Ontario employers must now disclose AI use in job postings. Quebec Law 25 is already being enforced.
Most Canadian businesses have done nothing about either.
Canada has no federal AI statute — and that is exactly why most businesses assume none of this applies to them.
Quebec Law 25 — the strictest privacy law in Canada — has been fully in force since September 2023. It follows your customers, not your head office: it applies to any business holding personal information about Quebec residents, wherever you are incorporated.
There is no federal AI Act. Bill C-27, which carried the Artificial Intelligence and Data Act, died in January 2025 when Parliament was prorogued. Nothing has replaced it and nothing is before Parliament.
Your duties are already written — into privacy, employment and anti-spam law. All three are being enforced today, whatever happens federally.
Not sure where you stand? Answer 7 questions and get your free Canada AI compliance exposure report — instant, no sign-up.
Take the Free Check →Canada's AI compliance obligations don't wait for a federal AI law.
The most common mistake Canadian businesses make is waiting for a federal AI law. There isn't one — Bill C-27 and its Artificial Intelligence and Data Act died in January 2025 on prorogation — and waiting misreads where the duties actually sit. Quebec Law 25 is already enforced. PIPEDA applies now. Ontario employers must disclose AI screening in job postings. CASL governs your AI-generated communications today.
Quebec Law 25 (Act 25) applies to any business that collects, uses, or discloses personal information about Quebec residents — regardless of where your business is based. It requires privacy impact assessments for AI-assisted decisions that affect individuals.
PIPEDA (Personal Information Protection and Electronic Documents Act) governs how businesses handle personal information in AI systems federally. It applies to commercial activities that cross provincial or national borders — which covers most AI tool usage.
CASL (Canada's Anti-Spam Legislation) applies to AI-generated commercial electronic messages. If your AI tools send or personalise outreach to Canadians, you need documented consent processes and CASL-compliant unsubscribe mechanisms.
Bill C-27, which carried the Artificial Intelligence and Data Act, died in January 2025 when Parliament was prorogued. Nothing has replaced it and nothing is before Parliament. Businesses read that as "no AI obligations" and stop there — while PIPEDA, Quebec Law 25, Ontario's job-posting rule and CASL bind them today.
Quebec Law 25 has been fully in force since September 2023. The Commission d'accès à l'information (CAI) has enforcement powers and can issue significant fines for non-compliance.
Canada's AI compliance landscape is accelerating.
Canada's federal privacy law has governed commercial AI data processing for over two decades. Most businesses underestimate how broadly it applies to AI tool usage.
Act 25 — Canada's strictest privacy law — is now fully enforceable. Privacy impact assessments for AI decisions, consent obligations, and transparency requirements apply to any business with Quebec customers or employees.
Canada's only federal AI bill fell when Parliament was prorogued, taking the Artificial Intelligence and Data Act with it. There is no federal AI statute today and no successor before Parliament. Your obligations come from privacy, employment and anti-spam law — all of which are in force now.
Alberta PIPA, BC PIPA, and federal PIPEDA are all in force. CASL governs AI-generated communications. Non-compliant businesses are already exposed — many simply don't know it.
Under the Employment Standards Act and O. Reg. 476/24, employers with 25 or more employees must state in publicly advertised job postings whether AI is used to screen, assess or select applicants. In force now.
14 dates that decide whether you are compliant.
8 of them have already passed.
Canada is one line of 6. Almost every business we see is on more than one of them. Yours is marked. The rest catch you through your customers, your staff and your suppliers, wherever you are incorporated.
Europe
- in force Obligations for general-purpose AI models.
- in force Article 50 transparency duties, deployer obligations, and enforcement powers for national regulators.
- coming New prohibitions, and Article 50(2) marking of synthetic content.
- coming Every Member State must have an AI regulatory sandbox running.
- coming High-risk obligations for Annex III systems — including AI used in recruitment, credit scoring, education and essential services.
- coming High-risk obligations for Annex I systems — AI embedded in products already covered by EU product safety law.
United Kingdom
- in force Most Part 5 data protection provisions of the Data (Use and Access) Act 2025, including the wider lawful bases for solely automated decisions and the safeguards that come with them.
- in force The duty on controllers to operate a complaints procedure and respond to data protection complaints within set time limits.
