Canada's AI Regulatory Landscape: AIDA, Bill C-27, and the Provincial Patchwork

The Legislative Status of AIDA and Bill C-27

Bill C-27, the Digital Charter Implementation Act 2022, contained the proposed Artificial Intelligence and Data Act (AIDA) alongside privacy reform provisions known as the Consumer Privacy Protection Act. The bill had been referred to the House of Commons Standing Committee on Industry and Technology for clause-by-clause review, a process it had not completed when Parliament was prorogued in January 2025.

Under Canadian parliamentary procedure, prorogation causes bills that have not received royal assent to die on the Order Paper. AIDA was never enacted and currently has no legal force.

In 2023, Innovation, Science and Economic Development Canada released a companion document proposing amendments to AIDA, including a schedule-based approach to defining "high-impact AI systems" and an enforcement model built around a new AI and Data Commissioner housed within ISED. These proposals describe ISED's intended direction as of that document's publication, not enacted obligations. It is not established whether or when a successor bill will be reintroduced.

What Currently Governs AI in Canada

In the absence of AIDA, AI systems that process personal information in Canada remain subject to existing privacy statutes. The applicable statute depends on deployment jurisdiction and the type of personal information involved.

PIPEDA (federal private sector)

PIPEDA continues to apply as the federal private-sector privacy law in provinces without their own substantially similar legislation. It does not include AI-specific provisions, but its accountability, consent, and accuracy principles apply to AI systems that process personal information.

Quebec's Law 25

Quebec's Law 25 amends the province's private-sector privacy statute to require organizations to inform individuals when a decision is based exclusively on automated processing, and to explain the personal information and the principal factors and parameters used to reach that decision. This is the most specific AI-related binding obligation currently in force at the provincial level in Canada.

TBS Directive on Automated Decision-Making

The Treasury Board of Canada Secretariat's Directive on Automated Decision-Making requires algorithmic impact assessments for automated decision systems within federal institutions. The directive uses a structured scoring tool to determine the required level of human oversight. It binds federal institutions rather than private industry.

Provincial guidance (non-binding)

Ontario has published a trustworthy AI framework directed at public-sector AI use. No Canadian province has enacted a comprehensive AI-specific law comparable in scope to AIDA. Provincial AI governance is expressed primarily through privacy law amendments and non-binding guidance documents.

What AIDA Would Have Required, If Enacted

As proposed, AIDA would have imposed obligations on persons responsible for "high-impact" AI systems spanning design, development, and deployment stages, including documented risk assessment, mitigation measures, ongoing monitoring, and record-keeping.

The 2023 companion document favored a schedule-based classification of high-impact systems over a single uniform standard, an approach structurally similar to risk-tiered frameworks elsewhere but narrower in scope as drafted. AIDA's proposed obligations emphasized documented risk assessment and mitigation rather than prescriptive technical standards, leaving decisions such as explainability method or audit-log format to the regulated organization.

Enforcement, as proposed, would have been carried out by a new AI and Data Commissioner within ISED, with authority to order audits and impose administrative monetary penalties. None of these mechanisms are currently in force. Organizations should treat the companion document as a description of legislative intent from the 2023 to 2024 committee process, not as a binding compliance standard.

Compliance Actions to Take Now

Because no single federal AI statute currently applies, compliance requires mapping each AI use case to the specific statutes that actually govern it based on jurisdiction and data type. The following actions reflect obligations that are enforceable today.

• Map each AI use case to the specific statutes that apply, such as PIPEDA, Quebec's Law 25, Alberta PIPA, or BC PIPA, based on jurisdiction and personal information involved. Do not assume one national AI law governs the deployment.
• Build a standing capability to produce automated-decision transparency disclosures covering personal information used and principal factors or parameters, to meet Quebec's Law 25 requirement and anticipate similar expectations in other provinces.
• Assign explicit internal ownership for tracking the legislative status of AIDA or any successor federal AI bill. Bill C-27 already lapsed once after prorogation, and a successor bill may be reintroduced with amended scope.
• For AI systems used in federal or provincial government contracts, benchmark internal risk documentation against the TBS Algorithmic Impact Assessment structure, since public-sector procurement may reference it directly.
• Remove any customer-facing language that implies AIDA compliance or AI-specific federal certification, since no such framework is currently in force.

Designing Controls That Outlast Legislative Uncertainty

Because Canada's AI regulatory landscape remains unsettled, the most durable governance posture is one that can be remapped to new statutory requirements without redesigning underlying controls. The following design principles support that goal.

Where Runtime Governance Fits

Regardless of which statute currently applies to a given AI deployment, the operational requirement is consistent: classify systems by risk, enforce least-privilege access for the agents and tools involved, log decisions and actions for audit, and be able to demonstrate this at the point of execution rather than only in policy documents.

Runtime governance platforms such as Trussed AI apply these controls, including agent identity, permissions, tool approval workflows, and audit logging, directly to AI agent and MCP-based deployments. This does not constitute compliance with AIDA, Law 25, or any other statute. It is an operational layer that can support the record-keeping and monitoring capabilities that current privacy law, and any future AI-specific law, are likely to require.