AI law in Canada, in plain terms.

PIPEDA governs collecting, using and disclosing personal information to train, fine-tune and run AI systems in commercial activity, including consent, purposes and safeguards, and the Privacy Commissioner’s 2023 generative AI principles explain how regulators read it. In May 2026, federal and provincial regulators found that OpenAI’s early collection of web data to train its models was overbroad and lacked valid consent. Quebec’s private sector law, amended by Law 25, already requires notice when a decision about a person is based exclusively on automated processing (s. 12.1), with an explanation and human review on request. Bill C-36 would replace PIPEDA’s private sector rules and add explanations of automated decisions, but as of late October 2026 it was still awaiting second reading.

• Bill C-27 Is Gone, Bill C-36 Is New
• Automated Decision-Making in Canada
• Training AI on Customer Data
• Quebec’s Law 25 Outside Quebec

• In ForcePIPEDA (as applied to AI)
• Before ParliamentBill C-36, Protecting Privacy and Consumer Data Act
• In ForceQuebec Law 25, Automated Decisions (Private Sector Act, s. 12.1)
• IssuedOPC Principles for Responsible, Trustworthy and Privacy-Protective Generative AI
• DecidedOPC Findings on OpenAI (PIPEDA Findings #2026-002)

The Competition Act prohibits false or misleading representations to the public, judged by their general impression as well as their literal meaning, and that covers claims about what an AI product does. Claims about performance, such as accuracy or time saved, must rest on adequate and proper testing done before you make them. Since June 20, 2025, private parties can also apply to the Competition Tribunal over deceptive marketing, and the Competition Bureau has flagged algorithmic pricing and AI-generated advertising as risks.

• Can We Say Our Product Is “AI-Powered”?

• In ForceCompetition Act, Deceptive Marketing (ss. 52 and 74.01)
• In ForceBill C-59, Competition Act Amendments
• IssuedCompetition Bureau, AI and Competition

If consumers use your product, Ontario’s Consumer Protection Act, 2002 applies to your agreement with them whatever your terms say, and false, misleading or deceptive representations to Ontario consumers are unfair practices. Its internet agreement rules include giving consumers an express opportunity to accept, decline or correct errors, which matters for AI agents that buy or book for users. Ontario has passed a Consumer Protection Act, 2023 to replace it, but as of October 2026 it isn’t in force.

• Online Terms and Ontario Consumer Law
• Legal Risk of AI Agents

The Copyright Act doesn’t address AI-generated works, and we’re not aware of any Canadian court decision on whether raw AI output is protected. Work where a person makes meaningful creative choices stands on firmer ground than output from a single prompt, so contracts, AI tool terms and records of how work was made do most of the protecting. On training data, the Act has no text and data mining exception, the federal consultation on generative AI hasn’t led to a bill, and an Ontario court has held it can hear Canadian news publishers’ copyright claims against OpenAI.

• Who Owns AI-Generated Content in Canada?
• Foundation Model API Terms

• IssuedCopyright Act and the Generative AI Consultation
• DecidedToronto Star Newspapers Limited v. OpenAI Inc., 2025 ONSC 6217

Since January 1, 2026, Ontario employers with 25 or more employees must say in publicly advertised job postings whether AI is used to screen, assess or select applicants. The definition of AI is broad, so resume ranking in an applicant tracking system or an AI-scored coding test may count. Human rights law applies to AI-assisted hiring decisions as it does to human ones.

• Ontario’s New Job Posting Rules

• In ForceEmployment Standards Act, 2000, s. 8.4 (AI in Job Postings)

In Moffatt v. Air Canada, 2024 BCCRT 149, a British Columbia tribunal held the airline responsible for wrong information its website chatbot gave a customer and rejected the argument that the chatbot was a separate entity. Ontario’s Electronic Commerce Act, 2000 says a contract can be formed through an electronic agent, so an AI agent’s purchase or booking can bind someone. Your own AI product terms, and the terms of the model provider you build on, decide much of the rest: who owns output, whether you train on customer data and who bears a mistake.

• Liability for AI Chatbots
• Legal Risk of AI Agents
• Selling AI to Enterprise Customers

• DecidedMoffatt v. Air Canada, 2024 BCCRT 149

Health software that is a medical device follows Health Canada’s guidance for machine learning-enabled medical devices, and an app sold to Ontario clinics will usually be bound by PHIPA through that relationship. Federally regulated financial institutions will apply OSFI Guideline E-23 on model risk management from May 1, 2027, and ask their AI vendors for documentation on development, validation and monitoring. The Canadian Securities Administrators have explained how securities law applies to AI used by registrants, issuers and marketplaces, including overstated AI disclosure.

• PHIPA and Health Apps
• Selling AI to Enterprise Customers

• IssuedHealth Canada Guidance for Machine Learning-Enabled Medical Devices
• IssuedOSFI Guideline E-23, Model Risk Management
• IssuedCSA Staff Notice 11-348, AI Systems in Capital Markets

Federal departments using automated decision systems must complete an Algorithmic Impact Assessment under the Treasury Board Directive on Automated Decision-Making, so vendors selling AI to them should be ready to supply information for it. The 2023 Voluntary Code of Conduct on advanced generative AI systems remains voluntary. The national AI strategy released on June 4, 2026 sets policy priorities without creating legal obligations, and ISED consulted until September 23, 2026 on labelling AI-generated content and telling people when they’re dealing with AI.

• Is AI Regulated in Canada?

• In ForceTreasury Board Directive on Automated Decision-Making
• IssuedVoluntary Code of Conduct on Advanced Generative AI Systems
• IssuedNational Artificial Intelligence Strategy: AI for All
• ProposedISED Consultation on AI Transparency
• DiedArtificial Intelligence and Data Act (Bill C-27, Part 3)

Since July 18, 2026, the Criminal Code offence of publishing intimate images without consent also covers realistic AI-generated images of an identifiable person. Bill C-25 amends the Canada Elections Act to prohibit misleading deepfakes of candidates and election figures. Bill C-34, the Safe Social Media Act, would impose safety duties on AI chatbot services, but it is a proposal, not law.

• Bill C-34, the Safe Social Media Act

• In ForceCriminal Code s. 162.1, as Amended by Bill C-16 (Protecting Victims Act)
• PassedStrong and Free Elections Act (Bill C-25)
• Before ParliamentBill C-34, Safe Social Media Act (Digital Safety Act)

The EU AI Act can apply to a Canadian startup with no EU office if it places AI systems on the EU market or its AI output is used in the EU. Prohibited practices have applied since February 2, 2025, general-purpose model duties since August 2, 2025 and Article 50 transparency duties since August 2, 2026. The 2026 Digital Omnibus amendment, in force since July 27, 2026, moved high-risk duties to December 2, 2027 for Annex III uses and August 2, 2028 for Annex I products. We advise on Ontario and Canadian law, not EU law, and work alongside EU counsel where you need one.

• The EU AI Act for Canadian Startups

• Partly In ForceEU AI Act (Regulation (EU) 2024/1689), as Amended