Is AI regulated in Canada? What startups need to know in 2026, including the EU AI Act

Founders building AI products in Canada often ask whether there’s an “AI law” they need to comply with. There isn’t a single one. There are several existing laws that apply to AI already, two federal bills that would add more, and, for startups selling into Europe, the EU AI Act.

This post is general information, not legal advice.

No general AI statute in Canada

The Artificial Intelligence and Data Act was part of Bill C-27. It would have regulated “high-impact” AI systems. Bill C-27 died when Parliament was prorogued on January 6, 2025, and no general AI bill has been introduced to replace it.

The federal government has instead released a national AI strategy on June 4, 2026 and, on July 23, 2026, opened a public consultation on AI transparency, open until September 23, 2026. The consultation asks about identifying AI-generated content, telling people when they’re interacting with AI, and tracking serious AI incidents. A consultation isn’t law, but it signals where future rules may go. The 2023 Voluntary Code of Conduct on advanced generative AI systems remains voluntary.

Bills before Parliament

• Bill C-36 would enact the Protecting Privacy and Consumer Data Act, replacing PIPEDA’s private sector rules. As introduced, it includes explanations of automated decisions that significantly affect individuals.
• Bill C-34, the Safe Social Media Act, would enact a Digital Safety Act, with safety duties for regulated social media services and AI chatbot services.

Neither is law, and both may change. As of late October 2026, LEGISinfo showed that neither had passed second reading in the House of Commons.

The laws that already apply to AI

Privacy. PIPEDA governs personal information used to train, fine-tune or run models in commercial activity, including purposes, consent and safeguards. The Privacy Commissioner’s 2023 generative AI principles explain how it reads those rules. Quebec’s private sector law, amended by Law 25, already requires notice of decisions based exclusively on automated processing.

Advertising and consumer law. The Competition Act prohibits false or misleading claims, including claims about what an AI product can do. “AI-powered” accuracy or savings claims need support.

Employment. Since January 1, 2026, Ontario employers with 25 or more employees must disclose in public job postings whether they use AI to screen, assess or select applicants. Human rights law applies to AI-assisted hiring decisions as it does to human ones.

Contracts and intellectual property. Copyright, licence terms and your AI product terms govern training data, model use and outputs.

Sector rules. Health, financial services and other regulated sectors have their own rules that apply to AI used within them.

The EU AI Act

The EU AI Act (Regulation (EU) 2024/1689) can apply to a Canadian company without an EU office. It reaches providers that place AI systems on the EU market or put them into service there, and providers and deployers outside the EU where the AI system’s output is used in the EU.

Its obligations depend on risk:

• Prohibited practices, such as certain manipulative techniques and social scoring, have applied since February 2, 2025.
• General-purpose AI model obligations have applied since August 2, 2025.
• High-risk systems. A “digital omnibus” amendment, Regulation (EU) 2026/1744, signed in July 2026 and in force since July 27, 2026, moved the deadline for stand-alone high-risk systems listed in Annex III (which include some uses in employment, education and access to services) to December 2, 2027, and for high-risk systems in products covered by Annex I to August 2, 2028.
• Transparency obligations under Article 50, such as telling people they’re interacting with an AI system and marking AI-generated content, weren’t deferred in the same way. They apply from August 2, 2026, with a short transition to December 2, 2026 for providers of generative systems already on the market before August 2, 2026 to add machine-readable marking of AI-generated content.

Most B2B SaaS features won’t be high-risk, but HR tech, edtech, credit and insurance tools may be. If you sell into the EU, get EU advice on classification.

What Canadian AI startups can do now

• Keep a simple register of AI features: what each does, what data it uses and whether it makes decisions about people.
• Make sure your privacy policy and consent flows describe AI uses accurately.
• Be able to explain automated decisions about individuals, and offer human review.
• Support AI marketing claims with testing.
• Tell users when they’re dealing with an AI system rather than a person.
• Check whether any product is used in the EU, and in what way.
• Put AI-specific terms in your customer contracts: inputs, outputs, training use and responsibilities.

We prepare AI product terms and privacy policies at fixed fees, listed on our fees page. To talk through how these rules apply to your product, book a free 15-minute consult.