Artificial Intelligence and Data Act

The Artificial Intelligence and Data Act (AIDA) was Canada's initial attempt to create a comprehensive federal framework for regulating AI systems. Introduced as part of Bill C-27 in June 2022, its core objective was to ensure the responsible design, development, and deployment of AI systems that could significantly impact Canadians, balancing innovation with robust citizen protection.

AIDA adopted a risk-based approach, focusing on the potential impact of AI systems on individuals rather than just their technical specifications. This was intended to provide flexibility as AI technology evolved. The legislation aimed to hold businesses accountable for their AI activities, requiring them to implement governance mechanisms to address risks. However, despite parliamentary review, Bill C-27, including AIDA, did not become law and died on the Order Paper in January 2025.

AIDA provided crucial definitions to establish its regulatory scope. An "artificial intelligence system" was broadly defined as a technological system that, autonomously or partly autonomously, processes data related to human activities using techniques like machine learning to generate content, make decisions, recommendations, or predictions. This definition was designed to be adaptable to future AI advancements.

The legislation primarily focused on "high-impact systems," though the specific criteria for this designation were to be detailed in future regulations. Companion documents suggested these would include systems with the potential for serious physical or psychological harm, property damage, or substantial economic loss to individuals. Examples included systems affecting access to services, employment, biometric identification, or those critical to health and safety. "Harm" was explicitly defined to cover physical or psychological harm, property damage, or economic loss to an individual.

AIDA proposed a governance structure that granted significant authority to the Minister of Innovation, Science and Industry for administering and enforcing the Act. A key element was the planned establishment of an Artificial Intelligence and Data Commissioner's office.

This Commissioner was envisioned as a central hub of expertise, tasked with supporting the development of regulations and overseeing the Act's ongoing administration. Responsibilities would have included monitoring company compliance, ordering third-party audits, and sharing information with other regulatory bodies. The Commissioner's role was designed to evolve, initially focusing on education and assistance, and later expanding to include robust compliance and enforcement functions once the Act was fully in force, ensuring a dynamic regulatory response to AI advancements.

AIDA's core regulatory requirements centered on a risk-based approach. All persons involved with AI systems were mandated to assess whether their system qualified as "high-impact" and to maintain records of this assessment. For systems designated as high-impact, stricter obligations applied.

These obligations included establishing and continuously monitoring measures to identify, assess, and mitigate risks of harm or biased output. Transparency was also a critical element, requiring providers and operators of high-impact systems to publish plain-language descriptions of their systems on public websites. These descriptions were to cover the system's purpose, capabilities, limitations, and potential impacts. Furthermore, AIDA proposed prohibitions against specific harmful AI uses, such as knowingly using unlawfully obtained personal information for AI development or making an AI system available if it was known or reckless that it would cause serious harm or substantial economic loss.

The implementation of AIDA was designed to be a phased and agile process, acknowledging the rapid evolution of AI technology. Following the anticipated Royal Assent of Bill C-27, the government intended to conduct extensive consultations with a wide range of stakeholders, including industry, academia, civil society, and Canadian communities.

These consultations were crucial for developing the detailed regulations that would build upon AIDA's foundational framework. Key areas for regulatory development included precisely defining the criteria for high-impact systems, establishing standards and certifications to ensure AI systems met Canadian expectations, and detailing specific requirements for risk mitigation, transparency, and data governance. This iterative approach aimed to ensure the regulations remained effective in protecting the public interest while fostering innovation and avoiding undue burdens on the Canadian AI ecosystem.

AIDA emphasized continuous monitoring and evaluation to ensure ongoing compliance and responsible AI operation. Persons responsible for high-impact AI systems were not only required to establish measures for identifying, assessing, and mitigating risks of harm or biased output but also to continuously monitor the effectiveness of these measures. This included maintaining detailed records of actions taken and their outcomes.

The Minister of Innovation, Science and Industry, supported by the AI and Data Commissioner, would have possessed significant oversight and enforcement powers. These included the authority to compel regulated entities to produce records and information to verify compliance. In situations where a high-impact system posed a risk of harm or biased output, the Minister could order an independent audit. Furthermore, in cases of serious risk of imminent harm, the Minister had the power to order the cessation of a high-impact system's use or availability and could also order the publication of compliance-related information, while safeguarding confidential business information.

AIDA outlined a tiered system of penalties designed to encourage compliance. This framework included administrative monetary penalties for contraventions of regulatory requirements. For more serious infractions, the Act proposed criminal offences.

These criminal offences covered actions such as knowingly possessing or using unlawfully obtained personal information for AI system development, or making an AI system available knowing or being reckless that it was likely to cause serious harm or substantial damage to property, and if such harm or damage actually occurred. The proposed penalties were substantial, with fines potentially reaching up to $25 million or 5% of global revenue, whichever was greater, for certain offences. The Act also included provisions for the Minister to issue orders, such as requiring the publication of information related to compliance or system audits, and in cases of serious imminent harm, ordering the cessation of an AI system's use. These enforcement mechanisms were intended to provide robust tools for accountability across the AI lifecycle.

The Artificial Intelligence and Data Act was introduced as Part 3 of Bill C-27, the Digital Charter Implementation Act, 2022. This broader legislative package also included the Consumer Privacy Protection Act (CPPA) and the Personal Information and Data Protection Tribunal Act. AIDA was designed to complement these privacy-focused laws, recognizing that effective AI oversight requires comprehensive data protection.

AIDA was intended to build upon existing Canadian legal frameworks, including consumer protection and human rights laws. Its goal was to ensure that high-impact AI systems met the same expectations for safety and human rights that Canadians were accustomed to in other regulated sectors. The intent was for the new AI regulations to be interoperable with existing and future regulatory approaches, integrating seamlessly with Canada's broader legal landscape and supporting a holistic approach to digital governance.

Canada's approach to AI regulation through AIDA was consciously designed with international alignment in mind. The framework, including its key definitions and concepts, aimed to reflect and align with evolving global norms in the AI space. This included principles established by the Organization for Economic Co-operation and Development (OECD) AI Principles, as well as frameworks like the European Union's AI Act and the US National Institute of Standards and Technology (NIST) Risk Management Framework.

The goal of this international interoperability was to facilitate Canadian companies' access to global markets and to ensure that Canada remained competitive in the global AI landscape. By adopting a risk-based approach and seeking consistency with international standards, AIDA aimed to position Canada as a leader in responsible AI governance, while also allowing for a uniquely Canadian perspective that balanced innovation with protection.