Canada AI Compliance 2026: PIPEDA, AIDA, Law 25, OSFI

Reviewed by AIDOLS Research Report Team · Last updated 2026-05-02

Canada has no general AI statute in 2026. The Artificial Intelligence and Data Act — AIDA, the AI piece of Bill C-27 — died on the Order Paper when Parliament was prorogued in January 2025. After the April 2025 federal election, the new AI Minister Evan Solomon publicly stated AIDA will not return in its old form. As of April 2026, the federal AI bill that dominated Canadian AI policy conversation from 2022 through 2024 is gone, and no replacement statute has been tabled.

This is the most important fact for anyone deploying AI in Canada today. Most online commentary about Canadian AI regulation still treats AIDA as imminent. It is not. The operative federal framework is PIPEDA, augmented by sectoral overlays (OSFI E-23 for FRFIs, Health Canada AI/ML for medical devices) and a province-level statute that has real teeth (Quebec Law 25, fully in force since September 22, 2024).

This is the cornerstone reference for what actually applies to AI deployment in Canada in 2026, written for general counsel, CISOs, heads of risk, and AI program owners. It covers each regime in the order it should be reasoned about, the SR&ED enhancements that change the financial math for AI work, and how AIDOLS structures engagements to satisfy each.

If you want the city-and-country context as well, see the AI consulting Canada country pillar, the AI consulting Quebec province pillar, and the AI consulting Ottawa page for federal and regulated-tech buyers. For governance program design specifically, see Governance and Trust.

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to all private-sector organizations in Canada that collect, use, or disclose personal information in the course of commercial activity, regardless of size. For AI systems, PIPEDA applies whenever personal information is ingested, trained on, or output by the system.

What PIPEDA Requires for AI

The Office of the Privacy Commissioner of Canada (OPC), together with provincial counterparts, published "Principles for responsible, trustworthy and privacy-protective generative AI technologies" in December 2023. The principles interpret PIPEDA in the AI context across several dimensions:

• Necessity and proportionality. Personal information processed by an AI system must be necessary for an identified purpose, and the processing must be proportionate to that purpose. AI systems that ingest broad personal information for unspecified future use do not satisfy this principle.
• Meaningful consent. Consent for AI processing must be informed in a way that the individual can actually understand. Buried clauses in terms of service do not satisfy meaningful consent standards.
• Transparency. The existence and operation of AI systems that process personal information must be disclosed in a way that individuals can act on. Opaque systems that produce decisions without explanation fail this requirement.
• Limiting collection, use, and disclosure. AI systems must respect data minimization principles, even when training data is technically more useful at higher volume.
• Accountability. Organizations remain accountable for personal information processed by AI systems, including third-party systems and foundation models accessed via API.

Sector and Province Layers Under PIPEDA

Federally regulated sectors — banking, telecom, airlines, interprovincial rail and transport, broadcasting — are always subject to PIPEDA, including for employee data.

Alberta, British Columbia, and Quebec have private-sector privacy laws that the OPC has declared "substantially similar" to PIPEDA. Intra-provincial activity in those provinces is generally exempt from PIPEDA, though cross-border data flows remain under PIPEDA. Quebec Law 25, covered in Section 3 below, has materially evolved beyond PIPEDA and now imposes obligations PIPEDA does not.

2025 OPC Guidance and Enforcement Trajectory

The OPC has continued to publish guidance on biometrics, AI data use, and consent through 2025, raising the de facto compliance bar even without statutory reform. The practical effect: PIPEDA expectations for AI deployments in 2026 are materially more demanding than the statute's text alone would suggest. Organizations relying on a 2018-era reading of PIPEDA are out of step with current OPC interpretations.

Source: Office of the Privacy Commissioner of Canada, PIPEDA brief and Principles for responsible, trustworthy and privacy-protective generative AI technologies.

Bill C-27 — which contained AIDA, the Consumer Privacy Protection Act, and the Personal Information and Data Protection Tribunal Act — died on the Order Paper when Parliament was prorogued in January 2025. After the April 2025 federal election, AI Minister Evan Solomon publicly stated AIDA "will not return in its old form" and signalled a "light, tight, right" replacement framework.

As of April 2026, Canada has no enacted federal AI statute. This is the single most important compliance fact for buyers of AI systems in Canada today.

