Governance

Regulated activity

AI-related activities covered by AIDA in interprovincial/international commerce.

How the laws define this

Both instruments establish that a regulated activity encompasses specific lifecycle stages of artificial intelligence systems—including development and deployment—that trigger compliance obligations under the statute, with detailed criteria left to subordinate regulations. However, the two descriptions diverge regarding scope limitations and explicit exceptions. The Digital Charter Implementation Act (Bill C-27) explicitly confines regulated activities to those occurring within interprovincial or international trade and commerce, while expressly excluding certain defence and national security operations. In contrast, the entry for the proposed Artificial Intelligence and Data Act (AIDA) frames regulated activities around designated lifecycle actions—explicitly incorporating testing, provision, and operation—without stating a restriction to interprovincial or international trade and commerce, and without referencing any national security or defence exclusions.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Canada	Digital Charter Implementation Act (Bill C-27) — An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act	Withdrawn	Includes specific examples of regulated activities (design, development, deployment or making available) in interprovincial or international trade and commerce, excludes defence and national security activities, and delegates finer criteria to regulation.
Canada	Artificial Intelligence and Data Act (AIDA) (proposed, part of Bill C-27)	Withdrawn	Limits regulated activities to designated lifecycle stages (development, testing, deployment, provision or operation) of AI systems, with subordinate regulations defining targets and compliance requirements.

What it triggers

Under the Artificial Intelligence and Data Act in Bill C-27, regulated activities would have attracted the statute's obligations and prohibitions.source
Under the Artificial Intelligence and Data Act in Bill C-27, regulated activities would have been targeted by subordinate regulations for obligations under the Act.source

Definitions (2)

Activities falling within AIDA's scope—notably the design, development, deployment or making available of AI systems in the course of interprovincial or international trade and commerce—such that those activities attract the statute's obligations and prohibitions; certain defence and national security activities are excluded. The bill delegated finer criteria and thresholds for regulated activities to regulation.

Digital Charter Implementation Act (Bill C-27) — An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data ActDefinition 1 of 2

Designated lifecycle activities (such as development, testing, deployment, provision or operation) involving artificial intelligence systems that subordinate regulations will target for obligations under the Act; regulations define which activities are regulated and the corresponding compliance requirements.

Artificial Intelligence and Data Act (AIDA) (proposed, part of Bill C-27)Definition 2 of 2

Not to be confused with

Regulated person

Regulated person refers to a person or organization subject to AIDA obligations, while regulated activity refers to the specific AI-related activities that trigger those obligations.

High-impact AI system

High-impact AI system refers to an AI system posing significant risk of harm or rights impacts, while regulated activity refers to lifecycle activities involving any AI systems that attract AIDA obligations.

Questions and answers

What activities count as regulated under AIDA?

Regulated activities under AIDA include design, development, deployment or making available of AI systems in interprovincial or international trade and commerce. They also encompass designated lifecycle activities like development, testing, deployment, provision or operation. Finer criteria and thresholds are delegated to regulations.

Are there exclusions for regulated activities in AIDA?

Certain defence and national security activities are excluded from regulated activities under AIDA.

Does regulated activity under AIDA apply to all AI systems?

Regulated activities target AI systems in a risk-based framework for private-sector use in interprovincial and international trade, with subordinate regulations defining which activities and systems are covered.