Quebec Law 25 is already law. Bill C-27 is coming.
Most Canadian businesses aren't ready for either.
Canada's AI compliance landscape is more complex than most businesses realise. Quebec Law 25 — the strictest privacy law in Canada — has been fully in force since September 2023 and applies to any business with Quebec customers or employees, regardless of where you're incorporated. Bill C-27's Artificial Intelligence and Data Act is moving through Parliament. The time to build your compliance framework is before enforcement begins, not after.
Canada's AI compliance obligations don't wait for a federal AI law.
The most common mistake Canadian businesses make is assuming they need to wait for Bill C-27 to pass before taking action. Quebec Law 25 is already enforced. PIPEDA applies now. CASL governs your AI-generated communications today. Businesses that prepare now won't be scrambling when AIDA comes into force.
Quebec Law 25 (Act 25) applies to any business that collects, uses, or discloses personal information about Quebec residents — regardless of where your business is based. It requires privacy impact assessments for AI-assisted decisions that affect individuals.
PIPEDA (Personal Information Protection and Electronic Documents Act) governs how businesses handle personal information in AI systems federally. It applies to commercial activities that cross provincial or national borders — which covers most AI tool usage.
CASL (Canada's Anti-Spam Legislation) applies to AI-generated commercial electronic messages. If your AI tools send or personalise outreach to Canadians, you need documented consent processes and CASL-compliant unsubscribe mechanisms.
Canada's Artificial Intelligence and Data Act is before Parliament and expected to pass. It will introduce impact assessment requirements and prohibitions on high-impact AI systems. Businesses building compliance frameworks now will be ahead of the curve when it passes.
Quebec Law 25 has been fully in force since September 2023. The Commission d'accès à l'information (CAI) has enforcement powers and can issue significant fines for non-compliance.
Canada's AI compliance landscape is accelerating.
Canada's federal privacy law has governed commercial AI data processing for over two decades. Most businesses underestimate how broadly it applies to AI tool usage.
Act 25 — Canada's strictest privacy law — is now fully enforceable. Privacy impact assessments for AI decisions, consent obligations, and transparency requirements apply to any business with Quebec customers or employees.
Alberta PIPA, BC PIPA, and federal PIPEDA are all in force. CASL governs AI-generated communications. Non-compliant businesses are already exposed — many simply don't know it.
The Artificial Intelligence and Data Act is moving through Parliament. When it passes, it will require impact assessments for high-impact AI systems and establish enforcement mechanisms. Businesses with compliance frameworks already in place will adapt — not scramble.
If any of these apply to your business, you have compliance obligations today.
- Any business with customers or employees in Quebec (Quebec Law 25 applies)
- Commercial activities that collect, use, or disclose personal information of Canadians (PIPEDA)
- Using AI tools to generate or personalise commercial emails to Canadian recipients (CASL)
- Businesses operating in Alberta or BC (provincial PIPA laws apply)
- Using AI in hiring, performance review, or any decision about Canadian employees or applicants
- Any business wanting to be ready for AIDA before it passes — not after
Canada AI Compliance Packages.
Every package builds a documented compliance position for your business. Prices in GBP — approximate CAD equivalents shown. Stripe accepts all major cards.
~$330 CAD · ~$250 USD
- AI Acceptable Use Policy (Canada-compliant)
- Employee AI guidelines
- AI tool inventory template
- Plain-English summary of federal obligations
Best for: small businesses wanting a baseline AI policy that covers federal PIPEDA and CASL obligations before province-specific requirements kick in.
Turnaround: 3–5 working days
~$1,350 CAD · ~$1,010 USD
- Everything in Canada AI Policy
- PIPEDA compliance gap analysis for AI systems
- Quebec Law 25 compliance roadmap
- CASL-compliant AI communications procedures
- Privacy impact assessment template for AI decisions
- Provincial applicability assessment (QC, AB, BC)
Best for: businesses with Quebec customers or employees, businesses using AI in email communications, or any business wanting a documented PIPEDA compliance position for their AI tools.
