Canada AI Compliance 2026: PIPEDA, Law 25, OSFI E-23, AIDA's Demise

Canada has no general AI statute in 2026. AIDA died with Bill C‑27 in 2025: the Artificial Intelligence and Data Act, the AI piece of Bill C‑27, died on the Order Paper when Parliament was prorogued in January 2025. After the April 2025 federal election, the new AI Minister Evan Solomon said the government was not planning to revive AIDA. As of October 2026, no replacement AI statute has been tabled. On June 15, 2026 the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act, which would modernize federal private-sector privacy law, require transparency about automated decision-making for significant decisions, and set penalties up to CAD 10M or 3% of global revenue (fines up to CAD 25M or 5%). As of October 2026 it has completed first reading only. Bill C-34, the Safe Social Media Act (June 10, 2026), would make social media services and AI chatbots safer for children.

This is the most important fact for anyone deploying AI in Canada today. Most online commentary about Canadian AI regulation still treats AIDA as imminent. It is not. The operative federal framework is PIPEDA, augmented by sectoral overlays (OSFI E-23 for FRFIs, Health Canada AI/ML for medical devices) and a province-level statute that has real teeth (Quebec Law 25, fully in force since September 22, 2024).

This is the cornerstone reference for what actually applies to AI deployment in Canada in 2026, written for general counsel, CISOs, heads of risk, and AI program owners. It covers each regime in the order it should be reasoned about, the SR&ED enhancements that change the financial math for AI work, and how AIDOLS structures engagements to satisfy each.

If you want the city-and-country context as well, see the AI consulting Canada country page, the AI consulting Quebec province page, and the AI consulting Ottawa page for federal and regulated-tech buyers. For governance program design specifically, see Governance and Trust.

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to all private-sector organizations in Canada that collect, use, or disclose personal information in the course of commercial activity, regardless of size. For AI systems, PIPEDA applies whenever personal information is ingested, trained on, or output by the system.

What PIPEDA Requires for AI

The Office of the Privacy Commissioner of Canada (OPC), together with provincial counterparts, published "Principles for responsible, trustworthy and privacy-protective generative AI technologies" in December 2023. The principles interpret PIPEDA in the AI context across several dimensions:

• Necessity and proportionality. Personal information processed by an AI system must be necessary for an identified purpose, and the processing must be proportionate to that purpose. AI systems that ingest broad personal information for unspecified future use do not satisfy this principle.
• Meaningful consent. Consent for AI processing must be informed in a way that the individual can actually understand. Buried clauses in terms of service do not satisfy meaningful consent standards.
• Transparency. The existence and operation of AI systems that process personal information must be disclosed in a way that individuals can act on. Opaque systems that produce decisions without explanation fail this requirement.
• Limiting collection, use, and disclosure. AI systems must respect data minimization principles, even when training data is technically more useful at higher volume.
• Accountability. Organizations remain accountable for personal information processed by AI systems, including third-party systems and foundation models accessed via API.

Sector and Province Layers Under PIPEDA

Federally regulated sectors — banking, telecom, airlines, interprovincial rail and transport, broadcasting — are always subject to PIPEDA, including for employee data.

Alberta, British Columbia, and Quebec have private-sector privacy laws that the federal Governor in Council has declared "substantially similar" to PIPEDA, through exemption orders under PIPEDA s. 26(2)(b). Intra-provincial activity in those provinces is generally exempt from PIPEDA, though cross-border data flows remain under PIPEDA. Quebec Law 25, covered in Section 3 below, has materially evolved beyond PIPEDA and now imposes obligations PIPEDA does not.

2025 OPC Guidance and Enforcement Trajectory

The OPC has continued to publish guidance on biometrics, AI data use, and consent through 2025, raising the de facto compliance bar even without statutory reform. The practical effect: PIPEDA expectations for AI deployments in 2026 are materially more demanding than the statute's text alone would suggest. Organizations relying on a 2018-era reading of PIPEDA are out of step with current OPC interpretations.

Source: Office of the Privacy Commissioner of Canada, PIPEDA brief and Principles for responsible, trustworthy and privacy-protective generative AI technologies.

Bill C‑27 — which contained AIDA, the Consumer Privacy Protection Act, and the Personal Information and Data Protection Tribunal Act — died on the Order Paper when Parliament was prorogued in January 2025. After the April 2025 federal election, AI Minister Evan Solomon said in June 2025 that the government was not planning to revive AIDA but would consider which parts to carry forward ("We are not going to just repeat what happened"), and called for "light, tight, right" AI regulation.

As of October 2026, Canada has no enacted federal AI statute. This is the single most important compliance fact for buyers of AI systems in Canada today.

