Detailed overview
Canada does not currently have an enacted comprehensive federal AI statute equivalent to the EU AI Act. The proposed Artificial Intelligence and Data Act, known as AIDA, was included in Bill C-27, but the official parliamentary record shows that Bill C-27 did not complete the legislative process during the 44th Parliament. AIDA should therefore not be treated as an operative AI law unless new legislation is introduced and enacted.
Voluntary federal framework
Canada's current federal AI framework relies on voluntary governance instruments, public-sector AI policy, existing privacy and human-rights laws, consumer and competition rules, and sector-specific regulation. The federal government has also supported the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, sometimes described as Canadian guardrails for generative AI. This is a voluntary instrument rather than a statute.
The voluntary generative AI code addresses responsible development and deployment of advanced generative AI systems. It focuses on areas such as accountability, safety, fairness, transparency, human oversight, validity, robustness, privacy and security. Organisations that develop or deploy advanced generative AI can use the code to structure internal governance, risk management, testing, documentation and public-facing transparency.
Canadian AI Safety Institute
Canada has also established the Canadian AI Safety Institute. Its role is connected with AI safety research, evaluation, standards and coordination on advanced AI risks. This reflects Canada's policy focus on safe and responsible AI, even though a comprehensive federal AI Act has not yet entered into force.
Existing-law overlays
Where AI processes personal information, Canadian privacy laws may apply. Where AI affects employment, credit, insurance, consumer services, competition, healthcare or public administration, additional rules may arise under federal, provincial or sector-specific law.
Penalties
Canada does not currently have one AI-specific penalty table equivalent to the EU AI Act. Penalties depend on the underlying law breached, such as privacy, consumer protection, competition, employment, human-rights or sectoral regulation. AIDA-style penalties should not be presented as active law unless and until a new AI bill is enacted.
Practical requirements & details
Sourced from the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems (ISED, Sept 2023), PIPEDA + provincial privacy laws, the Office of the Privacy Commissioner's Principles for Responsible, Trustworthy and Privacy-Protective Generative AI, the Directive on Automated Decision-Making (Treasury Board, public sector) and the Canadian AI Safety Institute.
Voluntary Code of Conduct (generative AI)
- Six commitments: Accountability, Safety, Fairness and Equity, Transparency, Human Oversight and Monitoring, Validity and Robustness.
- Signatories include major Canadian AI developers and integrators.
- Not legally binding, but referenced in procurement and supplier due-diligence.
Privacy law overlay (PIPEDA + provincial)
- Apply lawful basis, consent, accountability, limiting collection, accuracy, safeguards, openness, individual access, challenging compliance.
- OPC principles add: legal authority, appropriate purposes, necessity/proportionality, accuracy, transparency, individual access, accountability.
- Quebec Law 25 (effective 2023) requires AIA for systems with significant impact, explanation rights, and stricter automated-decision controls.
Public-sector AI — Directive on Automated Decision-Making
- Mandatory for federal departments using automated decision systems affecting clients.
- Four Algorithmic Impact Assessment (AIA) levels with proportionate mitigations.
- Higher levels require notice to clients, plain-language explanation, recourse, human-in-the-loop, peer-review of system design.
Canadian AI Safety Institute
- Established 2024; coordinates AI-safety research, evaluation and standards on advanced AI risks.
Penalties
- AIDA not in force (Bill C-27 did not pass).
- PIPEDA: up to CAD 100,000 per offence for knowing breaches; CPPA proposals would have raised this.
- Quebec Law 25: up to CAD 25 million or 4% worldwide turnover.
- Sectoral fines under consumer, competition, employment law as applicable.