Canada AI Regulation Overview

Overview

Canada’s artificial intelligence governance architecture relies on a hybrid framework of mandatory administrative policies for public sector institutions, voluntary industry codes, sector-specific supervisory guidelines, national technical standards, and research safety initiatives. Following the lapse of proposed overarching statutory legislation—the Artificial Intelligence and Data Act (AIDA) under Bill C-27, which died on the Order Paper in January 2025—the federal governance landscape remains structured around existing administrative mechanisms, sectoral rules, and voluntary compliance frameworks.

Federal public service operations are strictly regulated by internal policy instruments issued by the Treasury Board of Canada Secretariat (TBS), notably the Directive on Automated Decision-Making and its mandatory Algorithmic Impact Assessment (AIA) tool. For the private sector, federal governance operates primarily through voluntary frameworks, such as the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, the Implementation Guide for Managers of AI Systems, and national voluntary standards like CAN-ASC-6.2:2025 on Accessible and Equitable Artificial Intelligence Systems. In financial services, the Office of the Superintendent of Financial Institutions (OSFI) supervises AI and machine learning through model risk management expectations under Guideline E-23.

Canada also maintains dedicated organizational and research infrastructure to foster responsible AI adoption. The Pan-Canadian Artificial Intelligence Strategy (PCAIS), initiated in 2017 and expanded in 2022, funds talent, commercialization, compute capacity, and standards development across three national AI institutes (Mila, Vector Institute, and Amii). In late 2024, the government launched the Canadian Artificial Intelligence Safety Institute (CAISI) within Innovation, Science and Economic Development Canada (ISED) to advance scientific understanding of advanced AI risks, develop evaluation toolkits, and collaborate with international safety institutes.

Regulatory Approach

Canada employs a combination of soft law, risk-proportionate guidelines, and sectoral oversight rather than a single horizontal AI statute. In the federal public sector, governance is binding and prescriptive: the TBS Directive on Automated Decision-Making categorizes automated decision systems into four distinct impact levels (Level I to Level IV) using a quantitative risk questionnaire, mapping each tier to mandatory risk mitigation controls, testing standards, human oversight rules, and public transparency obligations.

For private sector AI deployment, Canada relies on risk-proportionate soft-law frameworks and voluntary standards. The Voluntary Code of Conduct targets developers and managers of advanced generative AI systems with general-purpose capabilities, emphasizing six core principles: accountability, safety, fairness and equity, transparency, human oversight, and validity. Operational guidance published by ISED scales compliance expectations based on an organization's risk profile, high-impact scenarios, and system exposure. Similarly, National Standard CAN-ASC-6.2:2025 offers a process-oriented, lifecycle framework ensuring equity and accessibility for persons with disabilities, designed for voluntary adoption or potential future reference in binding regulations under the Accessible Canada Act.

In addition to federal frameworks, provincial legislation enforces target requirements for AI applications within provincial jurisdictions. For example, Ontario enacted the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (Bill 194) to regulate public sector AI use, cybersecurity programs, and minor data protections, as well as the Working for Workers Four Act, 2024 (Bill 149), which mandates AI screening disclosures in public job postings.

