Ontario employers must now disclose AI use in job postings. Quebec Law 25 is already being enforced.
Most Canadian businesses have done nothing about either.
Canada's AI compliance landscape is more complex than most businesses realise. Quebec Law 25 — the strictest privacy law in Canada — has been fully in force since September 2023 and applies to any business with Quebec customers or employees, regardless of where you're incorporated. Canada has no federal AI statute — Bill C-27, which carried the Artificial Intelligence and Data Act, died in January 2025 when Parliament was prorogued. That absence is exactly why most businesses assume they are unaffected. Your obligations already sit in privacy, employment and anti-spam law, and they are being enforced now.
Not sure where you stand? Answer 7 questions and get your free Canada AI compliance exposure report — instant, no sign-up.
Take the Free Check →Canada's AI compliance obligations don't wait for a federal AI law.
The most common mistake Canadian businesses make is waiting for a federal AI law. There isn't one — Bill C-27 and its Artificial Intelligence and Data Act died in January 2025 on prorogation — and waiting misreads where the duties actually sit. Quebec Law 25 is already enforced. PIPEDA applies now. Ontario employers must disclose AI screening in job postings. CASL governs your AI-generated communications today.
Quebec Law 25 (Act 25) applies to any business that collects, uses, or discloses personal information about Quebec residents — regardless of where your business is based. It requires privacy impact assessments for AI-assisted decisions that affect individuals.
PIPEDA (Personal Information Protection and Electronic Documents Act) governs how businesses handle personal information in AI systems federally. It applies to commercial activities that cross provincial or national borders — which covers most AI tool usage.
CASL (Canada's Anti-Spam Legislation) applies to AI-generated commercial electronic messages. If your AI tools send or personalise outreach to Canadians, you need documented consent processes and CASL-compliant unsubscribe mechanisms.
Bill C-27, which carried the Artificial Intelligence and Data Act, died in January 2025 when Parliament was prorogued. Nothing has replaced it and nothing is before Parliament. Businesses read that as "no AI obligations" and stop there — while PIPEDA, Quebec Law 25, Ontario's job-posting rule and CASL bind them today.
Quebec Law 25 has been fully in force since September 2023. The Commission d'accès à l'information (CAI) has enforcement powers and can issue significant fines for non-compliance.
Canada's AI compliance landscape is accelerating.
Canada's federal privacy law has governed commercial AI data processing for over two decades. Most businesses underestimate how broadly it applies to AI tool usage.
Act 25 — Canada's strictest privacy law — is now fully enforceable. Privacy impact assessments for AI decisions, consent obligations, and transparency requirements apply to any business with Quebec customers or employees.
Canada's only federal AI bill fell when Parliament was prorogued, taking the Artificial Intelligence and Data Act with it. There is no federal AI statute today and no successor before Parliament. Your obligations come from privacy, employment and anti-spam law — all of which are in force now.
Alberta PIPA, BC PIPA, and federal PIPEDA are all in force. CASL governs AI-generated communications. Non-compliant businesses are already exposed — many simply don't know it.
Under the Employment Standards Act and O. Reg. 476/24, employers with 25 or more employees must state in publicly advertised job postings whether AI is used to screen, assess or select applicants. In force now.
If any of these apply to your business, you have compliance obligations today.
- Any business with customers or employees in Quebec (Quebec Law 25 applies)
- Commercial activities that collect, use, or disclose personal information of Canadians (PIPEDA)
- Using AI tools to generate or personalise commercial emails to Canadian recipients (CASL)
- Businesses operating in Alberta or BC (provincial PIPA laws apply)
- Using AI in hiring, performance review, or any decision about Canadian employees or applicants
- Any business that assumed no federal AI law means no AI obligations
Read it before you buy it.
This is not a mock-up or a contents page. It is a genuine Canada AI Compliance pack — all 14 documents — produced by the same system that will produce yours, for a fictional insurance brokerage we invented to test it. Their model prices quotes without a broker, so the pack is written around that. Yours is written around whatever your business does.
Opens the PDF exactly as a client receives it. Yours is written around your business, your tools and your sector — not this one.
Canada AI Compliance Packages.
Every package builds a documented compliance position for your business. Prices in GBP — approximate CAD equivalents shown. Stripe accepts all major cards.
~$330 CAD · ~$250 USD
- AI Acceptable Use Policy (Canada-compliant)
- Employee AI guidelines
- AI tool inventory template
- Plain-English summary of federal obligations
Best for: small businesses wanting a baseline AI policy that covers federal PIPEDA and CASL obligations before province-specific requirements kick in.
