Ontario employers must now disclose AI use in job postings. Quebec Law 25 is already being enforced.
Most Canadian businesses have done nothing about either.
Canada has no federal AI statute — and that is exactly why most businesses assume none of this applies to them.
Quebec Law 25 — the strictest privacy law in Canada — has been fully in force since September 2023. It follows your customers, not your head office: it applies to any business holding personal information about Quebec residents, wherever you are incorporated.
There is no federal AI Act. Bill C-27, which carried the Artificial Intelligence and Data Act, died in January 2025 when Parliament was prorogued. Nothing has replaced it and nothing is before Parliament.
Your duties are already written — into privacy, employment and anti-spam law. All three are being enforced today, whatever happens federally.
Not sure where you stand? Answer 7 questions and get your free Canada AI compliance exposure report — instant, no sign-up.
Take the Free Check →Canada's AI compliance obligations don't wait for a federal AI law.
The most common mistake Canadian businesses make is waiting for a federal AI law. There isn't one — Bill C-27 and its Artificial Intelligence and Data Act died in January 2025 on prorogation — and waiting misreads where the duties actually sit. Quebec Law 25 is already enforced. PIPEDA applies now. Ontario employers must disclose AI screening in job postings. CASL governs your AI-generated communications today.
Quebec's private-sector privacy law, as amended by Law 25, applies to a business based outside Quebec too, if it collects, holds, uses or discloses personal information in the course of its business activities in Quebec — that is how Quebec's privacy regulator, the Commission d'accès à l'information, puts it. If a decision about someone is made only by automated processing, it requires you to tell them at the time, explain on request the information, reasons and main factors behind it, and let them put their case to a person who can review it.
PIPEDA (Personal Information Protection and Electronic Documents Act) governs how businesses handle personal information in AI systems federally. It applies to commercial activities that cross provincial or national borders — which covers most AI tool usage.
CASL (Canada's Anti-Spam Legislation) applies to AI-generated commercial electronic messages. If your AI tools send or personalise outreach to Canadians, you need documented consent processes and CASL-compliant unsubscribe mechanisms.
Bill C-27, which carried the Artificial Intelligence and Data Act, died in January 2025 when Parliament was prorogued. Nothing has replaced it and nothing is before Parliament. Businesses read that as "no AI obligations" and stop there — while PIPEDA, Quebec Law 25, Ontario's job-posting rule and CASL bind them today.
Quebec Law 25 has been fully in force since September 2023. The Commission d'accès à l'information (CAI) has enforcement powers and can issue significant fines for non-compliance.
Canada's AI compliance landscape is accelerating.
Canada's federal privacy law has governed commercial AI data processing for over two decades. Most businesses underestimate how broadly it applies to AI tool usage.
Act 25 — Canada's strictest privacy law — is now fully enforceable. Consent obligations, transparency requirements and the duty to explain decisions made only by automated processing apply to any business with Quebec customers or employees.
Canada's only federal AI bill fell when Parliament was prorogued, taking the Artificial Intelligence and Data Act with it. There is no federal AI statute today and no successor before Parliament. Your obligations come from privacy, employment and anti-spam law — all of which are in force now.
Alberta PIPA, BC PIPA, and federal PIPEDA are all in force. CASL governs AI-generated communications. Non-compliant businesses are already exposed — many simply don't know it.
Under the Employment Standards Act and O. Reg. 476/24, employers with 25 or more employees must state in publicly advertised job postings whether AI is used to screen, assess or select applicants. In force now.
28 dates that decide whether you are compliant.
14 of them have already passed.
Canada is one line of 9. Almost every business we see is on more than one of them. Yours is marked. The rest catch you through your customers, your staff and your suppliers, wherever you are incorporated.
Europe
- in force Obligations for general-purpose AI models.
- in force Article 50 transparency duties and enforcement powers for national regulators.
- coming New prohibitions, and Article 50(2) marking of synthetic content.
- coming Every Member State must have an AI regulatory sandbox running.
- coming High-risk obligations for Annex III systems — including AI used in recruitment, credit scoring, education and essential services.
- coming High-risk obligations for Annex I systems — AI embedded in products already covered by EU product safety law.
United Kingdom
- in force Most Part 5 data protection provisions of the Data (Use and Access) Act 2025, including the wider lawful bases for solely automated decisions and the safeguards that come with them.
- in force The duty on controllers to operate a complaints procedure and respond to data protection complaints within set time limits.
United States
- in force New York City Local Law 144 — an employer or agency using an automated employment decision tool for a New York City job needs a bias audit within the past year, published results, and notice to candidates.