Key AI Legislation

• Directive on Automated Decision-Making (Treasury Board of Canada Secretariat): Mandatory federal policy establishing impact assessments, transparency, peer review, and human oversight controls for automated decision systems used in administrative decision-making.
• Algorithmic Impact Assessment (AIA) Tool (TBS): An open-source risk assessment questionnaire that scores automated decision systems across four impact tiers to dictate operational and governance requirements.
• Guideline E-23 — Model Risk Management (OSFI): Federal prudential guideline setting expectations for enterprise-wide model risk management, explicitly incorporating artificial intelligence and machine learning applications across federally regulated financial institutions (effective May 1, 2027).
• CAN-ASC-6.2:2025 — Accessible and Equitable Artificial Intelligence Systems: A National Standard of Canada published by Accessibility Standards Canada and approved by the Standards Council of Canada, establishing process and outcome requirements for disability inclusion across the AI lifecycle.
• Voluntary Code of Conduct on Advanced Generative AI Systems (ISED): Interim non-binding framework setting voluntary commitments for organizations developing or deploying general-purpose generative AI.
• Implementation Guide for Managers of Artificial Intelligence Systems (ISED): Operational resource providing best practices for risk assessment, procurement, testing, human oversight, and incident reporting.
• Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (Ontario Bill 194): Provincial legislation enacting the Enhancing Digital Security and Trust Act, 2024 (EDSTA) to govern public sector AI usage, cybersecurity programs, and minor data protection.
• Working for Workers Four Act, 2024 (Ontario Bill 149): Amends the Ontario Employment Standards Act, 2000 to require qualifying employers to disclose the use of AI in applicant screening or selection on public job postings.
• Artificial Intelligence and Data Act / Digital Charter Implementation Act (Bill C-27) [Withdrawn]: Proposed federal legislation aiming to regulate high-impact commercial AI systems and modernize federal private-sector privacy law; lapsed on the Order Paper in January 2025.

Governance & Enforcement Bodies

Multiple federal and provincial bodies share administrative, supervisory, and research responsibilities for AI across Canada. Innovation, Science and Economic Development Canada (ISED) serves as the primary federal department for policy development, overseeing the Pan-Canadian AI Strategy, stewarding the Voluntary Code of Conduct, housing CAISI, and issuing operational guidance for AI managers. CAISI executes its scientific mandate through two streams: investigator-led research managed by the Canadian Institute for Advanced Research (CIFAR) and government-directed projects executed by the National Research Council of Canada (NRC), in partnership with Canada's national AI institutes (Amii, Mila, and Vector Institute).

Public sector automated decision systems are supervised by the Treasury Board of Canada Secretariat (TBS) through its Office of the Chief Information Officer (OCIO). The OCIO maintains the Algorithmic Impact Assessment tool, publishes peer-review guidelines, conducts policy evaluations, and monitors departmental compliance. In financial regulation, the Office of the Superintendent of Financial Institutions (OSFI) supervises model risk across federally regulated financial institutions, reviewing AI/ML quantitative models and vendor risk frameworks.

Standardization and specialized rights oversight involve additional bodies. Accessibility Standards Canada (ASC) and the Standards Council of Canada (SCC) develop national technical standards and conformity assessment frameworks. At the provincial level, Ontario's Ministry of Labour, Immigration, Training and Skills Development enforces job posting AI disclosure rules under the Employment Standards Act, while the Information and Privacy Commissioner of Ontario (IPC) oversees mandatory privacy breach notifications and advises on public sector AI use under Bill 194.

Penalties & Enforcement

Enforcement approaches in Canada depend entirely on the specific instrument and jurisdiction, as soft-law measures and voluntary frameworks contain no direct statutory fines or criminal sanctions. Voluntary tools—such as the Voluntary Code of Conduct, the ISED Implementation Guide, CAN-ASC-6.2:2025, and international MOUs—rely on reputational accountability, organizational commitments, and contractual terms attached to funding or contribution agreements. However, if standard CAN-ASC-6.2 is formally adopted into binding regulations under the Accessible Canada Act, enforcement would fall to the Accessibility Commissioner, who holds statutory powers to conduct audits, issue compliance orders, and levy administrative monetary penalties (AMPs).

For mandatory financial and public sector policies, non-compliance triggers administrative oversight and statutory remedies. Under OSFI Guideline E-23, financial institutions failing to meet model risk expectations face supervisory remediation plans, operational restrictions, capital add-ons, or statutory enforcement measures under federal financial legislation. In the federal public service, failure to comply with the TBS Directive on Automated Decision-Making leads to internal escalation, halted system deployment, or procurement restrictions. Under provincial employment law (Ontario Bill 149), non-compliant employers face administrative complaints and enforcement under the Employment Standards Act. Statutory penalties proposed under the lapsed Bill C-27 (such as CPPA administrative fines up to CA$25 million or 5% of global revenue, and AIDA criminal offences) never came into force.

