For Founders Law

Canadian AI Law Tracker

Every AI rule in Canada, and where it stands.

Federal and provincial laws, bills, regulator guidance and decisions that matter to AI startups, each with its primary source and the date we last checked it. Free to use and to link.

Last checked by Brooke Ash, lawyer at For Founders Law

In Short

Canada has no general AI law in force. The proposed Artificial Intelligence and Data Act died in January 2025 and no government AI act has replaced it. AI products are governed by existing law, mainly privacy (PIPEDA and Quebec Law 25), the Competition Act, the Criminal Code and sector rules, while new privacy and online safety bills (C-36 and C-34) are before Parliament.

How 2026 Unfolded

The year’s developments in the order they happened. Each one opens its entry in the tracker.

  1. Ontario employers with 25 or more employees must disclose AI screening in public job postings.

    In ForceEmployment Standards Act, 2000, s. 8.4 (AI in Job Postings)

  2. Federal and provincial privacy regulators release their findings on OpenAI’s training data.

    DecidedOPC Findings on OpenAI (PIPEDA Findings #2026-002)

  3. Bill C-34, the Safe Social Media Act, introduced, with safety duties for AI chatbot services.

    Before ParliamentBill C-34, Safe Social Media Act (Digital Safety Act)

  4. Privacy regulators find X and xAI breached PIPEDA when launching Grok image generation.

    DecidedOPC Findings on X and xAI, Grok (PIPEDA Findings #2026-004)

  5. Bill C-36, the Protecting Privacy and Consumer Data Act, introduced to replace PIPEDA’s private sector rules.

    Before ParliamentBill C-36, Protecting Privacy and Consumer Data Act

  6. Bill C-25 receives royal assent, banning misleading deepfakes of candidates and election figures.

    PassedStrong and Free Elections Act (Bill C-25)

  7. Criminal Code s. 162.1 now covers AI-generated intimate images of identifiable people (Bill C-16).

    In ForceCriminal Code s. 162.1, as Amended by Bill C-16 (Protecting Victims Act)

  8. Latest

    ISED opens its consultation on AI transparency, labelling and AI agents (closed September 23, 2026).

    ProposedISED Consultation on AI Transparency

The Tracker

Search, or tap a count or a place to narrow the list.

