Canada No Federal AI Act Explained

Canada does not currently have, and does not currently have pending, a comprehensive federal AI-specific law. The bill that would have created one, the Artificial Intelligence and Data Act (AIDA), died on the order paper in January 2025 and was never re-tabled. If you've read anything describing Canada's upcoming AI law as imminent, it's very likely working from information that predates that.

The plain-English answer

If you're waiting for a Canadian federal AI law before finalising your business's own AI policy, stop waiting, there's nothing currently in progress to wait for. What actually governs AI use in Canada right now is the existing Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level, interpreted by the Office of the Privacy Commissioner as applying its existing fairness and transparency principles to AI systems, plus a real and binding set of provincial rules, most significantly Quebec's Law 25. This is the actual, current governance picture, not a placeholder until AIDA arrives.

Why this matters for your business

A 12-person Toronto marketing agency holding off on finalising its own AI usage policy while waiting for a clearer federal framework is a genuinely understandable instinct, and also one that's stalling real planning against a law that isn't coming. Clients being told a federal AI law is imminent are getting inaccurate advice, and a business building product or compliance roadmaps around AIDA's original proposed requirements is building around something that no longer exists.

The practical cost of this confusion isn't just wasted planning time. A business that treats "no federal AI law yet" as "no real obligations yet" misses the fact that PIPEDA and, for many businesses, Quebec's Law 25 already impose real, binding requirements on AI use today, requirements that don't need AIDA to exist in order to apply, and a business without a clear, documented compliance position on either one has real exposure today, not exposure that starts only once new legislation eventually passes.

What actually happened to AIDA

AIDA was introduced in June 2022 as Part 3 of Bill C-27, the Digital Charter Implementation Act, alongside two privacy-reform components, the Consumer Privacy Protection Act (intended to replace PIPEDA) and a new Personal Information and Data Protection Tribunal. AIDA itself would have been Canada's first horizontal, AI-specific statute, taking a risk-based approach focused on "high-impact" AI systems, with obligations covering training-data anonymisation, human-rights risk assessments, mitigation measures, and human oversight requirements for the highest-risk systems.

The bill spent years moving through Parliament, including detailed committee hearings specifically on AIDA's provisions, real testimony from academics, civil society groups, and industry representatives debating the specifics of what a high-impact system should mean and how the enforcement regime should work. Then, in January 2025, Prime Minister Justin Trudeau's resignation triggered a prorogation of Parliament, which killed every bill still before Parliament at that point, including Bill C-27 and AIDA, none of which had reached a final vote. The snap federal election that followed in April 2025 shifted government priorities, and Bill C-27 was never re-tabled in anything resembling its original form. As of mid-2026, no comprehensive federal AI bill is before Parliament.

What actually fills the gap: PIPEDA and the provinces

With no federal AI-specific statute, two layers do the real work of governing AI use in Canada today. The first is PIPEDA, Canada's existing federal private-sector privacy law, which predates AIDA entirely and applies to any organisation handling personal information in the course of commercial activity. The Office of the Privacy Commissioner has been explicit that PIPEDA's existing principles, particularly around fairness, transparency, and accountability, apply fully to AI systems, even without AI-specific statutory language. This means an AI tool making decisions about Canadians, screening applicants, scoring risk, personalising offers, is already subject to real privacy obligations today, obligations that don't depend on AIDA ever existing.

The second layer is provincial, and it's genuinely uneven across the country. Quebec's Law 25 is by far the most developed, with explicit statutory rights around automated decision-making, notification, explanation, and human review, that go well beyond what PIPEDA provides at the federal level. Alberta and British Columbia each have their own long-standing private-sector privacy statutes, broadly similar in structure to PIPEDA but administered by their own provincial commissioners, and neither currently has Quebec-style AI-specific provisions, though that could change. The result is a genuine patchwork: a business's actual obligations depend heavily on which provinces its customers, employees, or candidates are in, not a single national standard.

Why the AIDA confusion is so persistent

AIDA received a genuinely large amount of coverage while Bill C-27 was progressing through Parliament between 2022 and 2024, detailed committee hearings, extensive legal commentary, and a real expectation across the Canadian tech and legal community that some version of it would eventually pass. A lot of content written during that window, including, until this correction, our own coverage of Canadian AI governance, described AIDA in future tense, as something coming rather than something that had already died. That volume of pre-2025 content is part of why the confusion persists, there's simply more material describing AIDA as pending than material that's caught up to its death.