In your inbox by the end of the business day
Buy now — £197 →~$1,350 CAD · ~$1,010 USD per year
- Everything in Canada AI Policy
- PIPEDA compliance gap analysis for AI systems
- Quebec Law 25 compliance roadmap
- CASL-compliant AI communications procedures
- Privacy impact assessment template for AI decisions
- Provincial applicability assessment (QC, AB, BC)
Best for: businesses with Quebec customers or employees, businesses using AI in email communications, or any business wanting a documented PIPEDA compliance position for their AI tools.
In your inbox by the end of the business day · Covers you for 12 months, renews yearly
Book a scoping call → or buy directly — £797/yr~$2,530 CAD · ~$1,900 USD per year
- Everything in Canada AI Compliance Foundation
- Full Federal AI Direction and Readiness Review
- Federal + provincial compliance matrix
- HR AI procedures and disclosure templates
- Data subject rights procedures (access, correction, deletion)
- Incident response procedure
Best for: businesses operating across multiple provinces, businesses with significant Quebec operations, or any business that wants a complete framework ready for any successor to the defunct Bill C-27.
In your inbox by the end of the business day · Covers you for 12 months, renews yearly
Renews yearly — Quebec Law 25, provincial and federal changes applied throughout your cover.
Book a scoping call → or buy directly — £1,497/yrEvery framework is annual — your fee covers 12 months of protection, with Quebec Law 25, provincial and federal law changes applied to your framework as they land, and renews yearly so your cover never lapses.
How we build your Canada AI compliance framework.
Audit
We identify every AI tool your business uses, what personal data it processes, and which Canadian individuals it affects — employees, customers, applicants.
Assess Obligations
We map your operations against PIPEDA, Quebec Law 25, provincial PIPA laws, and CASL — and identify exactly which requirements apply to your business and where.
Document
We build your compliance framework — acceptable use policy, privacy impact assessments, consent procedures, CASL notices, and a federal AI direction and readiness review.
Maintain
Throughout your 12-month cover, we track Canadian AI, privacy and employment law — federal and provincial, including any successor to Bill C-27 — and update your framework automatically when something changes.
Straight answers.
Does Quebec Law 25 apply to my business if I'm not based in Quebec?
Yes, in most cases. Quebec Law 25 applies to any business that collects, holds, uses, or communicates personal information about Quebec residents — regardless of where your business is incorporated or located. If you have customers, employees, or contractors in Quebec, and you use AI tools that process their personal information, Act 25 applies to you. This includes businesses based in other Canadian provinces and businesses based entirely outside Canada.
What exactly does Quebec Law 25 require for AI?
For AI specifically, Quebec Law 25 requires that businesses conduct a Privacy Impact Assessment (PIA) before using any technology — including AI — that processes personal information in ways that may affect privacy. It also requires: transparency to individuals when decisions about them are made using automated systems; the right for individuals to request human review of automated decisions; and consent obligations that are stricter than PIPEDA. The CAI can impose fines up to 4% of worldwide turnover or $25 million CAD.
Is there a federal Canadian AI law?
No. Bill C-27 contained three parts — an updated federal privacy law (CPPA), a data tribunal act, and the Artificial Intelligence and Data Act (AIDA) — and it died in January 2025 when Parliament was prorogued. AIDA never came into force and no successor is before Parliament. Canada's AI obligations today come from PIPEDA, Quebec Law 25, Ontario's job-posting disclosure rule, BC and Alberta PIPA, and CASL — all in force now. If a federal AI statute is introduced, your framework is updated within your cover.
Does CASL really apply to AI-generated emails?
Yes. CASL applies to commercial electronic messages sent to Canadian recipients — and the law doesn't distinguish between human-written and AI-generated content. If you use AI tools to write, personalise, or optimise commercial emails to Canadian recipients, CASL's consent, identification, and unsubscribe requirements apply. Violations can result in fines up to $10 million CAD per violation.
Is this legal advice?
No. We produce compliance documentation frameworks and policy documents — we are not Canadian lawyers. For businesses in regulated sectors or facing specific enforcement actions, we recommend reviewing your documentation with Canadian-qualified legal counsel. For most businesses using standard AI tools, our frameworks provide a practical, well-documented compliance position that demonstrates good-faith effort.
Build your Canada AI compliance framework on the law that is already enforced.
Ontario's hiring disclosure rules are in force. Quebec Law 25 is enforced. PIPEDA applies today. The businesses that build their compliance framework now are the ones that adapt rather than scramble.
See the Packages →Or book a free 20-minute call to discuss your situation — hello@opsintel.io