North America - AI Regulation Overview

The North American approach to artificial intelligence (AI) regulation, as exemplified by the United States and Canada, presents a distinct model characterized by a dynamic and evolving philosophy. In contrast to more prescriptive, horizontal regulatory frameworks seen elsewhere, both nations prioritize fostering innovation and maintaining global leadership in AI development while simultaneously addressing potential risks and societal impacts through more agile, risk-based, and often sector-specific strategies. The overall regulatory maturity in North America is best described as rapidly developing, with significant legislative, executive, and soft-law activity in recent years, demonstrating a pragmatic effort to adapt to the fast pace of AI innovation.

This regional approach is fundamentally rooted in a desire to strike a delicate balance: promoting economic competitiveness and technological advancement on one hand, and safeguarding civil liberties, privacy, and national security on the other. Instead of a single, overarching AI statute for the private sector, the North American landscape is shaped by a multi-faceted blend of existing legal authorities, executive actions, voluntary industry standards, and targeted legislative proposals. This creates a flexible, yet increasingly structured environment designed to enable rapid technological progress and democratize access to AI resources, while embedding principles of responsible and trustworthy AI deployment across various domains.

A hallmark of AI governance in this region is its adaptive nature, favoring iterative approaches that can quickly respond to new technological developments and emerging risks. This often translates into robust internal government policies for AI use and procurement, alongside voluntary guidelines and best practices for the broader private sector. While both countries share this foundational philosophy, there are nuanced differences in their emphasis and the specific instruments they employ, contributing to a rich and complex regulatory tapestry across North America.

Key Trends and Focus Areas

North America's AI regulatory landscape is characterized by several dominant themes that reflect a shared commitment to responsible innovation and a pragmatic approach to governance:

• Risk-Based Approaches: A central tenet across both the United States and Canada is the adoption of risk-based frameworks. This means that regulatory scrutiny and mitigation measures are scaled according to the potential impact and severity of harm posed by an AI system. For instance, both nations implement impact assessments and proportionate risk management for "high-impact" or "rights-impacting" AI systems within their federal governments, and encourage similar approaches in the private sector through voluntary frameworks.
• Innovation Promotion and Economic Competitiveness: Fostering AI innovation and maintaining a competitive edge in global AI development are paramount. Both countries invest heavily in AI research infrastructure, talent development, and commercialization strategies. The U.S. explicitly frames its AI policy around sustaining global dominance, while Canada’s Pan-Canadian AI Strategy similarly aims to strengthen its competitive position.
• Soft Law and Voluntary Standards for the Private Sector: For the broader private sector, both nations heavily rely on non-binding guidelines, voluntary codes of conduct, and industry standards. The U.S. leverages frameworks like the National Institute of Standards and Technology (NIST) AI Risk Management Framework, which, while voluntary, often become de facto industry standards. Canada similarly employs voluntary codes of conduct for generative AI and provides implementation guides for organizations. This approach prioritizes flexibility, enabling rapid adaptation to technological advancements without stifling innovation through rigid legislation.
• Strong Internal Government AI Governance: Both the U.S. and Canada have established robust and binding frameworks for their respective federal agencies' development, procurement, and deployment of AI systems. The U.S. utilizes Presidential Executive Orders and Office of Management and Budget (OMB) memoranda to mandate governance structures, risk assessments, and transparency requirements for federal AI. Canada's Treasury Board Secretariat's Directive on Automated Decision-Making serves a similar function, requiring federal institutions to assess and mitigate risks from automated systems.
• Sector-Specific Regulation: Rather than a single, horizontal law, there is a clear trend towards integrating AI considerations into existing sector-specific regulatory frameworks. Examples include the U.S. Federal Energy Regulatory Commission (FERC) addressing AI-driven data centers in grid reliability, and Canada's Office of the Superintendent of Financial Institutions (OSFI) updating model risk management guidelines to explicitly include AI/ML-based systems in the financial sector. This approach leverages existing expertise and regulatory bodies to address AI risks within their specific domains.
• Transparency, Accountability, and Ethical Principles: Underlying many of the regulatory efforts are core principles of transparency, accountability, fairness, and human oversight. These principles are embedded in government directives, voluntary codes, and proposed legislation, aiming to ensure that AI systems are developed and deployed ethically and responsibly, protecting civil liberties and public trust.
• Focus on AI Safety and Research Infrastructure: Both countries recognize the importance of foundational research and safety initiatives. The U.S. is codifying and scaling the National Artificial Intelligence Research Resource (NAIRR) and has a National Security Memorandum on AI focusing on governance within national security systems. Canada established the Canadian Artificial Intelligence Safety Institute (CAISI) to advance scientific understanding of AI risks and develop testing methodologies.

