated federal AI statute is currently in force; general privacy law (PIPEDA, and Law 25 in Québec) already applies to AI use; a voluntary federal code exists alongside that law. The second version is longer because it is actually checkable against a source, sentence by sentence.
Related: Canada’s voluntary AI code, explained.
How a due-diligence review treats this legal landscape when evaluating an AI-dependent business is covered on the AI due diligence hub.
This article does not state that it is or isn’t. What is verifiable is that Parliament’s own LEGISinfo page records Bill C-27 against a prior session, with committee referral on April 24, 2023 as its latest recorded activity — check that page directly for the current status.
No. General privacy law already applies — PIPEDA governs personal information processed by an AI tool nationally, and Québec’s Law 25 adds a separate automated-decision right that PIPEDA does not contain.
No — it is explicitly voluntary and states on its own page that it “does not in any way change existing legal obligations”. See our companion piece on the Code for what it does commit signatories to.
A short call is enough to separate what’s enforceable today from what’s still proposed.
