US and Canadian AI Compliance Diverge: What Professional Services Need to Know in 2026

The regulatory paths of the United States and Canada have sharply diverged on artificial intelligence governance, and 2026 is proving to be the year that divergence becomes operationally significant. For professional services businesses — accountants, solicitors, HR consultancies, and marketing agencies operating across borders — understanding both landscapes is no longer optional. Clients in these jurisdictions are subject to these rules, and the services you provide may well be implicated.

Canada Pivots Away From Standalone AI Legislation

Canada's most consequential AI compliance development in recent memory is also, paradoxically, the absence of a law. The Artificial Intelligence and Data Act (AIDA), which formed part of Bill C-27, lapsed in January 2025 without passing, and the Canadian government has confirmed it will not be reintroduced. That removes the spectre of a standalone AI statute — for now.

In its place, on 15 June 2026, the government tabled Bill C-36, which revives the private-sector privacy reforms originally bundled with AIDA. The focus has shifted: AI governance in Canada will be channelled primarily through privacy law rather than a dedicated AI framework. For professional services businesses, this means the relevant obligations are grounded in the Personal Information Protection and Electronic Documents Act (PIPEDA) and its anticipated amendments, not a bespoke AI regime.

That said, AIDA's principles have not simply evaporated. Regulators and organisations are still expected to apply risk-based thinking and transparency measures to high-impact AI systems. The Office of the Privacy Commissioner of Canada (OPC) has been active in shaping expectations, issuing substantive guidance on AI and privacy and, in May 2026, draft guidance on age assurance. Businesses using AI tools that process personal data — which covers most client-facing applications in professional services — should treat the OPC's guidance as a compliance floor, not a theoretical document.

Quebec's Law 25, in force since September 2023, adds a further layer. It includes specific provisions governing automated decision-making and profiling, and applies to organisations handling the personal information of Quebec residents. If your firm serves Canadian clients or employs Canadian staff, this legislation is live and enforceable.

Further amendments to PIPEDA in 2026 are expected to introduce a data mobility framework, increasing individual control over personal information and creating new interoperability obligations. Firms managing client data across jurisdictions will need to assess how these rights interact with their existing data governance arrangements.

Canada's National AI Strategy Sets the Direction of Travel

On 4 June 2026, Canada launched its National Artificial Intelligence Strategy: AI for All. This five-year plan allocates C$925.6 million from Budget 2025 and sets an ambitious target: increasing AI adoption among Canadian businesses from 12% to 60% by 2034. The strategy is deliberately broad, encompassing privacy reform, online safety, and investment in AI infrastructure rather than a single legislative instrument.

For professional services firms, the strategic direction matters as much as the legal detail. Canada is signalling that AI adoption at scale is a policy priority, and the regulatory environment will be constructed to enable that — through privacy law reform, not prohibition. Firms advising Canadian clients, or expanding their own AI capabilities to serve that market, should factor this policy context into their compliance planning and client communications.

The United States: Fragmentation at Federal Level, Intensity at State Level

The United States has no single federal AI law, and the current administration is actively discouraging the development of one — or at least resisting state efforts to fill the gap. President Trump's Executive Order 14179, issued in January 2025, rescinded earlier directives requiring AI safety testing and reoriented federal policy towards innovation. A subsequent Executive Order in December 2025 went further, establishing a Department of Justice AI Litigation Task Force specifically tasked with challenging state AI laws deemed inconsistent with federal policy.

That task force matters. With over 100 state-level AI laws enacted as of July 2026, the tension between federal and state authority is significant. Businesses operating across multiple US states face genuine compliance complexity — and the prospect that some of the state laws they are currently working to comply with may be contested or invalidated.

At the state level, two developments deserve particular attention. California's Transparency in Frontier AI Act (SB 53), effective January 2026, imposes obligations on generative AI developers: publishing documentation on training data, implementing safety frameworks, and including latent disclosures in AI-generated content. New York's RAISE Act was amended in March 2026 to align with California's approach. If your firm develops, deploys, or advises on generative AI tools used in either state — and the reach of California law, in particular, is broad — these requirements are live.

At the federal level, the Take it Down Act (TiDA), effective May 2026, criminalises the nonconsensual publication of intimate images, including AI-generated deepfakes, and requires platforms to remove such content. While this is not a professional services-specific measure, it has clear implications for marketing agencies and HR consultancies managing digital content or workplace misconduct matters.

FTC Enforcement: A Direct Warning to Businesses Using AI

The US Federal Trade Commission (FTC) established a dedicated AI enforcement unit in January 2026, and its intent is serious. On 1 July 2026, the FTC issued a proposed policy statement warning that altering AI outputs to suppress accuracy — even when done to comply with state laws — could constitute consumer deception under Section 5 of the FTC Act.

Read that carefully. The FTC is signalling that attempting to comply with one regulatory obligation could itself create a separate federal enforcement risk. For professional services businesses providing compliance advice on AI, or using AI-generated outputs in client-facing work, this is a tension that requires active legal and operational management. Firms must be able to demonstrate that their AI tools produce accurate, unmanipulated outputs — and that their governance frameworks are designed with that requirement in mind.

What This Means for International Professional Services Businesses

The implications extend well beyond North America. Solicitors advising on cross-border transactions, accountants working with US or Canadian entities, HR consultancies managing multinational workforces, and marketing agencies serving North American clients are all exposed to these frameworks — whether or not they are physically present in either jurisdiction.

The core compliance obligations emerging from both countries share a common theme: transparency, accountability, and documentation. Whether it is PIPEDA's evolving requirements in Canada, California's SB 53 mandates, or the FTC's accuracy expectations, regulators are requiring that organisations demonstrate how their AI systems work, what data they use, and what safeguards are in place.

Firms that have not yet mapped their AI use against these requirements — tools used internally, outputs delivered to clients, systems that inform decisions affecting individuals — are carrying risk that is already materialising.

Take the Next Step

The US-Canada AI compliance picture is complex, fast-moving, and consequential. Ops Intel works with professional services businesses globally to translate regulatory developments into practical compliance frameworks — covering AI governance, data protection, and cross-border risk.

If your firm operates in or serves clients in North America, now is the time to assess your exposure. Contact Ops Intel to speak with a specialist about your AI compliance obligations.