- in force Washington My Health My Data Act (RCW 19.373) — consent before collecting or sharing consumer health data and a published health data privacy policy, for any business targeting Washington consumers; small businesses from 30 June 2024. A breach is an unfair practice under the Consumer Protection Act.
- in force Utah Artificial Intelligence Policy Act (SB 149, 2024) — a business using generative AI with a consumer must say so when the consumer clearly asks; licensed professions must disclose it up front in high-risk interactions. Narrowed by SB 226 from 7 May 2025, with a safe harbour for disclosing at the start.
- in force Texas HB 149, the Responsible Artificial Intelligence Governance Act — prohibited uses, government AI disclosure, and Attorney General enforcement.
- in force California SB 942, the AI Transparency Act — free AI detection tool and latent provenance disclosure for large generative AI providers. Delayed from 1 January 2026 by AB 853.
- coming Colorado SB 26-189 — developer and deployer duties for automated decision-making technology used in consequential decisions. It repealed and reenacted SB 24-205, which never took effect. California SB 1050 (Chapter 246, Statutes of 2026) — an advert shown in California that prominently features an AI-generated performer who looks or sounds human must say so clearly, in words like "this performance features a synthetic performer". Any size of business; enforced as false advertising. California CCPA regulations on automated decisionmaking technology (Cal. Code Regs. tit. 11, s. 7200) — a business using ADMT for a significant decision about a consumer must give pre-use notice, opt-out and access rights. In force 1 January 2026; businesses already using ADMT must comply by this date. Only businesses within the CCPA. Connecticut Public Act 26-15, sections 4 to 6 — duties on operators of AI companions, including detecting and responding to signs of self-harm. Washington HB 2225 (Chapter 168, Laws of 2026) — AI companion chatbots must disclose that they are not human, with safeguards for minors and a private right of action. A customer-service bot that does not sustain a relationship is excluded. Oregon SB 1546 (Chapter 85, Oregon Laws 2026) — operators of AI companions must tell users they are not talking to a person, keep a protocol for users who express thoughts of suicide or self-harm, and add safeguards for minors; a user who is harmed can sue. Software used solely for customer service, business operations or productivity is excluded.
- coming Idaho Conversational AI Safety Act (S 1297, Session Law Chapter 249 of 2026; Idaho Code Title 48, Chapter 21) — a conversational AI service open to the public must say it is AI where a person could be misled, answer prompts about suicide with a crisis referral, and protect account holders who are minors. Enforced by the Attorney General. A chatbot used only for customer service or a business's own operations is excluded.
- coming Connecticut Public Act 26-15 (Substitute SB 5, 2026), sections 7 to 12 — any business doing business in Connecticut that uses an automated employment-related decision technology for a hiring, promotion or discipline decision must disclose it and give written notice before the decision. No size threshold. A breach is an unfair trade practice.
- coming California CCPA regulations, s. 7157 — risk assessments conducted in 2026 and 2027 must be submitted to the California Privacy Protection Agency by this date.
Canada this page
- in force Ontario ESA / O. Reg. 476/24 — a publicly advertised job posting must disclose the use of AI to screen, assess or select applicants. Employers of 25 or more, including where a third party screens on their behalf.
Australia
- coming Privacy Act 1988 (Cth), APP 1.7 — a privacy policy must say what kinds of personal information a computer program uses to make decisions that could reasonably be expected to significantly affect a person, and what kinds of decisions those are — the automated decision-making (ADM) transparency obligations, regulated by the OAIC.
United Arab Emirates
- in force DIFC Data Protection Regulation 10 — a business deploying an autonomous or semi-autonomous system that processes personal data must tell users, on first use, what the system decides for itself, what it was built to do and what it does with the output.
Saudi Arabia
- in force The Saudi Data and AI Authority's grace period under the Personal Data Protection Law ends, and with it the undertaking not to apply penalties. The authority has said it may extend the grace period for a business that gives it good reason.
South Korea
- in force Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust in force. A business in the AI industry must tell users in advance where a product runs on generative or high-impact AI, and label what generative AI produces. It applies to conduct outside Korea that affects the Korean market or its users.
China
- in force Personal Information Protection Law in force. A business outside China that handles the personal information of people in China — to offer them products or services, or to analyse their behaviour — must have a lawful basis for it and must appoint a representative or a dedicated body inside the country. Nothing in the duty turns on how much data is held.
If any of these apply to your business, you have compliance obligations today.
- Any business with customers or employees in Quebec (Quebec Law 25 applies)
- Commercial activities that collect, use, or disclose personal information of Canadians (PIPEDA)
- Using AI tools to generate or personalise commercial emails to Canadian recipients (CASL)
- Businesses operating in Alberta or BC (provincial PIPA laws apply)
- Using AI in hiring, performance review, or any decision about Canadian employees or applicants
- Any business that assumed no federal AI law means no AI obligations
Read it before you buy it.