Showing all 38 rules

Federal 19

  • Artificial Intelligence and Data Act (Bill C-27, Part 3) Bill · January 6, 2025 Died
    What It Does
    Would have regulated high-impact AI systems, but the bill died in committee when Parliament was prorogued, and no government AI act has replaced it.
    Who It Affects
    Developers and deployers of AI systems
    What to Do
    Treat AIDA as background only, and build governance around privacy, consumer and sector laws that apply now.
    Primary Source Checked
  • PIPEDA (as applied to AI) Law In Force
    What It Does
    Governs collecting, using and disclosing personal information to train, fine-tune and run AI systems in commercial activity, including consent, purpose limits, accuracy and safeguards.
    Who It Affects
    Private sector organizations handling personal information
    What to Do
    Map what personal information goes into training and prompts, confirm consent and purposes, and document safeguards.
    Primary Source Checked
  • OPC Principles for Responsible, Trustworthy and Privacy-Protective Generative AI Guidance · December 2023 Issued
    What It Does
    Sets out how federal, provincial and territorial privacy regulators expect privacy law to apply to building and using generative AI.
    Who It Affects
    Generative AI developers and deployers
    What to Do
    Use the principles as a checklist for legal authority, purpose, transparency and accuracy in AI features.
    Primary Source Checked
  • Bill C-36, Protecting Privacy and Consumer Data Act Bill · June 15, 2026 Before Parliament
    What It Does
    Would replace PIPEDA's private sector rules and, as introduced, require organizations to explain on request predictions, recommendations or decisions made by an automated decision system that could significantly affect a person.
    Who It Affects
    Private sector organizations handling personal information
    What to Do
    Watch the bill, and design AI features so you can explain automated decisions about individuals.
    Primary Source Checked
  • Budget 2025 Implementation Act, No. 1 (Bill C-15), PIPEDA Data Mobility Amendments Law · March 26, 2026 Passed
    What It Does
    Adds a data mobility right to PIPEDA that will operate through data mobility frameworks set by regulation.
    Who It Affects
    Organizations in sectors covered by a future data mobility framework
    What to Do
    Track regulations that designate frameworks, since the right applies only once a framework covers your sector.
    Primary Source Checked
  • Bill C-34, Safe Social Media Act (Digital Safety Act) Bill · October 21, 2026 Before Parliament
    What It Does
    Would impose safety duties on regulated social media services and AI chatbot services, with a focus on children, overseen by a new Digital Safety Commission.
    Who It Affects
    Social media platforms and AI chatbot providers
    What to Do
    If you run a consumer chatbot, follow the bill's scope definitions and start documenting child safety measures.
    Primary Source Checked
  • Bill C-63, Online Harms Act Bill · January 6, 2025 Died
    What It Does
    Would have created duties for social media services on harmful content, but died at second reading on prorogation.
    Who It Affects
    Social media services
    What to Do
    Look to Bill C-34 instead, which is the current online safety bill.
    Primary Source Checked
  • Bill C-277, Regulating the Online Use of Deepfakes Act Bill · May 6, 2026 Before Parliament
    What It Does
    A private member's bill that would regulate the online use and spread of deepfakes and increase transparency.
    Who It Affects
    Platforms and creators of synthetic media
    What to Do
    Monitor only, since private member's bills rarely pass, but label synthetic media now as good practice.
    Primary Source Checked
  • Criminal Code s. 162.1, as Amended by Bill C-16 (Protecting Victims Act) Law · July 18, 2026 In Force
    What It Does
    Extends the offence of publishing intimate images without consent to realistic images made with AI software that depict an identifiable person.
    Who It Affects
    Image and video generation tools, platforms and users
    What to Do
    Block generation and sharing of sexual images of identifiable real people, and keep a takedown process.
    Primary Source Checked
  • Strong and Free Elections Act (Bill C-25) Law · June 18, 2026 Passed
    What It Does
    Amends the Canada Elections Act to prohibit deepfake images or voice imitations of candidates and election figures intended to mislead, with exceptions for satire and parody.
    Who It Affects
    Generative media tools, political advertisers and platforms
    What to Do
    Restrict or label generated content that imitates political candidates or election officials.
    Primary Source Checked
  • Voluntary Code of Conduct on Advanced Generative AI Systems Voluntary code · September 2023 Issued
    What It Does
    Sets voluntary commitments on accountability, safety, fairness, transparency, human oversight and robustness for advanced generative AI systems.
    Who It Affects
    Developers and managers of advanced generative AI systems
    What to Do
    Consider whether to sign, and use its commitments as a governance framework that customers may ask about.
    Primary Source Checked
  • ISED Consultation on AI Transparency Guidance · July 23, 2026 Proposed
    What It Does
    Asked for views, until September 23, 2026, on labelling AI-generated content, disclosing AI interactions, AI incident tracking and monitoring AI agents.
    Who It Affects
    AI developers and deployers
    What to Do
    Expect future disclosure and labelling rules, and tell users now when they are dealing with AI.
    Primary Source Checked
  • National Artificial Intelligence Strategy: AI for All Guidance · June 4, 2026 Issued
    What It Does
    Sets federal AI policy priorities, including modernizing privacy and online safety laws and building AI safety capacity, but creates no legal obligations.
    Who It Affects
    AI companies generally
    What to Do
    Read it for policy direction and funding opportunities, not compliance duties.
    Primary Source Checked
  • Treasury Board Directive on Automated Decision-Making Regulation · June 24, 2025 In Force
    What It Does
    Requires federal institutions using automated decision systems to complete an Algorithmic Impact Assessment and apply controls by impact level, with existing systems to comply by June 24, 2026.
    Who It Affects
    Federal institutions and vendors selling AI to them
    What to Do
    If you sell to federal departments, be ready to supply information for their Algorithmic Impact Assessment, testing and monitoring.
    Primary Source Checked
  • Competition Act, Deceptive Marketing (ss. 52 and 74.01) Law In Force
    What It Does
    Prohibits false or misleading representations, which covers claims about what an AI product does and misleading AI-generated marketing content.
    Who It Affects
    Any business marketing to the public
    What to Do
    Substantiate AI performance, accuracy and savings claims with testing before you publish them.
    Primary Source Checked
  • Bill C-59, Competition Act Amendments Law · June 20, 2024 In Force
    What It Does
    Strengthened the Competition Act, including drip pricing and environmental claim rules and, from June 20, 2025, private access to the Competition Tribunal for deceptive marketing.
    Who It Affects
    Businesses making marketing claims
    What to Do
    Expect private applicants as well as the Bureau to challenge unsupported claims, including AI claims.
    Primary Source Checked
  • OSFI Guideline E-23, Model Risk Management Guidance · September 11, 2025 Issued
    What It Does
    Sets model risk management expectations covering AI and machine learning models for federally regulated financial institutions, effective May 1, 2027.
    Who It Affects
    Banks, insurers, trust and loan companies, and their AI vendors
    What to Do
    If you sell models to these institutions, prepare documentation on development, validation, explainability and monitoring.
    Primary Source Checked
  • Health Canada Guidance for Machine Learning-Enabled Medical Devices Guidance · April 1, 2026 Issued
    What It Does
    Sets licensing expectations for Class II to IV machine learning-enabled medical devices, including data, testing, transparency and predetermined change control plans.
    Who It Affects
    Health AI companies whose software is a medical device
    What to Do
    Check whether your software is a medical device, and plan model updates through a change control plan.
    Primary Source Checked