United States
- in force Texas HB 149, the Responsible Artificial Intelligence Governance Act — prohibited uses, government AI disclosure, and Attorney General enforcement.
- in force California SB 942, the AI Transparency Act — free AI detection tool and latent provenance disclosure for large generative AI providers. Delayed from 1 January 2026 by AB 853.
- coming Colorado SB 26-189 — developer and deployer duties for automated decision-making technology used in consequential decisions. It repealed and reenacted SB 24-205, which never took effect.
Canada this page
- in force Ontario ESA / O. Reg. 476/24 — a publicly advertised job posting must disclose the use of AI to screen, assess or select applicants. Employers of 25 or more, including where a third party screens on their behalf.
Australia
- coming Privacy Act 1988 (Cth), APP 1.7 — a privacy policy must say what kinds of personal information a computer program uses to make decisions that could reasonably be expected to significantly affect a person, and what kinds of decisions those are.
United Arab Emirates
- in force DIFC Data Protection Regulation 10 — a business deploying an autonomous or semi-autonomous system that processes personal data must tell users, on first use, what the system decides for itself, what it was built to do and what it does with the output.
If any of these apply to your business, you have compliance obligations today.
- Any business with customers or employees in Quebec (Quebec Law 25 applies)
- Commercial activities that collect, use, or disclose personal information of Canadians (PIPEDA)
- Using AI tools to generate or personalise commercial emails to Canadian recipients (CASL)
- Businesses operating in Alberta or BC (provincial PIPA laws apply)
- Using AI in hiring, performance review, or any decision about Canadian employees or applicants
- Any business that assumed no federal AI law means no AI obligations
Read it before you buy it.
This is not a mock-up or a contents page. It is a genuine Canada AI Compliance pack — all 14 documents — produced by the same system that will produce yours, for a fictional insurance brokerage we invented to test it. Their model prices quotes without a broker, so the pack is written around that. Yours is written around whatever your business does.
Opens the PDF exactly as a client receives it. Yours is written around your business, your tools and your sector — not this one.
The framework you build now is the one the next law will test.
Every regime that reaches Canadian AI use is converging on the same short list of duties: know which systems you are running, assess them before you deploy, tell people when a machine made a decision about them, keep a human able to review that decision, and be able to show your working afterwards. Quebec Law 25 already requires most of that list. Ontario's job-posting rule requires one part of it. Any federal statute that eventually fills that gap will require its own version of it.
So the durable move is to build to the list, not to a bill number. Do that and you hold a documented compliance position today — and when the law does move, it tests a framework you already have rather than one you are writing under deadline. That is what the annual renewal is for: when Quebec, Ontario or Parliament shifts, your framework shifts with it, and you are not paying to start again.
Not sure which of these already bind you? Seven questions, no sign-up.
Take the free check →
Your customers decide which law
applies to you. Not your address.
Where your customers are, where your staff are and where your AI has effect — those decide, not where the business is registered. We write frameworks to four legal systems, and serve four more on request.
- United Kingdom UK GDPR, in force now. The Data (Use and Access) Act added automated-decision duties from 5 February 2026.
- European Union The EU AI Act. General-purpose AI obligations already apply; enforcement begins 2 August 2026.
- United States State by state, not federal. Texas from 1 January 2026, California from 2 August 2026, Colorado from 1 January 2027.
- Canada PIPEDA plus provincial law. Ontario's AI hiring disclosure rules applied from 1 January 2026.
Canada AI Compliance Packages.
Every package builds a documented compliance position for your business. Prices in GBP — approximate CAD equivalents shown. Stripe accepts all major cards.
~$330 CAD · ~$250 USD
- AI Acceptable Use Policy (Canada-compliant)
- Employee AI guidelines
- AI tool inventory template
- Plain-English summary of federal obligations
Best for: small businesses wanting a baseline AI policy that covers federal PIPEDA and CASL obligations before province-specific requirements kick in.
In your inbox by the end of the business day
Buy now — £197 →~$1,350 CAD · ~$1,010 USD per year
- Everything in Canada AI Policy
- PIPEDA compliance gap analysis for AI systems
- Quebec Law 25 compliance roadmap
- CASL-compliant AI communications procedures
- Privacy impact assessment template for AI decisions
- Provincial applicability assessment (QC, AB, BC)
Best for: businesses with Quebec customers or employees, businesses using AI in email communications, or any business wanting a documented PIPEDA compliance position for their AI tools.