Regulatory Status

The current state of AI regulation in North America is characterized by a significant reliance on soft law and executive mandates, with a clear trajectory towards more targeted and potentially binding legislation for specific AI-related harms. Comprehensive, horizontal binding legislation for the entire private sector is not yet a reality in either country, and in Canada's case, a proposed federal AI Act was withdrawn.

In the United States, the federal government's approach is predominantly horizontal in its application across government agencies, but relies heavily on a risk-based and often non-binding framework for the private sector. Executive Orders and OMB memoranda establish binding, government-wide policies for federal agencies regarding AI use and procurement, mandating governance, risk assessments, and transparency. For the broader private sector, the U.S. largely employs a soft law approach, emphasizing voluntary guidelines and standards from bodies like NIST. However, there is a clear trajectory towards more binding rules for certain high-impact AI systems. Numerous legislative proposals are currently under consideration in Congress, seeking to introduce statutory safeguards for specific AI-related harms, such as algorithmic accountability in critical decision-making or content provenance for deepfakes. This indicates a move from purely voluntary guidelines towards a hybrid model where targeted, legally binding rules will complement the existing soft law framework, often by leveraging existing regulatory authorities like the Federal Trade Commission.

In Canada, the federal regulatory approach is also predominantly characterized by a blend of soft law instruments, sector-specific binding guidelines, and a strong commitment to a risk-based framework. While a comprehensive federal AI statute (the Artificial Intelligence and Data Act, AIDA) was proposed but ultimately withdrawn, Canada has active soft law instruments like the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems for the private sector. For federal government institutions, the Treasury Board of Canada Secretariat's Directive on Automated Decision-Making provides a mandatory, risk- and impact-based framework. Moreover, in specific regulated sectors such as financial services, bodies like OSFI issue binding guidelines that explicitly incorporate AI/ML systems into existing risk management frameworks. This demonstrates that while a comprehensive AI Act is not currently in force, Canada is incrementally building regulatory capacity through sector-specific rules and mandatory directives for public sector AI, while fostering responsible private sector innovation through voluntary measures.

In summary, neither country currently possesses a single, comprehensive binding law governing all AI in the private sector. Instead, both are navigating the complexities through a combination of:

• Binding Federal Government Directives: Both countries have mandatory rules for their own governmental use of AI.
• Voluntary Guidelines/Codes for Private Sector: Predominant approach for broader industry.
• Sector-Specific Binding Rules: Emerging in areas like finance and energy.
• Proposed Targeted Legislation: An active area in the U.S. Congress, indicating a future move towards more specific statutory requirements.

The trajectory for both nations suggests a continued evolution from primarily soft law and internal government mandates towards a more robust, but still risk-based and often sector-specific, regulatory environment that will likely include a mix of legally binding provisions for identified high-risk applications and continued reliance on flexible, voluntary standards.

Notable Differences

While sharing a common philosophical foundation, the United States and Canada exhibit several notable differences in their specific approaches, levels of maturity, and focus areas for AI regulation:

• Approach to Horizontal Legislation for the Private Sector: This is arguably the most significant divergence. Canada had a proposed comprehensive AI Act (AIDA) as part of Bill C-27, which aimed to establish binding, horizontal rules for high-impact AI systems across the private sector. However, this component was ultimately withdrawn, signaling a current federal preference against such broad, prescriptive legislation for industry. In contrast, the U.S. federal government has largely maintained a stance against a single, overarching AI statute from the outset, instead favoring a decentralized, sector-specific, and risk-based framework leveraging existing authorities and proposed targeted legislation. While both rely heavily on soft law, Canada's journey through proposing and then withdrawing AIDA illustrates a distinct internal policy debate and a current choice to stick with softer instruments for the private sector.
• Emphasis on National Competitiveness vs. Human-Centric Principles: While both nations value innovation, the U.S. explicitly prioritizes "global leadership" and "maintaining global AI dominance," as highlighted by recent Executive Orders that focus on removing barriers to American leadership. Canada, while also aiming to strengthen its competitive position, places a strong emphasis on a "human-centric" and "accessible and equitable AI" philosophy, evident in its National Standard for Accessible and Equitable AI and the principles guiding its AI strategy.
• Role of Executive Orders and OMB Memoranda (U.S.) vs. Treasury Board Directives (Canada): The U.S. has seen a rapid succession of powerful Presidential Executive Orders and OMB memoranda in recent years (e.g., EO 14179, M-25-21, M-25-22), establishing a robust and dynamic administrative framework for federal agencies. These are legally binding on federal entities and are evolving quickly. Canada's primary binding instrument for federal agencies, the Directive on Automated Decision-Making, is older (2019) but equally impactful, and supplemented by more recent guides on generative AI use within government. The sheer volume and speed of U.S. executive action in recent years are particularly striking.
• State-Level Activity (U.S.): The federal structure of the U.S. means that individual states can also pursue their own AI-related regulations or actions. The example of the coalition of 42 State Attorneys General addressing chatbot safety highlights a multi-jurisdictional dynamic that is less prominent in Canada's federal-provincial division of powers regarding AI.
• Specific Legislative Focus: The proposed legislation in the U.S. shows a strong interest in areas like content origin protection (deepfakes), algorithmic accountability in critical decisions (employment, healthcare), and preventing algorithmic collusion. While Canada also shares concerns about fairness and transparency, these specific legislative priorities have not been as explicitly articulated or progressed in its federal legislative agenda beyond the withdrawn AIDA.
• AI Safety Institutes: Both countries have established AI safety/research institutes (US NAIRR, Canada CAISI). However, the U.S. National Security Memorandum on AI points to a stronger, more explicit integration of AI governance within national security systems, whereas CAISI in Canada is focused more broadly on scientific understanding of risks and testing.

Regional Outlook

The North American AI regulatory landscape is poised for continued evolution, maintaining its characteristic adaptability and risk-based orientation. We can anticipate several key trends shaping its future trajectory.

Firstly, the reliance on soft law and voluntary standards for the private sector is likely to persist and grow in influence. Frameworks like the NIST AI RMF in the U.S. and voluntary codes in Canada will increasingly become de facto industry standards, influencing best practices, procurement requirements, and even informing future legislation. Companies operating in North America will find it increasingly necessary to align with these guidelines to demonstrate responsible AI governance and maintain public trust.

Secondly, while a comprehensive, horizontal AI act for the entire private sector remains unlikely in the short to medium term for either country, there will be a clear shift towards more targeted, binding legislation addressing specific, high-risk AI applications and harms. The U.S. Congress, with its numerous proposed bills, is a prime example of this incremental approach, focusing on issues like deepfake provenance, algorithmic discrimination in critical decisions (e.g., employment, lending), and anti-competitive practices facilitated by AI. Canada, too, may eventually introduce binding measures for specific high-risk areas, leveraging its existing regulatory bodies or creating new, narrowly tailored statutes.

Thirdly, internal government AI governance will continue to strengthen and mature. Both the U.S. and Canadian federal governments are committed to being exemplars of responsible AI use. We can expect further refinements and expansions of existing executive orders, OMB memoranda, and directives, covering areas such as AI procurement, workforce training, and consistent risk management across agencies. These government-internal frameworks often serve as a blueprint and signal for private sector expectations.

Fourthly, international collaboration will remain a significant pillar of North American AI strategy. Both countries actively engage with international partners, as seen with the Canada-EU Memorandum of Understanding on AI and the U.S.'s emphasis on global leadership and harmonizing standards. This collaboration will be crucial for addressing cross-border AI challenges, sharing best practices, and potentially influencing global norms, even without strict regulatory harmonization.

Finally, the region will face ongoing challenges in balancing the rapid pace of AI innovation with the need for effective governance. Regulators will need to remain agile, leveraging expertise from AI safety institutes and research initiatives to inform evidence-based policy. Ensuring interoperability of frameworks, addressing issues of data privacy, and fostering public trust in AI will be critical for the continued responsible development and deployment of AI across North America.