Data Protection Framework

Federal data protection in Canada is split between the commercial private sector—governed by the Personal Information Protection and Electronic Documents Act (PIPEDA)—and federal public institutions, governed by the Privacy Act. Legislative efforts to replace PIPEDA with the Consumer Privacy Protection Act (CPPA) and establish a specialized Personal Information and Data Protection Tribunal under Bill C-27 lapsed in January 2025 when Parliament prorogued.

AI governance instruments explicitly interface with existing data protection principles. The TBS Directive on Automated Decision-Making and the AIA tool require federal departments to perform Privacy Impact Assessments (PIAs), ensure secure data handling, and verify data quality and representativeness prior to deployment. OSFI Guideline E-23 demands strict data lineage, governance, and representativeness controls for models used in financial institutions. In the public sector at the provincial level, Ontario’s Bill 194 introduced mandatory privacy breach reporting to the Information and Privacy Commissioner of Ontario under FIPPA/MFIPPA whenever a breach poses a real risk of significant harm, while imposing enhanced safeguards for digital data belonging to minors.

Sector-Specific Rules

Sector-specific AI rules are established primarily in financial services, public administration, and employment. In the financial sector, OSFI Guideline E-23 establishes an enterprise-wide model risk management regime covering quantitative AI/ML systems. Federally regulated financial institutions must identify models with non-negligible risk, maintain a centralized model inventory, enforce independent model validation, monitor model drift, and apply third-party risk controls under Guideline B-10.

In employment, Ontario’s Working for Workers Four Act, 2024 (Bill 149) and Ontario Regulation 476/24 impose mandatory disclosure rules on employers with 25 or more employees. Employers who advertise public job postings and use AI systems to screen, assess, or select applicants must explicitly state the use of AI within the posting. In federal public administration, the Treasury Board's Directive on Automated Decision-Making and the Guide on the use of generative AI govern administrative decision tools and generative AI applications, establishing strict risk classification, human-in-the-loop controls, and adherence to the FASTER principles (Fair, Accountable, Secure, Transparent, Educated, Relevant).

International Alignment

Canada aligns its domestic AI policy with international standards, OECD principles, and bilateral partnerships. On December 8, 2025, during the Canada-EU Digital Partnership Council meeting in Montréal, Canada signed the Canada-EU Memorandum of Understanding on Artificial Intelligence. This non-binding policy instrument formalizes political cooperation to advance trustworthy AI, harmonize technical standards, expand compute access for SMEs and researchers, implement the G7 AI Adoption Roadmap, and conduct technical dialogues on mutual recognition of conformity assessment results.

Canada also participates actively in international research and technical alignment. CAISI represents Canada within the International Network of AI Safety Institutes, conducting joint safety evaluations and technical testing with global counterparts. Furthermore, Canadian policy resources—such as the ISED Implementation Guide, the Voluntary Code of Conduct, and the Pan-Canadian AI Strategy—explicitly adopt OECD definitions of AI systems and cross-reference international frameworks, including the NIST AI Risk Management Framework and G7/GPAI initiatives.

Future Developments

Following the lapsing of Bill C-27 (containing AIDA and the CPPA) in January 2025, future federal statutory legislation for commercial AI and privacy reform remains under active policy review. Regulatory attention is focused on implementing existing phased frameworks and transitioning institutions toward upcoming effective dates.

Key milestone dates include May 1, 2027, when OSFI Guideline E-23 on Model Risk Management becomes formally effective following an 18-month transition period. In the federal public sector, updates to the TBS Directive on Automated Decision-Making require federal departments operating pre-existing automated decision systems to achieve full alignment with revised requirements by June 24, 2026. Additionally, CAN-ASC-6.2:2025 is scheduled for a formal review initiation by December 3, 2029, with potential intermediate recommendations for inclusion in mandatory regulations under the Accessible Canada Act.

Enforcement Bodies