Turnaround: 5–7 working days
~$2,530 CAD · ~$1,900 USD
- Everything in Canada AI Compliance Foundation
- Full AIDA readiness assessment
- Federal + provincial compliance matrix
- HR AI procedures and disclosure templates
- Data subject rights procedures (access, correction, deletion)
- Incident response procedure
- 12-month policy update included
Best for: businesses operating across multiple provinces, businesses with significant Quebec operations, or any business that wants a complete framework ready for AIDA when it passes.
Turnaround: 7–10 working days · Valid for 12 months
Annual update available at £497 as new legislation comes into force.
Ongoing Compliance
~$330 CAD/month · ~$250 USD/month
6-month minimum term, then rolling monthly with 30 days' notice.
- AIDA monitored and applied to your framework when it passes
- Quebec Law 25 updates tracked and incorporated
- Quarterly compliance reviews
- Provincial law changes covered automatically
- Priority support for privacy or regulatory enquiries
Best for: businesses that can't afford to track federal and provincial Canadian AI legislation themselves — especially as AIDA moves toward Royal Assent.
How we build your Canada AI compliance framework.
Audit
We identify every AI tool your business uses, what personal data it processes, and which Canadian individuals it affects — employees, customers, applicants.
Assess Obligations
We map your operations against PIPEDA, Quebec Law 25, provincial PIPA laws, and CASL — and identify exactly which requirements apply to your business and where.
Document
We build your compliance framework — acceptable use policy, privacy impact assessments, consent procedures, CASL notices, and an AIDA readiness roadmap.
Maintain
On a managed plan, we monitor AIDA's progress through Parliament and update your framework automatically when it receives Royal Assent.
Straight answers.
Does Quebec Law 25 apply to my business if I'm not based in Quebec?
Yes, in most cases. Quebec Law 25 applies to any business that collects, holds, uses, or communicates personal information about Quebec residents — regardless of where your business is incorporated or located. If you have customers, employees, or contractors in Quebec, and you use AI tools that process their personal information, Act 25 applies to you. This includes businesses based in other Canadian provinces and businesses based entirely outside Canada.
What exactly does Quebec Law 25 require for AI?
For AI specifically, Quebec Law 25 requires that businesses conduct a Privacy Impact Assessment (PIA) before using any technology — including AI — that processes personal information in ways that may affect privacy. It also requires: transparency to individuals when decisions about them are made using automated systems; the right for individuals to request human review of automated decisions; and consent obligations that are stricter than PIPEDA. The CAI can impose fines up to 4% of worldwide turnover or $25 million CAD.
What is Bill C-27 and when will it affect my business?
Bill C-27 contains three parts: an updated federal privacy law (CPPA), a data tribunal act, and the Artificial Intelligence and Data Act (AIDA). AIDA is Canada's first AI-specific federal law. When it receives Royal Assent, it will require impact assessments for high-impact AI systems, mandate transparency measures, and establish an enforcement regime with fines of up to 3% of global turnover (or $10 million CAD). Building your compliance framework now means you adapt rather than scramble.
Does CASL really apply to AI-generated emails?
Yes. CASL applies to commercial electronic messages sent to Canadian recipients — and the law doesn't distinguish between human-written and AI-generated content. If you use AI tools to write, personalise, or optimise commercial emails to Canadian recipients, CASL's consent, identification, and unsubscribe requirements apply. Violations can result in fines up to $10 million CAD per violation.
Is this legal advice?
No. We produce compliance documentation frameworks and policy documents — we are not Canadian lawyers. For businesses in regulated sectors or facing specific enforcement actions, we recommend reviewing your documentation with Canadian-qualified legal counsel. For most businesses using standard AI tools, our frameworks provide a practical, well-documented compliance position that demonstrates good-faith effort.
Build your Canada AI compliance framework before AIDA passes.
Quebec Law 25 is already enforced. PIPEDA applies today. AIDA is coming. The businesses that build their compliance framework now are the ones that adapt rather than scramble.
See the Packages →Or book a free 20-minute call to discuss your situation — scott@opsintel.io