AI regulation in Canada has no single statute. The Artificial Intelligence and Data Act died with Bill C-27 in January 2025. The June 2026 national strategy did not revive it. An Alberta business using AI answers to privacy law, human rights law, sector rules and its own contracts.
Legal status verified 23 September 2026. Not legal advice.
Someone in a board meeting is going to say “we need to be compliant with the Canadian AI Act.” There is no Canadian AI Act.
The confusion is understandable. For about two years there was a bill, it was widely covered, and plenty of content was written as if it had passed. The Artificial Intelligence and Data Act was one part of Bill C-27. It was still in committee when Parliament was prorogued (the session formally ended) in January 2025, and the bill died there. Nothing has replaced it.
On 4 June 2026 the federal government released its national AI strategy, AI for All. It is a spending strategy: $500 million for the Business Development Bank’s LIFT program, $700 million for compute access, $50 million for the Canadian AI Safety Institute, and a target of lifting business AI adoption from 12% to 60% by 2034. On a standalone AI statute, it declined. The stated plan is updated privacy law, new online safety law and the regulators that already exist. It is the clearest signal yet of what AI in Canada looks like for business over the next few years.
So the honest summary is that Canada decided to fund adoption rather than legislate it, and left the existing rules to do the governing.
Those existing rules are the ones that bind you, and it is easy to be offside on one without knowing it. It comes up in most of the AI consulting work I do in Calgary and across the rest of Alberta.
A note before the list. I am not a lawyer, and nothing here is legal advice. This is a map of what applies, written for owners who need to know which conversation to have with counsel.
AI regulation in Canada comes from five sets of rules that already apply
1. Alberta’s Personal Information Protection Act. PIPA is Alberta’s private-sector privacy law. It governs how organizations collect, use and disclose personal information. It predates modern AI by a wide margin and says nothing about models. That does not make it inapplicable. Feeding customer records into a third-party model is a use and a disclosure, so consent, purpose limits (using data only for the reason you collected it) and reasonable security all attach to it, exactly as they would to any other system.
2. PIPEDA. The federal private-sector privacy law applies to personal information that crosses provincial or national borders in the course of commercial activity, even for a business based in Alberta. An Alberta company with customers in other provinces, or a vendor in the United States, is in scope for parts of its operations while PIPA governs the rest.
3. The Alberta Human Rights Act. If a model influences hiring, promotion, tenancy, lending or service decisions, and its outputs correlate with a protected ground, the discrimination is yours. The statute does not care that a vendor built the model. Nobody has to prove you intended it.
4. Sector and professional obligations. Health custodians fall under the Health Information Act, and Alberta’s privacy commissioner has published guidance for small custodians using AI. Regulated professionals carry obligations from their colleges. Financial institutions carry theirs. These are usually stricter than anything a general AI law would impose.
5. Your own contracts. This is the one that bites first and gets discussed last. Client agreements with confidentiality clauses, master service agreements with data-handling schedules, and non-disclosure agreements signed years ago rarely contemplate a staff member pasting the material into a chatbot. The breach is contractual, it is immediate, and no regulator has to be involved for it to cost you the account.
The two AI-specific Canadian rules that do exist
Neither is Alberta law. Both reach Alberta companies.
Quebec. Law 25 requires organizations to tell people when a decision about them is based exclusively on automated processing of their personal information, and to let them submit observations to someone who can review it. An Alberta company with Quebec customers is in scope for those customers.
Ontario. From 1 January 2026, employers with 25 or more employees who use AI to screen, assess or select applicants must disclose that use in publicly advertised job postings. The rule covers jobs in Ontario, and it holds even when a third-party recruiter does the screening. The regulation defines AI broadly, as a machine-based system that infers from its input to generate outputs.
If you are an Alberta company posting a job for an Ontario role and your applicant tracking system ranks candidates, that rule is yours.
What Alberta’s own privacy commissioner has asked for
In August 2025 the Office of the Information and Privacy Commissioner of Alberta published a report recommending a standalone provincial AI law alongside modernized privacy laws. The recommended shape borrows from the EU AI Act: safety requirements, transparency, anti-discrimination safeguards, and human oversight for high-risk decisions.
That report creates no obligations. It does two useful things. It tells you where Alberta is heading, and it tells you what the regulator considers reasonable conduct today, which matters if you ever have to explain yourself. The commissioner’s current advice to organizations is to follow published guidance, apply privacy-by-design, watch international developments, and maintain internal policies covering accountability, transparency and oversight.
Alberta has also been consulting on updates to PIPA, including a public survey in February 2026.
If you sell into Europe
The EU AI Act applies based on where the system is used and who it affects, not where the company is registered. An Alberta software company with European customers, or one whose product is embedded in a European client’s operations, should get advice on this specifically. It is the strictest regime any Alberta company is likely to touch, and it is the one the Alberta commissioner pointed at as a model.
What to do this quarter
Four things, none of which require a lawyer to start. Together they are the short version of AI governance for Canadian businesses. If you only get to one this week, make it the contracts.
Find out what is already in use. Every company that has run this exercise has found tools nobody approved. Treat that as a baseline, with nobody in trouble for it. It is the whole reason shadow AI in your company is worth an afternoon.
Write one page. What tools are approved, what data may never go into any of them, what has to have a human decision attached, and who to ask. One page that people read beats twelve pages that sit in a shared drive. The AI governance checklist is the version to work from.
Check the three decision points. Hiring, credit or pricing, and anything affecting a customer’s access to service. Those are where the human rights exposure sits and where a model shaping an outcome unnoticed does the most damage.
Read your top five client contracts. Specifically the confidentiality and subcontractor clauses. If a clause would be breached by pasting client material into a third-party model, that is a rule with teeth today, regardless of what Parliament does next.
So Canada has no AI act and your business still has rules. They sit across five statutes, two provinces and your own filing cabinet. Nobody is going to send you a compliance deadline to make you look.
When the federal legislation eventually arrives, and the strategy’s language suggests privacy reform first, the companies that already know what they run and what their data does will be doing paperwork. The rest will be doing discovery. If you want help working out which category you are in, start here.
Questions people ask
No. Canada has no general artificial intelligence statute. The Artificial Intelligence and Data Act was part of Bill C-27, which died when Parliament was prorogued in January 2025. The national AI strategy published on 4 June 2026 did not revive standalone AI legislation and instead relies on privacy reform, online safety law and existing regulators.
It never came into force. AIDA was one part of Bill C-27, which was still in committee in the House of Commons when Parliament was prorogued in January 2025, so the bill died. No successor bill has been introduced, and the June 2026 national strategy chose privacy reform and online safety law instead.
Alberta’s Personal Information Protection Act, the federal PIPEDA for interprovincial and international commercial activity, the Alberta Human Rights Act where AI influences decisions about people, the Health Information Act for health custodians, sector and professional obligations, and the company’s own contractual commitments on confidentiality and data handling.
No statute requires one for a private Alberta business. Alberta’s privacy commissioner advises organizations to maintain internal policies covering accountability, transparency, oversight and compliance with existing laws. A short written policy is also the fastest way to prevent the contractual and privacy problems that do carry consequences today.
In Ontario, yes. From 1 January 2026, employers with 25 or more employees must disclose the use of AI to screen, assess or select applicants in publicly advertised job postings, and the obligation stays with the employer even when a third-party recruiter does the screening. Alberta has no equivalent requirement.
The Office of the Information and Privacy Commissioner of Alberta recommended a standalone provincial AI statute in an August 2025 report, and the province has been consulting on updates to the Personal Information Protection Act. No Alberta AI legislation has been introduced as of 17 September 2026.