Ontario 2

  • Employment Standards Act, 2000, s. 8.4 (AI in Job Postings) Law · January 1, 2026 In Force
    What It Does
    Requires employers with 25 or more employees to state in publicly advertised job postings whether AI is used to screen, assess or select applicants.
    Who It Affects
    Ontario employers with 25 or more employees, and HR tech vendors
    What to Do
    Add an AI disclosure to public postings if any tool screens or ranks candidates, and tell customers if you sell such tools.
    Primary Source Checked
  • Enhancing Digital Security and Trust Act, 2024 (Bill 194) Law · January 29, 2025 Partly In Force
    What It Does
    Lets Ontario set AI disclosure, accountability, risk management and oversight duties for public sector entities by regulation.
    Who It Affects
    Ontario public sector entities and their AI vendors
    What to Do
    If you sell to Ontario public bodies, watch for AI regulations and be ready to support their disclosure and risk management.
    Primary Source Checked

Quebec 2

  • Quebec Law 25, Automated Decisions (Private Sector Act, s. 12.1) Law · September 22, 2023 In Force
    What It Does
    Requires notice when a decision is based exclusively on automated processing of personal information, and on request the information used, the reasons and a chance to submit observations to a person who can review it.
    Who It Affects
    Businesses making automated decisions about Quebec residents
    What to Do
    Identify fully automated decisions about individuals, and build notice, explanation and human review into the product.
    Primary Source Checked
  • Quebec Law 25, Privacy Impact Assessments and Privacy by Default Law · September 22, 2023 In Force
    What It Does
    Requires privacy impact assessments for projects that acquire, develop or overhaul systems involving personal information and before sending personal information outside Quebec, with data portability added on September 22, 2024.
    Who It Affects
    Businesses handling Quebec residents' personal information
    What to Do
    Run a privacy impact assessment before launching an AI feature or sending Quebec data to an offshore model provider.
    Primary Source Checked