What AIDA Would Have Required (and Why It Is Lapsed)

The original AIDA design targeted "high-impact systems" with obligations covering risk assessment, mitigation, monitoring, transparency, and record-keeping. Proposed administrative monetary penalties ran up to the greater of CAD 10M or 3% of global revenue, with criminal penalties up to CAD 25M or 5%. The statute moved through Parliament across 2022-2024, accumulated significant criticism over the breadth of its delegation to regulations, and was overtaken by prorogation before passing.

The companion document published by ISED setting out the original AIDA design remains available as a historical reference, but it has no statutory force.

What Fills the Gap in 2026

In the absence of AIDA, four mechanisms fill the federal AI gap:

1. PIPEDA, as the horizontal privacy framework covered above, plus its emerging AI-specific OPC interpretations.
2. Sectoral regulators — OSFI for FRFIs (E-23, covered below), Health Canada for medical devices, the CSA for securities, the CRTC for telecom and broadcasting — each applying their existing mandates to AI systems within scope.
3. The ISED Voluntary Code of Conduct on Advanced Generative AI Systems, which remains in effect as a voluntary signal of industry expectations. It is non-binding.
4. Provincial privacy law, particularly Quebec Law 25, which now imposes AI-specific obligations PIPEDA does not.

Implications for Buyers

Three practical implications follow from AIDA's death:

• Do not procure AI systems on the assumption AIDA is imminent. Vendor pitches that lead with "AIDA-readiness" are usually selling fear of a regime that no longer exists.
• Do procure AI systems that are PIPEDA-defensible and Law 25-aware. These are the live regimes. A system that satisfies PIPEDA, Law 25 (where applicable), and the relevant sectoral overlay is structurally well-positioned regardless of what eventual federal AI legislation looks like.
• Treat the ISED Voluntary Code as a useful signal but not a compliance floor. It is voluntary, non-enforceable, and intentionally less prescriptive than statutory regimes.

Source: Parliament of Canada, Bill C-27 LEGISinfo; Hill Notes, Privacy and artificial intelligence in Canada (May 2025).

Quebec's Act respecting the protection of personal information in the private sector — known as Law 25 or Loi 25 — has been fully in force since September 22, 2024. It is the most consequential AI compliance regime in Canada in 2026 because it is enacted, enforced, and AI-specific in ways PIPEDA is not.

Section 12.1: Automated Decision-Making Disclosure

The section every AI deployment in Quebec needs to know is Section 12.1. When a decision is based exclusively on automated processing of personal information, the organization must:

• Inform the individual at or before the decision is rendered that the decision is based exclusively on automated processing.
• Provide access to the personal information used to render the decision.
• Accept correction requests for the personal information used.
• Provide the right to submit observations to a person who is in a position to review the decision — that is, the individual must be able to escalate to a human reviewer.

Section 12.1 turns on the word "exclusively." Decisions where a human meaningfully participates in the loop are not subject to Section 12.1, though the human-in-the-loop must be substantive, not nominal. AI systems that produce a recommendation that a human merely rubber-stamps may still fall within Section 12.1 in substance.

Section 14: Consent for AI Processing

Section 14 governs informed and express consent for personal information processing in AI contexts. Biometric systems require a prior declaration to the Commission d'accès à l'information (CAI), Quebec's data protection authority, before deployment.

Penalties

Quebec Law 25 imposes two parallel penalty regimes:

• Administrative monetary penalties (AMPs), assessed by the CAI, up to CAD 10M or 2% of global turnover, whichever is greater.
• Penal fines, prosecuted in the courts, up to CAD 25M or 4% of global worldwide turnover, whichever is greater.

Law 25 also introduced a private right of action for damages, allowing individuals to sue directly for breaches. Penalty exposure in Quebec is now structurally on par with EU GDPR fines.

Other Law 25 Obligations Relevant to AI

• Right to data portability, activated September 22, 2024 — individuals can demand computerized personal information in a structured, commonly used format.
• Privacy impact assessments required for the acquisition, development, or redesign of information systems involving personal information, including AI systems.
• Privacy by default for technology products and services offered to the public.