This is a useful general lesson, not just a Canada-specific one: legislative coverage tends to concentrate while a bill is actively moving, and drops off sharply once it dies quietly on an order paper rather than being voted down in a way that generates its own news cycle. A bill dying through prorogation, as AIDA did, is genuinely easy to miss if you're not specifically checking, it doesn't get the same attention a defeated vote would.

What this looks like in practice

This matters even for a business with no Quebec exposure at all. A marketing agency serving clients across Ontario and the rest of English-speaking Canada might reasonably conclude Law 25 never applies to them, and be broadly right, but that doesn't mean PIPEDA's obligations disappear. An AI tool the agency uses to personalise ad targeting or draft client reports still processes personal information in a commercial context, and PIPEDA's consent, accuracy, and safeguarding principles still apply in full, they were simply never conditional on AIDA passing in the first place.

Picture the agency owner, having told several clients over the past year that a federal AI law is on the horizon and that finalising an internal AI policy could wait until the picture was clearer. Working through what actually happened to AIDA changes the advice: there's no clearer federal picture coming any time soon, and the agency's own AI policy, and any advice given to clients, should be built around what's genuinely in force today.

That means grounding the policy in PIPEDA's existing fairness and transparency principles as the OPC currently interprets them, plus Quebec's Law 25 for any client or the agency's own customer base with Quebec residents involved, rather than a future framework with no defined return date. The correction here isn't complicated, it's simply updating the starting assumption from "a federal AI law is coming soon" to "nothing is currently coming, plan around what exists."

What you can do about it

Worth noting too: the OPC itself hasn't stood still just because AIDA died. It has committed to publishing updated PIPEDA guidance on automated decision-making specifically because AIDA's expiry left a gap the Commissioner's office is aware of, and it has continued active enforcement against AI-related privacy issues under PIPEDA's existing powers in the meantime, including a real 2026 finding against a major AI provider over an inadequately safeguarded image-generation launch. The absence of new legislation hasn't meant an absence of regulatory activity, it's meant that activity is happening through existing tools rather than a new statute.

A practical way to reset your Canadian AI compliance planning around current reality:

• Stop referencing AIDA or Bill C-27 as pending legislation in any client-facing or internal material, it isn't pending, it's dead.
• Build your actual AI compliance baseline around PIPEDA's current, in-force principles as interpreted by the OPC.
• Check whether Quebec's Law 25 applies based on where your customers, employees, or candidates are, not just where your business is based.
• Watch for a future federal bill if one emerges, but don't build compliance roadmaps around it until it's genuinely progressing through Parliament again.
• Correct any outdated client advice or internal documentation that still describes a federal AI law as imminent.

For what PIPEDA specifically requires of AI use today, see our guide on PIPEDA and AI federal requirements.

Related reading: our AI governance by region.

Try our free AI Compliance Checker to check whether your AI tools meet your compliance obligations.

Could AIDA or something like it come back in the future?

It's possible, and given how far Bill C-27 progressed before dying, a future government could plausibly revive some version of it. But nothing is currently before Parliament as of mid-2026, no draft text, no committee hearings, no announced timeline, and no clear political appetite to revisit the exact same debates that stalled the original bill. Watch for a future bill if one is genuinely introduced, but treat the current absence of federal AI-specific legislation as the real, current state of things rather than a temporary gap waiting to be filled any time soon.

Does the absence of a federal AI law mean AI use in Canada is basically unregulated?

No. PIPEDA already applies to any AI system processing personal information in a commercial context, and the OPC actively interprets its existing principles as covering AI-specific concerns like automated decision-making. Quebec's Law 25 adds real, binding automated-decision rights on top of that for anyone with Quebec-resident customers or employees.

What about the federal government's own use of AI?

The Treasury Board Secretariat's Directive on Automated Decision-Making applies to federal government AI systems specifically, requiring impact assessments and human review at defined risk levels. This is separate from any private-sector obligation and doesn't apply to ordinary businesses.

Should I stop citing sources that mention AIDA as upcoming legislation?

Yes, treat any source describing AIDA as pending or upcoming as out of date unless it's been published after mid-2026 and explicitly acknowledges the repeal. This is a common and easy mistake given how much coverage AIDA received while it was genuinely progressing through Parliament.