This is not a mock-up or a contents page. It is a genuine Canada AI Compliance pack — all 16 documents — produced by the same system that will produce yours, for a fictional insurance brokerage we invented to test it. Their model prices quotes without a broker, so the pack is written around that. Yours is written around whatever your business does.
7 October 2026 — added: Canada's federal Voluntary Code of Conduct, added to the alignment map
The gap. Canada's government published a voluntary code for organisations that build or run generative AI, and its national AI strategy leans on building trust. Canadian clients can ask whether a supplier follows it. Our Canada frameworks held the evidence, but did not show it against the code.
What we added. The six measures the code sets for businesses that run AI tools, each mapped to the documents in your framework, with anything still yours to do. It shows alignment with the code, not that you have signed it.
26 September 2026 — added: Answers to the AI questions clients send their suppliers
The gap. Public bodies and large companies now send their suppliers questions about the AI they use. Our frameworks held most of the answers, but a client had to know where to look, usually with a renewal waiting.
What we added. The questions real buyers publish, each put in plain words, with the document in your framework that answers it and anything still yours to do.
24 September 2026 — added: ISO/IEC 42001 and NIST AI RMF alignment map
The gap. Bigger clients, insurers and tenders can ask a supplier whether its AI governance meets ISO/IEC 42001 or the NIST AI Risk Management Framework. Our frameworks held most of the evidence, but nothing in them showed it.
What we added. A map that names, clause by clause, which of your documents meets each standard and what is still yours to do. It shows alignment, not certification.
Every framework bought today has these changes. The pages below were made before them, so they show 2 documents fewer than a framework bought today.
This framework also comes with a compliance dashboard you run all year: a dated to-do list, your AI tools and their risks, staff sign-off, an incident log, every document to download, the deadlines for your markets and a statement you can share. See a fictional example → · What the dashboard does →
The framework you build now is the one the next law will test.
Every regime that reaches Canadian AI use is converging on the same short list of duties: know which systems you are running, assess them before you deploy, tell people when a machine made a decision about them, keep a human able to review that decision, and be able to show your working afterwards. Quebec Law 25 already requires most of that list. Ontario's job-posting rule requires one part of it. Any federal statute that eventually fills that gap will require its own version of it.
So the durable move is to build to the list, not to a bill number. Do that and you hold a documented compliance position today — and when the law does move, it tests a framework you already have rather than one you are writing under deadline. That is what the annual renewal is for: when Quebec, Ontario or Parliament shifts, your framework shifts with it, and you are not paying to start again.
Not sure which of these already bind you? Seven questions, no sign-up.
Take the free check →
Your customers decide which law
applies to you. Not your address.
Where your customers are, where your staff are and where your AI has effect — those decide, not where the business is registered. We write frameworks to four legal systems, and serve four more on request.
- United Kingdom UK GDPR, in force now. The Data (Use and Access) Act added automated-decision duties from 5 February 2026.
- European Union The EU AI Act. General-purpose AI obligations already apply; regulators have had enforcement powers since 2 August 2026.
- United States State by state, not federal. Texas from 1 January 2026, California from 2 August 2026, Colorado from 1 January 2027.
- Canada PIPEDA plus provincial law. Ontario's AI hiring disclosure rules applied from 1 January 2026.
Canada AI Compliance Packages.
Every package builds a documented compliance position for your business. Prices in GBP — approximate CAD equivalents shown. Stripe accepts all major cards.
~$330 CAD · ~$250 USD
- AI Acceptable Use Policy (Canada-compliant)
- Employee AI guidelines
- AI tool inventory template
- Plain-English summary of federal obligations
Best for: small businesses wanting a baseline AI policy that covers federal PIPEDA and CASL obligations before province-specific requirements kick in.
In your inbox by the end of the business day
Buy now — £197 →~$1,350 CAD · ~$1,010 USD per year
- Everything in Canada AI Policy
- PIPEDA compliance gap analysis for AI systems
- Quebec Law 25 compliance roadmap
- CASL-compliant AI communications procedures
- Privacy impact assessment template for AI decisions
- Provincial applicability assessment (QC, AB, BC)
- ISO/IEC 42001, NIST AI RMF and Canada Voluntary Code alignment map
Best for: businesses with Quebec customers or employees, businesses using AI in email communications, or any business wanting a documented PIPEDA compliance position for their AI tools.