What AIDA Would Have Required (and Why It Is Lapsed)

The original AIDA design targeted "high-impact systems" with obligations covering risk assessment, mitigation, monitoring, transparency, and record-keeping. AIDA left administrative monetary penalty amounts to regulations. Prosecuted breaches of its obligations carried fines up to the greater of CAD 10M or 3% of gross global revenues, and its new criminal offences up to CAD 25M or 5% (Bill C-27, Part 3, ss. 29, 30 and 40). The statute moved through Parliament across 2022–2024, accumulated significant criticism over the breadth of its delegation to regulations, and was overtaken by prorogation before passing.

The companion document published by ISED setting out the original AIDA design remains available as a historical reference, but it has no statutory force.

What Fills the Gap in 2026

In the absence of AIDA, four mechanisms fill the federal AI gap:

1. PIPEDA, as the horizontal privacy framework covered above, plus its emerging AI-specific OPC interpretations.
2. Sectoral regulators — OSFI for FRFIs (E-23, covered below), Health Canada for medical devices, the CSA for securities, the CRTC for telecom and broadcasting — each applying their existing mandates to AI systems within scope.
3. The ISED Voluntary Code of Conduct on Advanced Generative AI Systems, which remains in effect as a voluntary signal of industry expectations. It is non-binding.
4. Provincial privacy law, particularly Quebec Law 25, which now imposes AI-specific obligations PIPEDA does not.

Two federal bills tabled in June 2026 are pending and have completed first reading only: Bill C-36, the Protecting Privacy and Consumer Data Act (privacy modernization, including automated decision-making transparency), and Bill C-34, the Safe Social Media Act (social media services and AI chatbots).

Implications for Buyers

Three practical implications follow from AIDA's death:

• Do not procure AI systems on the assumption AIDA is imminent. Vendor pitches that lead with "AIDA-readiness" are usually selling fear of a regime that no longer exists.
• Do procure AI systems that are PIPEDA-defensible and Law 25-aware. These are the live regimes. A system that satisfies PIPEDA, Law 25 (where applicable), and the relevant sectoral overlay is structurally well-positioned regardless of what eventual federal AI legislation looks like.
• Treat the ISED Voluntary Code as a useful signal but not a compliance floor. It is voluntary, non-enforceable, and intentionally less prescriptive than statutory regimes.

Source: Parliament of Canada, Bill C‑27 LEGISinfo; Hill Notes, Privacy and artificial intelligence in Canada (May 2025); BetaKit, "Light, tight, right" regulation: Minister Evan Solomon unpacks how Canada plans to support domestic AI and quantum computing (June 25, 2025); ISED, Government of Canada tables new legislation to protect children's data, strengthen privacy (June 15, 2026); Parliament of Canada, Bill C-36 LEGISinfo and Bill C-34 LEGISinfo.

Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25 (Loi 25), has been fully in force since September 22, 2024. It is the most consequential AI compliance regime in Canada in 2026 because it is enacted, enforced, and AI-specific in ways PIPEDA is not.

Section 12.1: Automated Decision-Making Disclosure

The section every AI deployment in Quebec needs to know is Section 12.1 of the Private Sector Act. When a decision is based exclusively on automated processing of personal information, the organization must:

• Inform the individual at or before the decision is rendered that the decision is based exclusively on automated processing.
• Provide access to the personal information used to render the decision.
• Accept correction requests for the personal information used.
• Provide the right to submit observations to a person who is in a position to review the decision — that is, the individual must be able to escalate to a human reviewer.

Section 12.1 turns on the word "exclusively." Decisions where a human meaningfully participates in the loop are not subject to Section 12.1, though the human-in-the-loop must be substantive, not nominal. AI systems that produce a recommendation that a human merely rubber-stamps may still fall within Section 12.1 in substance.

Sections 12–14: Consent for AI Processing

Section 14 requires every consent to be clear, free and informed, given for specific purposes and requested for each purpose in clear and simple language; sections 12 and 13 require express consent when sensitive personal information is used for a new purpose or communicated to a third party. These rules apply to AI processing as to any other use. Biometric systems require a prior declaration to the Commission d'accès à l'information (CAI), Quebec's data protection authority, before deployment.

Penalties

Quebec Law 25 imposes two parallel penalty regimes:

• Administrative monetary penalties (AMPs), assessed by the CAI, up to CAD 10M or 2% of global turnover, whichever is greater.
• Penal fines, prosecuted in the courts, up to CAD 25M or 4% of global worldwide turnover, whichever is greater.

Law 25 also introduced a private right of action for damages, allowing individuals to sue directly for breaches. Penalty exposure in Quebec is now structurally on par with EU GDPR fines.

Other Law 25 Obligations Relevant to AI

• Right to data portability, activated September 22, 2024 — individuals can demand computerized personal information in a structured, commonly used format.
• Privacy impact assessments required for the acquisition, development, or redesign of information systems involving personal information, including AI systems. That can include rolling out an assistant such as Microsoft 365 Copilot across the organization; our guide to Microsoft Copilot governance and oversharing covers the assessment and the permission fixes to make first.
• Privacy by default for technology products and services offered to the public.