In your inbox by the end of the business day · Covers you for 12 months, renews yearly
Book a scoping call → or buy directly — £797/yr~$2,530 CAD · ~$1,900 USD per year
- Everything in Canada AI Compliance Foundation
- Full Federal AI Direction and Readiness Review
- Federal + provincial compliance matrix
- HR AI procedures and disclosure templates
- Data subject rights procedures (access, correction, deletion)
- Incident response procedure
Best for: businesses operating across multiple provinces, businesses with significant Quebec operations, or any business that wants a complete framework ready for any successor to the defunct Bill C-27.
In your inbox by the end of the business day · Covers you for 12 months, renews yearly
Renews yearly — Quebec Law 25, provincial and federal changes applied throughout your cover.
Book a scoping call → or buy directly — £1,497/yrEvery framework is annual — your fee covers 12 months of protection, with Quebec Law 25, provincial and federal law changes applied to your framework as they land, and renews yearly so your cover never lapses.
How we build your Canada AI compliance framework.
Audit
We identify every AI tool your business uses, what personal data it processes, and which Canadian individuals it affects — employees, customers, applicants.
Assess Obligations
We map your operations against PIPEDA, Quebec Law 25, provincial PIPA laws, and CASL — and identify exactly which requirements apply to your business and where.
Document
We build your compliance framework — acceptable use policy, privacy impact assessments, consent procedures, CASL notices, and a federal AI direction and readiness review.
Maintain
Throughout your 12-month cover, we track Canadian AI, privacy and employment law — federal and provincial, including any successor to Bill C-27 — and update your framework automatically when something changes.
Straight answers.
Does Quebec Law 25 apply to my business if I'm not based in Quebec?
Yes, in most cases. Quebec Law 25 applies to any business that collects, holds, uses, or communicates personal information about Quebec residents — regardless of where your business is incorporated or located. If you have customers, employees, or contractors in Quebec, and you use AI tools that process their personal information, Act 25 applies to you. This includes businesses based in other Canadian provinces and businesses based entirely outside Canada.
What exactly does Quebec Law 25 require for AI?
For AI specifically, Quebec Law 25 requires that businesses conduct a Privacy Impact Assessment (PIA) before using any technology — including AI — that processes personal information in ways that may affect privacy. It also requires: transparency to individuals when decisions about them are made using automated systems; the right for individuals to request human review of automated decisions; and consent obligations that are stricter than PIPEDA. The CAI can impose fines up to 4% of worldwide turnover or $25 million CAD.
Is there a federal Canadian AI law?
No. Bill C-27 contained three parts — an updated federal privacy law (CPPA), a data tribunal act, and the Artificial Intelligence and Data Act (AIDA) — and it died in January 2025 when Parliament was prorogued. AIDA never came into force and no successor is before Parliament. Canada's AI obligations today come from PIPEDA, Quebec Law 25, Ontario's job-posting disclosure rule, BC and Alberta PIPA, and CASL — all in force now. If a federal AI statute is introduced, your framework is updated within your cover.
Does CASL really apply to AI-generated emails?
Yes. CASL applies to commercial electronic messages sent to Canadian recipients — and the law doesn't distinguish between human-written and AI-generated content. If you use AI tools to write, personalise, or optimise commercial emails to Canadian recipients, CASL's consent, identification, and unsubscribe requirements apply. Violations can result in fines up to $10 million CAD per violation.
Is this legal advice?
No. We produce compliance documentation frameworks and policy documents — we are not Canadian lawyers. For businesses in regulated sectors or facing specific enforcement actions, we recommend reviewing your documentation with Canadian-qualified legal counsel. For most businesses using standard AI tools, our frameworks provide a practical, well-documented compliance position that demonstrates good-faith effort.
Build your Canada AI compliance framework on the law that is already enforced.
Ontario's hiring disclosure rules are in force. Quebec Law 25 is enforced. PIPEDA applies today. The businesses that build their compliance framework now are the ones that adapt rather than scramble.
See the Packages →Or book a free 20-minute call to discuss your situation — hello@opsintel.io