In your inbox by the end of the business day · Covers you for 12 months, renews yearly
Buy now — £797/year → or book a scoping call first~$2,530 CAD · ~$1,900 USD per year
- Everything in Canada AI Compliance Foundation
- Full Federal AI Direction and Readiness Review
- Federal + provincial compliance matrix
- HR AI procedures and disclosure templates
- Data subject rights procedures (access, correction, deletion)
- Incident response procedure
- ISO/IEC 42001, NIST AI RMF and Canada Voluntary Code alignment map
- Your AI compliance dashboard: a to-do list, your AI tools, staff sign-off, an incident log, every document and a shareable statement
Best for: businesses operating across multiple provinces, businesses with significant Quebec operations, or any business that wants a complete framework ready for any successor to the defunct Bill C-27.
In your inbox by the end of the business day · Covers you for 12 months, renews yearly
Renews yearly — Quebec Law 25, provincial and federal changes applied throughout your cover.
Buy now — £1,497/year → or book a scoping call firstEvery framework is annual — your fee covers 12 months of protection, with Quebec Law 25, provincial and federal law changes applied to your framework as they land, and renews yearly so your cover never lapses.
The same work, done in-house.
11 documents to write, and 15 records a year to keep afterwards. Costed against what a member of staff on the median UK salary actually costs an hour:
£2,140+
Your own staff — 83 hours of their time
£797/year
Canada AI Compliance — in your inbox by the end of the business day
Marked + because the reading is not in that figure yet — we are still counting this market's statutes, so the real in-house cost is higher than shown, never lower.
Bought, built and delivered without a meeting.
Buy it
Buy it on this page. There is no call to book and no slot to wait for. If you would rather talk it through first, that option is there too.
Tell us about you
A dozen questions: your sector, your size, the AI tools you use, what those tools decide, what you are worried about — and on Foundation and Complete, the provinces you deal with.
It arrives
Your framework is written from your answers against PIPEDA, Quebec Law 25, provincial privacy law and CASL — in your inbox by the end of the business day. PDF and Word, the full pack and every document on its own.
It stays current
For 12 months we watch Canadian privacy and AI law, federal and provincial. When something moves, we confirm it against the regulator’s own source, rebuild your documents and email them to you. Renews yearly.
Straight answers.
Does Quebec Law 25 apply to my business if I'm not based in Quebec?
Yes, in most cases. Quebec Law 25 applies to any business that collects, holds, uses, or communicates personal information about Quebec residents — regardless of where your business is incorporated or located. If you have customers, employees, or contractors in Quebec, and you use AI tools that process their personal information, Act 25 applies to you. This includes businesses based in other Canadian provinces and businesses based entirely outside Canada.
What exactly does Quebec Law 25 require for AI?
For AI specifically, Quebec Law 25 requires a privacy impact assessment for any project to acquire, develop or overhaul an information system that handles personal information — and the Commission d'accès à l'information's own guidance lists AI systems among those information systems. Where a decision about someone is made only by automated processing, it also requires you to tell them, explain the decision on request, and let them put their case to a person who can review it. Consent obligations are stricter than PIPEDA's. The CAI can impose administrative penalties of up to CA$10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is higher; the higher penal fines, up to CA$25 million or 4% of worldwide turnover for the preceding fiscal year, whichever is higher, need a prosecution.
Is there a federal Canadian AI law?
No. Bill C-27 contained three parts — an updated federal privacy law (CPPA), a data tribunal act, and the Artificial Intelligence and Data Act (AIDA) — and it died in January 2025 when Parliament was prorogued. AIDA never came into force and no successor is before Parliament. Canada's AI obligations today come from PIPEDA, Quebec Law 25, Ontario's job-posting disclosure rule, BC and Alberta PIPA, and CASL — all in force now. If a federal AI statute is introduced, your framework is updated within your cover.
Does CASL really apply to AI-generated emails?
Yes. CASL applies to commercial electronic messages sent to Canadian recipients — and the law doesn't distinguish between human-written and AI-generated content. If you use AI tools to write, personalise, or optimise commercial emails to Canadian recipients, CASL's consent, identification, and unsubscribe requirements apply. Violations can result in fines up to $10 million CAD per violation.
Is this legal advice?
No. We produce compliance documentation frameworks and policy documents — we are not Canadian lawyers. For businesses in regulated sectors or facing specific enforcement actions, we recommend reviewing your documentation with Canadian-qualified legal counsel. For most businesses using standard AI tools, our frameworks provide a practical, well-documented compliance position that demonstrates good-faith effort.
Build your Canada AI compliance framework on the law that is already enforced.
Ontario's hiring disclosure rules are in force. Quebec Law 25 is enforced. PIPEDA applies today. The businesses that build their compliance framework now are the ones that adapt rather than scramble.
See the Packages →Or book a free 20-minute call to discuss your situation — hello@opsintel.io