Alberta 1

  • Alberta Personal Information Protection Act Law In Force
    What It Does
    Governs private sector personal information in Alberta. No AI-specific amendments have been made, despite the Commissioner's reform recommendations on automated decisions.
    Who It Affects
    Private sector organizations in Alberta
    What to Do
    Apply PIPA's consent and reasonableness rules to AI uses, and watch for reform legislation.
    Primary Source Checked

British Columbia 2

  • BC Personal Information Protection Act Law In Force
    What It Does
    Governs private sector personal information in BC. No AI-specific amendments have been made.
    Who It Affects
    Private sector organizations in BC
    What to Do
    Apply PIPA's consent and reasonable purpose rules to AI uses of BC residents' information.
    Primary Source Checked
  • BC Intimate Images Protection Act Law · January 29, 2024 In Force
    What It Does
    Gives a fast civil process to stop distribution of intimate images, including digitally altered images, with orders that can reach internet intermediaries.
    Who It Affects
    Platforms and generative image tools with BC users
    What to Do
    Have a process to respond quickly to takedown orders for altered intimate images.
    Primary Source Checked

Courts and Regulators 10

  • Competition Bureau, AI and Competition Guidance · January 2025 Issued
    What It Does
    The Bureau's discussion paper and What We Heard report flag AI risks including algorithmic pricing, collusion and deceptive marketing using AI-generated content.
    Who It Affects
    AI developers, platforms and businesses using pricing algorithms
    What to Do
    Review pricing algorithms and AI-generated advertising for competition and deceptive marketing risk.
    Primary Source Checked
  • CSA Staff Notice 11-348, AI Systems in Capital Markets Guidance · December 5, 2024 Issued
    What It Does
    Explains how existing securities law applies to AI used by registrants, issuers and marketplaces, including governance, explainability, disclosure and AI washing.
    Who It Affects
    Registrants, fintechs, issuers and marketplaces
    What to Do
    Make sure AI-related disclosure is accurate and not overstated, and that AI used in advice or trading has governance and oversight.
    Primary Source Checked
  • Moffatt v. Air Canada, 2024 BCCRT 149 Decision · February 14, 2024 Decided
    What It Does
    Held Air Canada responsible for negligent misrepresentation by its website chatbot and rejected the argument that the chatbot was a separate entity.
    Who It Affects
    Any business using customer-facing chatbots
    What to Do
    Treat chatbot answers as your own statements, and limit and test what the bot can promise.
    Primary Source Checked
  • OPC Findings on OpenAI (PIPEDA Findings #2026-002) Decision · May 6, 2026 Decided
    What It Does
    Federal, Quebec, BC and Alberta regulators found that OpenAI's initial collection of web data to train GPT-3.5 and GPT-4 was overbroad and lacked valid consent, and that it fell short on accuracy, access and accountability.
    Who It Affects
    Developers training models on scraped or third-party data
    What to Do
    Limit personal information in training data, document your legal authority, and support access, correction and deletion requests.
    Primary Source Checked
  • OPC Findings on X and xAI, Grok (PIPEDA Findings #2026-004) Decision · June 11, 2026 Decided
    What It Does
    Found that X and xAI violated PIPEDA by launching Grok's image generation without adequate safeguards against non-consensual sexualized deepfakes.
    Who It Affects
    Generative image and video providers
    What to Do
    Assess privacy harms and put misuse safeguards in place before launching generation features.
    Primary Source Checked
  • OPC Findings on TikTok (PIPEDA Findings #2025-003) Decision · September 23, 2025 Decided
    What It Does
    Found inadequate age assurance and consent for using children's information in ad targeting and content recommendation algorithms.
    Who It Affects
    Consumer apps using personalization or recommendation algorithms
    What to Do
    Put age assurance in place, and do not use minors' data for profiling without a clear legal basis.
    Primary Source Checked
  • OPC Findings on Clearview AI (PIPEDA Findings #2021-001) Decision · February 2, 2021 Decided
    What It Does
    Found that scraping images to build a facial recognition database was mass surveillance without consent, and that publicly accessible online images were not exempt.
    Who It Affects
    Biometric and scraping-based AI products
    What to Do
    Get express consent for biometric data, and do not assume online images are free to use.
    Primary Source Checked
  • Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 Decision · May 8, 2025 Decided
    What It Does
    Upheld the Commissioner's order against Clearview but found PIPA's narrow publicly available information exception unconstitutional to the extent it bars use of information people deliberately make public online.
    Who It Affects
    Companies scraping public web data for AI training
    What to Do
    Do not treat this as permission to scrape, since federal and other provincial rules still apply.
    Primary Source Checked
  • Toronto Star Newspapers Limited v. OpenAI Inc., 2025 ONSC 6217 Decision · November 2025 Decided
    What It Does
    Held that Ontario courts have jurisdiction over Canadian news publishers' copyright and related claims about OpenAI training on their content, which lets the case proceed.
    Who It Affects
    Model developers using Canadian content
    What to Do
    Expect Canadian courts to hear training data claims against foreign AI companies, and keep records of content licences.
    Primary Source Checked
  • Ko v. Li, 2025 ONSC 2766 Decision · May 2025 Decided
    What It Does
    An Ontario court addressed a factum that cited non-existent, apparently AI-generated cases and confirmed that lawyers must verify authorities.
    Who It Affects
    Legal tech providers and anyone filing AI-assisted court documents
    What to Do
    If your product drafts legal or court content, build in citation checking and clear verification warnings.
    Primary Source Checked