Enforcement Posture

The CAI has been active since the September 2024 full-in-force date. Biometric systems and ADM disclosure obligations are among the early enforcement priorities. Organizations that treated 2024-2025 as a soft-launch grace period are now operating in an enforcement environment.

Source: BLG, Quebec's Private Sector Act compliance guide for organizations (2026); Commission d'accès à l'information du Québec, CAI; RCGT, Law 25 issue: automated decisions.

PIPEDA and Law 25 operate horizontally across sectors. Layered on top are sector-specific overlays that apply additional obligations within their respective mandates.

OSFI Guideline E-23: Model Risk Management for FRFIs

OSFI Guideline E-23 on model risk management was finalized September 11, 2025, and is effective May 1, 2027. The guideline materially expands OSFI's model risk management expectations and is the single most important AI compliance regime for federally regulated financial institutions in Canada.

Scope expanded. E-23 now applies to all federally regulated financial institutions — including foreign bank branches, life insurance companies, and property and casualty insurers — not just banks, trusts, and loans as in the previous version.

Models in scope. E-23 covers all models regardless of source (internal or third-party), explicitly including AI and ML systems. This is the operative federal AI regime for FRFIs.

Lifecycle controls required. FRFIs must maintain enterprise-wide model risk management frameworks covering:

• Model identification and inventory
• Risk-tiered governance proportionate to model materiality
• Development, validation, deployment, monitoring, and decommissioning controls
• Independent model validation
• Performance monitoring against pre-defined thresholds

Third-party vendor governance gap. OSFI explicitly flagged that many AI/ML vendors lack the documentation and validation maturity to meet E-23, leaving residual risk on the FRFI. This is a procurement implication: FRFIs cannot assume third-party AI providers will deliver E-23-compliant documentation by default. The contracting and SLA work must specify it.

The May 2027 effective date is not a delay. FRFIs that wait until 2027 to begin E-23 alignment will not be ready. The framework, inventory, validation discipline, and monitoring infrastructure required take 12-24 months to build at scale.

Source: OSFI, Backgrounder: Guideline E-23 — Model Risk Management; Blakes, OSFI releases final Guideline E-23 for model risk management and AI use by FRFIs; Torys, OSFI updates and expands scope of Guideline E-23.

Health Canada AI/ML Medical Device Guidance

For AI systems that meet the medical device definition under the Food and Drugs Act, Health Canada AI/ML guidance applies on top of PIPEDA. The guidance covers:

• Predetermined change control plans for AI/ML models that learn or update post-deployment
• Post-market performance monitoring with reporting obligations against pre-defined performance thresholds
• Clinical validation evidence appropriate to the device class
• Quality management system integration covering AI/ML lifecycle

Health Canada's posture on AI medical devices has converged with the FDA's pattern of guidance, though the Canadian process differs in classification thresholds and submission pathways. Coordinate Health Canada submission timelines with the deployment plan. AI medical device retrofitting after launch is materially more expensive than designing for the regulatory pathway from the start.

Other Sectoral Layers

The CSA (securities) and CRTC (telecom and broadcasting) apply their existing mandates to AI systems within scope, with active guidance development across both. The Bank of Canada has issued staff research and guidance on AI in financial services that complements OSFI E-23 without duplicating it.

Federal SR&ED — the Scientific Research and Experimental Development tax incentive — is the largest single source of innovation funding available to Canadian organizations doing AI work. Budget 2025 made three structural changes that materially affect the financial math:

The Three Budget 2025 Changes

1. Enhanced expenditure limit raised from CAD 3M to CAD 6M for the 35% refundable rate. Maximum refundable amount roughly CAD 2.1M annually. Effective for tax years beginning on or after December 16, 2024.
2. Capital expenditures restored as eligible for both ITC and deduction, for property acquired after December 15, 2024. R&D equipment, GPU clusters, edge devices, and prototype systems are eligible again after a multi-year exclusion.
3. Public companies eligible for the enhanced rate for the first time, broadening the program beyond the traditional CCPC-only restriction.

Administrative Improvements

The CRA is moving to AI-driven review and pre-claim approval. Review processing time is cut from 180 to 90 days, with administrative changes effective April 1, 2026. Combined with pre-claim approval, SR&ED is moving from a slow refund to a financing instrument for organizations with mature documentation practices.

