Is AI regulated in Canada? What happened to AIDA, and what applies now

Yes — AI use in Canada is regulated, just not by a law that says "AI" on the cover. A lot of the confusion comes from AIDA, the proposed Artificial Intelligence and Data Act. AIDA was part of Bill C-27, and Bill C-27 died when Parliament was prorogued in January 2025. It never passed. So there is no dedicated federal AI statute in force in Canada today. What does govern how you deploy AI — chatbots, voice agents, scoring tools, analytics — is the privacy law that already existed: PIPEDA federally, and Quebec's Law 25 for organizations operating in Quebec.

General information, not legal advice. Privacy and AI rules are evolving and fact-specific; confirm your obligations with a qualified Canadian lawyer before acting.

So is AI unregulated in Canada?

No. "There's no AI law" is not the same as "anything goes." Every AI system that touches a customer's name, phone number, voice, booking, or behaviour is processing personal information — and personal information is regulated. The rules apply to the outcome (how you collect, use, and disclose data, and how transparent and accountable you are), not to the technology label. An AI receptionist that answers calls is bound by the same privacy principles as a human employee doing the same job.

This matters more each year. Statistics Canada reported that 19.2% of Canadian businesses used AI in Q2 2026, up from 6.1% in Q2 2024. Among businesses already using AI, 28.2% used virtual agents or chatbots — a share of AI adopters, not of all Canadian businesses. Adoption is climbing fast; the compliance questions are catching up to real deployments.

What happened to AIDA?

AIDA was the federal government's attempt at a risk-based AI framework — obligations for "high-impact" systems, transparency requirements, and an AI and Data Commissioner. It travelled inside Bill C-27 alongside a proposed overhaul of federal privacy law. When Parliament was prorogued in January 2025, all bills on the order paper — including C-27 — died. AIDA is not law. It never took effect, and any obligations you may have read about from the 2023–2024 debate do not currently bind anyone.

As of 2026, the current federal legislative vehicle is Bill C-36. It is worth watching, but it is a bill — treat it as a proposal that could change or stall, not as settled law. Planning your business around unpassed legislation is a good way to build the wrong thing twice.

What actually governs AI use today

PIPEDA (federal)

PIPEDA — the Personal Information Protection and Electronic Documents Act — remains the operative federal private-sector privacy law. Its core is accountability: you must have a lawful basis to collect personal information, be transparent about how you use it, collect only what you need, secure it, and remain responsible for it even when a third party processes it on your behalf. The Office of the Privacy Commissioner of Canada (OPC, priv.gc.ca) enforces and interprets PIPEDA. If your AI tool records calls, transcribes conversations, or profiles customers, PIPEDA's principles already apply.

Quebec's Law 25

If you operate in Quebec, Law 25 (administered by the Commission d'accès à l'information, the CAI) is the strictest privacy regime in the country and it is fully in force. It layers on consent, transparency, privacy-by-default, breach reporting, and privacy-impact-assessment obligations. The penalties are real and structured across two regimes — administrative monetary penalties, and separate penal offences. For the penal offences, fines range from $15,000 to $25,000,000, or, if greater, an amount equal to 4% of worldwide turnover for the preceding fiscal year. In plain terms: penalties can reach the tens of millions of dollars, or a percentage of global revenue if that number is larger. This is not a regime to treat casually.

Automated decisions — Law 25 section 12.1

Law 25 has a specific rule for automation. Under section 12.1, when a business makes a decision based exclusively on automated processing of personal information, it must inform the individual and, on request, allow them to submit observations to have the decision reviewed. The key word is "exclusively." Routine, low-stakes automation — an AI agent booking an appointment or answering a common question — generally is not an "exclusively automated decision" with legal or similarly significant effect. Automated screening, scoring, or eligibility decisions are much more likely to trigger section 12.1. Know which side of that line your system sits on before you deploy it.

The French-language question

A common misconception: that Bill 96 and the Charter of the French Language impose a rule that you must "answer the phone in French." They don't create a specific telephone mandate. What they establish is a broader right for consumers to be served and informed in French. Bilingual capability in your customer-facing tools — including an AI agent that can converse in French — supports those French-language service obligations; it doesn't satisfy a phone-specific rule, because no such standalone rule exists. Frame it as serving customers properly in Quebec, not as ticking a single legislative box.

What about where your data is processed?

Another myth worth retiring: that PIPEDA forbids processing Canadians' personal information outside Canada. It does not. The OPC treats a transfer of personal information to a third party for processing as a use of that information — governed by the accountability principle rather than banned. You stay accountable for the data. Practically, that means: use contracts that require a comparable level of protection, and be transparent with customers that their information may be processed outside Canada and could therefore be accessible to foreign courts or authorities. That is the honest, citable position — see the OPC's guidance at priv.gc.ca. If your customers are in Quebec, Law 25 adds its own assessment obligations before transferring personal information outside the province.

What a Canadian business should do now

You don't need to wait for Bill C-36 to get this right. Regardless of what passes, the fundamentals hold:

• Map your data. Know what personal information your AI collects, where it goes, and who processes it.
• Be transparent. Tell customers when they're interacting with an AI, what you record, and why. Disclose out-of-country processing.
• Get consent and minimize. Collect only what the task needs; don't hoard recordings or transcripts "just in case."
• Watch for automated decisions. If AI is scoring, screening, or ranking people, build in the section 12.1 disclosure and human-review path.
• Put contracts around vendors. Require comparable protection, breach notification, and clear data-handling terms from any provider.
• Keep a human in the loop. Accountability can't be outsourced to a model.

These are the same obligations that would survive most versions of a future AI law, which is exactly why they're the right place to invest. As a Canadian AI implementation partner, ALMA Intelligence builds deployments — including our AI receptionist product, ALMATalk — around transparency, data minimization, and bilingual customer service, so the compliance groundwork is there whatever the federal Parliament does next.