Outside Canada 2

  • EU AI Act (Regulation (EU) 2024/1689), as Amended Law · July 27, 2026 Partly In Force
    What It Does
    Prohibited practices apply from February 2, 2025, general-purpose model duties from August 2, 2025 and Article 50 transparency from August 2, 2026, with high-risk duties moved to December 2, 2027 (Annex III) and August 2, 2028 (Annex I).
    Who It Affects
    Canadian companies placing AI on the EU market or whose outputs are used in the EU
    What to Do
    Classify each product used in the EU by risk level, and get EU advice for possible high-risk uses.
    Primary Source Checked
  • Colorado SB 26-189, Automated Decision-Making Technology Law · May 14, 2026 Passed
    What It Does
    Repeals and replaces Colorado's 2024 AI Act with narrower transparency and consumer rights duties for automated decision-making in consequential decisions, mainly from January 1, 2027.
    Who It Affects
    Developers and deployers of tools used in consequential decisions about Colorado consumers
    What to Do
    If US customers use your tool for hiring, lending, housing or similar decisions, prepare the developer documentation and notices.
    Primary Source Checked

Cite This Tracker

For Founders Law, “Canadian AI Law Tracker” (last checked October 28, 2026), https://www.forfounderslaw.com/ai-law-tracker/

Tracker Updates

Common Questions

Does Canada have an AI law?

Canada has no general AI law in force. The proposed Artificial Intelligence and Data Act died in January 2025 and no government AI act has replaced it. AI products are governed by existing law, mainly privacy (PIPEDA and Quebec Law 25), the Competition Act, the Criminal Code and sector rules, while new privacy and online safety bills (C-36 and C-34) are before Parliament.

Which of these apply to my startup?

It depends on what your product does, whose data it uses and where your customers are. Most Canadian AI startups deal first with privacy law (PIPEDA, and Quebec Law 25 if you have Quebec users), the Competition Act for marketing claims, and their own customer contracts.

How often is this tracker updated?

Each entry shows the date it was last checked against its primary source, and changes are logged at the foot of the page. The whole tracker was last checked on October 28, 2026.

Can I link to or cite the tracker?

Yes. Each entry has its own link, and there is a ready-made citation at the foot of the page.

Building with AI? We’ll tell you which of these apply to your product on a free 15-minute call.

Book a Free Consult AI Law in Canada AI Product Legal Check AI Product Terms

General information about Canadian law as of the dates shown. It isn’t legal advice and doesn’t create a lawyer-client relationship. Laws change; check the primary source before relying on any entry.