Quick answer: This page tracks the Canadian and international laws that most affect AI, SaaS and app companies operating in Canada, with their status as of the date below. It separates laws that are in force from bills that are still proposals, because founders regularly get asked by customers and investors to comply with rules that do not exist yet.
Last reviewed October 27, 2026 by Brooke Ash, For Founders Law PC. Statuses change. Check the linked official source before relying on any entry. General information only, not legal advice.
In force now
PIPEDA (federal private sector privacy law)
Status: In force. Governs how businesses collect, use and disclose personal information in commercial activity across most of Canada. What it means for you: meaningful consent, a clear privacy policy, safeguards and breach reporting. Glossary entry.
Québec Law 25
Status: Fully in force. Applies to businesses with Québec users or customers. What it means for you: a named privacy officer, privacy impact assessments, notice of automated decisions, and consent for cookies and tracking that is not on by default. Glossary entry.
Ontario AI disclosure in job postings
Status: In force since January 1, 2026 under the Employment Standards Act, 2000 and O. Reg. 476/24. Employers covered by Ontario's job-posting rules must disclose in a publicly advertised job posting if AI is used to screen, assess or select applicants. Employment agreements and policies.
Bill C-8 (cyber security)
Status: Received Royal Assent on June 15, 2026 (S.C. 2026, c. 9). Its main obligations apply to designated operators in federally regulated critical sectors such as telecommunications, finance and energy. Most startups are not designated operators, but their enterprise customers may push security terms down to them in vendor contracts and SaaS agreements.
Québec subscription cancellation rules (Bill 10)
Status: Adopted June 12, 2026; mostly in force since September 12, 2026. Merchants offering online subscriptions must provide an easily identifiable way to cancel them (Torys). See our subscription and cancellation guide.
BC auto-renewal rules (Bill 4)
Status: Mostly in effect since August 1, 2026. Auto-renewing consumer contracts must be cancellable without penalty, with renewal notice 30 to 60 days ahead for longer terms (Torys).
Manitoba personalized pricing rules (Bill 49)
Status: Proclaimed in force July 1, as reported by Torys in July 2026. Using algorithms to raise the price charged to a specific consumer is deemed an unfair business practice. See algorithmic and dynamic pricing in Canada.
EU AI Act
Status: In force, with obligations phasing in. After the 2026 AI Omnibus amendments (Regulation 2026/1744), transparency duties under Article 50 apply from August 2, 2026, and the Annex III high-risk obligations moved to December 2, 2027. Why Canadian founders care: it applies to providers placing AI systems on the EU market or whose output is used in the EU, wherever the company is based. AI terms and disclosures.
Proposed, not yet law
Bill C-34, Safe Social Media Act
Status: First reading June 10, 2026. At second reading in the House of Commons. Would set a minimum account age of 16 for regulated social media services and impose safety duties on AI chatbot providers. Full explainer.
Bill C-36, Protecting Privacy and Consumer Data Act
Status: Introduced June 15, 2026. At second reading. Would replace parts of PIPEDA and, among other things, ban surveillance pricing. Glossary entry.
Ontario Consumer Protection Act, 2023
Status: Passed but not yet in force. It will update Ontario's rules on consumer contracts, including subscriptions and unfair practices, once proclaimed. Draft your consumer terms of service so they can be adjusted when it takes effect.
Cases to watch
Canadian news publishers v. OpenAI
Status: In November 2025 an Ontario court held it has jurisdiction to hear the copyright claims brought by Canadian news organizations over the use of their articles to train AI models. The case continues. What it means for AI training data.
Reddit v. Anthropic
Status: A U.S. claim about scraping user content for AI training, remanded to California state court on March 30, 2026. It turns on contract and terms of use, not copyright, which is why your own terms of service matter.
Not in force anymore
U.S. FTC click-to-cancel rule
Status: Vacated by a U.S. federal appeals court in July 2025. The FTC still pursues cancellation practices under existing law, including the 2025 settlement with Amazon.
How to use this tracker
Laws in force should already be reflected in your privacy policy, terms of service, cookie banner and vendor contracts. Proposals are worth designing for, not drafting to. If a customer's security questionnaire or contract asks you to comply with a bill that has not passed, that is a negotiation point. For Founders Law drafts and updates terms of service, privacy policies and cookie consent, AI terms of use and SaaS agreements and DPAs for a flat fee agreed before work starts. Book a free consultation.