Enforcement Posture

The CAI has been active since the September 2024 full-in-force date. Biometrics is a visible focus: biometric-system disclosures to the CAI rose 206% over three years, with 104 received in 2024-2025 (CAI annual report 2024-2025). Organizations that treated 2024–2025 as a soft-launch grace period are now operating in an enforcement environment.

Source: BLG, Quebec's Private Sector Act compliance guide for organizations (2026); Commission d'accès à l'information du Québec, CAI; RCGT, Law 25 issue: automated decisions.

PIPEDA and Law 25 operate horizontally across sectors. Layered on top are sector-specific overlays that apply additional obligations within their respective mandates.

OSFI Guideline E-23: Model Risk Management for FRFIs

OSFI Guideline E-23 on model risk management was finalized September 11, 2025, and is effective May 1, 2027. The guideline materially expands OSFI's model risk management expectations and is the single most important AI compliance regime for federally regulated financial institutions in Canada.

Scope expanded. E-23 now applies to all federally regulated financial institutions — including foreign bank branches, life insurance companies, and property and casualty insurers — not just banks, trusts, and loans as in the previous version.

Models in scope. E-23 covers all models regardless of source (internal or third-party), explicitly including AI and ML systems. This is the operative federal AI regime for FRFIs.

Lifecycle controls required. FRFIs must maintain enterprise-wide model risk management frameworks covering:

• Model identification and inventory
• Risk-tiered governance proportionate to model materiality
• Development, validation, deployment, monitoring, and decommissioning controls
• Independent model validation
• Performance monitoring against pre-defined thresholds

Third-party vendor governance gap. E-23 makes no allowance for vendors that will not share documentation: OSFI says it is up to each institution to ensure vendors provide adequate documentation. Torys notes that many AI/ML vendors may not yet have the governance, validation and reporting capabilities E-23 expects, so FRFIs may carry residual risk. This is a procurement implication: FRFIs cannot assume third-party AI providers will deliver E-23-compliant documentation by default. The contracting and SLA work must specify it.

The May 2027 effective date is not a delay. FRFIs that wait until 2027 to begin E-23 alignment will not be ready. When OSFI proposed a 12-month implementation period, stakeholders said it was too short and asked for three years; OSFI set May 1, 2027, an 18-month transition, noting that many institutions had already begun the work.

Source: OSFI, Backgrounder: Guideline E-23 — Model Risk Management; Blakes, OSFI releases final Guideline E-23 for model risk management and AI use by FRFIs; Torys, OSFI updates and expands scope of Guideline E-23; OSFI, Letter on the final Guideline E-23 (September 11, 2025).

Health Canada AI/ML Medical Device Guidance

For AI systems that meet the medical device definition under the Food and Drugs Act, Health Canada AI/ML guidance applies on top of PIPEDA. The guidance covers:

• Predetermined change control plans for AI/ML models that learn or update post-deployment
• Post-market performance monitoring with reporting obligations against pre-defined performance thresholds
• Clinical validation evidence appropriate to the device class
• Quality management system integration covering AI/ML lifecycle

Health Canada's posture on AI medical devices has converged with the FDA's pattern of guidance, though the Canadian process differs in classification thresholds and submission pathways. Coordinate Health Canada submission timelines with the deployment plan. AI medical device retrofitting after launch is materially more expensive than designing for the regulatory pathway from the start.

Other Sectoral Layers

The CSA (securities) and CRTC (telecom and broadcasting) apply their existing mandates to AI systems within scope, with active guidance development across both. The Bank of Canada publishes staff research on AI and financial stability, and co-sponsored the FIFAI II forum with OSFI, Finance Canada, FINTRAC, FCAC and the Global Risk Institute; the forum's March 2026 report states it is not guidance.

Federal SR&ED — the Scientific Research and Experimental Development tax incentive — is the largest single source of innovation funding available to Canadian organizations doing AI work. The 2024 Fall Economic Statement and Budget 2025 together made three structural changes that materially affect the financial math:

The Three Changes

1. Enhanced expenditure limit raised from CAD 3M to CAD 4.5M (2024 Fall Economic Statement) and then to CAD 6M (Budget 2025) for the 35% refundable rate. Maximum refundable amount roughly CAD 2.1M annually. Effective for tax years beginning on or after December 16, 2024.
2. Capital expenditures restored as eligible for both ITC and deduction, for property acquired after December 15, 2024. R&D equipment, GPU clusters, edge devices, and prototype systems are eligible again after a multi-year exclusion.
3. Eligible Canadian public corporations can claim the enhanced rate for the first time (Canadian-resident, listed and not controlled by non-residents), broadening the program beyond the traditional CCPC-only restriction. Their expenditure limit phases out between CAD 15M and CAD 75M of average gross revenue.