What AI Work Qualifies

AI consulting work qualifies when it advances scientific or technological knowledge through experimental development beyond routine engineering. Examples that routinely qualify:

• Custom AI model development for novel use cases
• Novel optimization algorithms for industry-specific problems
• Proprietary computer vision systems trained on operator-specific data
• MLOps tooling that solves novel monitoring or drift-detection problems
• Reinforcement learning systems with non-trivial reward shaping
• Generative AI applications that go beyond API integration

Examples that typically do not qualify on their own:

• Routine API integration with existing foundation models
• Standard data engineering work with off-the-shelf tools
• Conventional dashboarding and reporting

Source: PwC Canada, SR&ED changes 2025; KPMG Canada, Canada's SR&ED program enters a new era; Canada Revenue Agency, SR&ED program.

The table below maps each Canadian compliance regime to the corresponding AIDOLS engagement design choice. The principle: regulatory alignment is a design parameter, not bolt-on compliance work after deployment.

The cross-cutting principle is design for the strictest applicable regime. An engagement that satisfies OSFI E-23 plus Quebec Law 25 plus PIPEDA produces a system that is well-positioned regardless of how the federal AI policy environment evolves. That structural posture is more valuable than chasing each new draft regulation as it appears.

Three patterns are worth flagging because they show up consistently in 2026 deployments:

Multi-regime stacking is the rule, not the exception. A typical FRFI deployment in Quebec is simultaneously subject to PIPEDA, Law 25, OSFI E-23, and (if it touches medical claims data) Health Canada guidance. Designing for one regime in isolation produces a system that fails another.

The third-party AI provider gap is real. OSFI explicitly flagged this for E-23, but the issue extends beyond financial services. AI providers that cannot deliver regime-aligned documentation force clients to retrofit it themselves, which is more expensive and less defensible than designing for it from the start.

SR&ED is now part of the financial architecture, not a tax afterthought. With Budget 2025's enhanced cap, restored capital eligibility, and 90-day processing, organizations that integrate SR&ED documentation into the engagement workstream finance a meaningful share of AI program cost through the credit. Organizations that treat SR&ED as a year-end exercise leave money on the table.

If you are deploying AI in Canada in 2026, the practical sequence is:

1. Inventory the personal information your AI systems touch. This is the foundational artefact for PIPEDA, Law 25, and most sectoral regimes.
2. Identify the strictest applicable regime. For most financial services deployments, this is OSFI E-23. For most Quebec deployments touching personal information, this is Law 25. For most healthcare deployments, this is Health Canada guidance plus PIPEDA.
3. Design for that regime as a parameter, not a constraint. Privacy-by-design, model risk management, ADM disclosure flows, and SR&ED documentation are all easier to build in than to retrofit.
4. Choose providers who can deliver regime-aligned documentation as a deliverable. Vendors who ask you to do the compliance work yourself are not reducing your cost — they are deferring it.
5. Treat SR&ED as financial architecture, not a tax afterthought. Real-time documentation under Budget 2025's enhanced rules can finance a meaningful share of program cost.

If you are evaluating AI deployment in Canada and need a structured view of which regimes apply, what each requires, and how to design for them, the most efficient next step is a structured AI readiness assessment. The assessment maps your highest-value use cases against the applicable Canadian regulatory regimes, identifies the design choices that satisfy each, and produces a 90-day deployment plan tied to compliance and operational KPIs.

Start Your Assessment — free, structured, and designed to give you a concrete plan rather than a generic overview. Boards comparing this against external counsel can review fixed-fee AI consulting pricing, the Toronto AI consulting buyer's guide, and the AI governance definition in our glossary to align Canadian compliance terminology before kickoff.

---

AIDOLS is an AI-native consulting firm delivering production AI systems in Canada under PIPEDA, Quebec Law 25, OSFI E-23, and Health Canada AI/ML guidance. Learn more about our Canada-wide engagements, our Quebec province practice, our Ottawa federal and regulated-tech work, and our Governance and Trust program design.

Related Content

• KI-Beratung Berlin 2026: Boutique vs Big-Four — Scale-ups, GovTech und EU AI Act
• KI-Beratung Zürich 2026: Privatbanking, FINMA-Compliance und Crypto Valley
• How to Reduce AI Costs 40%: 5 Proven Strategies (2026)