Administrative Improvements

Since April 1, 2026, the CRA has offered elective pre-claim approval, and Budget 2025 directs it to use more AI so low-risk claims avoid unnecessary audits. For claims with pre-approved projects that need an expenditure review, processing time is halved from 180 to 90 days (Budget 2025; CRA, April 8, 2026). Combined with pre-claim approval, SR&ED is moving from a slow refund to a financing instrument for organizations with mature documentation practices.

What AI Work Qualifies

AI consulting work qualifies when it advances scientific or technological knowledge through experimental development beyond routine engineering. Examples that routinely qualify:

• Custom AI model development for novel use cases
• Novel optimization algorithms for industry-specific problems
• Proprietary computer vision systems trained on operator-specific data
• MLOps tooling that solves novel monitoring or drift-detection problems
• Reinforcement learning systems with non-trivial reward shaping
• Generative AI applications that go beyond API integration

Examples that typically do not qualify on their own:

• Routine API integration with existing foundation models
• Standard data engineering work with off-the-shelf tools
• Conventional dashboarding and reporting

Source: PwC Canada, SR&ED changes 2025; KPMG Canada, Canada's SR&ED program enters a new era; Canada Revenue Agency, SR&ED program; Department of Finance, 2024 Fall Economic Statement, tax measures; Budget 2025, Chapter 1; Canada Revenue Agency, SR&ED pre-claim approval process.

The table below maps each Canadian compliance regime to the corresponding AIDOLS engagement design choice. The principle: regulatory alignment is a design parameter, not bolt-on compliance work after deployment.

The cross-cutting principle is design for the strictest applicable regime. An engagement that satisfies OSFI E-23 plus Quebec Law 25 plus PIPEDA produces a system that is well-positioned regardless of how the federal AI policy environment evolves. That structural posture is more valuable than chasing each new draft regulation as it appears.

Three patterns are worth flagging because they show up consistently in 2026 deployments:

Multi-regime stacking is the rule, not the exception. A typical FRFI deployment in Quebec is simultaneously subject to PIPEDA, Law 25, OSFI E-23, and (if it touches medical claims data) Health Canada guidance. Designing for one regime in isolation produces a system that fails another.

The third-party AI provider gap is real. Under E-23, OSFI leaves vendor documentation to the institution, but the issue extends beyond financial services. AI providers that cannot deliver regime-aligned documentation force clients to retrofit it themselves, which is more expensive and less defensible than designing for it from the start.

SR&ED is now part of the financial architecture, not a tax afterthought. With the enhanced cap, restored capital eligibility, and faster processing for pre-approved projects, organizations that integrate SR&ED documentation into the engagement workstream finance a meaningful share of AI program cost through the credit. Organizations that treat SR&ED as a year-end exercise leave money on the table.

If you are deploying AI in Canada in 2026, the practical sequence is:

1. Inventory the personal information your AI systems touch. This is the foundational artefact for PIPEDA, Law 25, and most sectoral regimes.
2. Identify the strictest applicable regime. For most financial services deployments, this is OSFI E-23. For most Quebec deployments touching personal information, this is Law 25. For most healthcare deployments, this is Health Canada guidance plus PIPEDA.
3. Design for that regime as a parameter, not a constraint. Privacy-by-design, model risk management, ADM disclosure flows, and SR&ED documentation are all easier to build in than to retrofit.
4. Choose providers who can deliver regime-aligned documentation as a deliverable. Vendors who ask you to do the compliance work yourself are not reducing your cost — they are deferring it.
5. Treat SR&ED as financial architecture, not a tax afterthought. Real-time documentation under Budget 2025's enhanced rules can finance a meaningful share of program cost.

If you are evaluating AI deployment in Canada, start with the free AI readiness assessment: 7–8 questions, about 5 minutes, and a 0–100 score across strategy, data, tooling, team and governance, with three next steps. It scores governance at a high level; it does not map your use cases to regulations. For a prioritized use-case map with ROI estimates and a 90-day implementation roadmap with named owners, the Sprint is a paid diagnostic ($15K–$25K, 2–3 weeks).

Start Your Assessment — free, about 5 minutes, no signup to start. Boards comparing this against external counsel can review fixed-fee AI consulting pricing, the Toronto AI consulting buyer's guide, and the AI governance definition in our glossary to align Canadian compliance terminology before kickoff.

AIDOLS is an AI-native consulting firm delivering production AI systems in Canada under PIPEDA, Quebec Law 25, OSFI E-23, and Health Canada AI/ML guidance. Learn more about our Canada-wide engagements, our Quebec province practice, our Ottawa federal and regulated-tech work, and our Governance and Trust program design.