Canada AI Regulation

Canada's proposed federal AI framework, the Artificial Intelligence and Data Act (AIDA), was introduced as part of Bill C-27 alongside broader privacy law reform. It did not survive the federal legislative process intact, and unlike Colorado's amended-but-progressing statute, AIDA's path forward is genuinely uncertain rather than delayed on a known timeline — treat any specific predicted effective date for AIDA with real skepticism.

What AIDA would have done

As proposed, AIDA would have introduced obligations for "high-impact" AI systems — a risk-tiered concept broadly similar to the EU AI Act's and Colorado's approaches — including risk assessment, mitigation measures, and monitoring obligations, with enforcement through a newly created AI and Data Commissioner role.

What actually governs AI in Canada today

In the absence of enacted federal AI-specific legislation, two other layers of law do the practical work:

• Federal privacy law (PIPEDA) already applies to AI systems that process personal information, covering a meaningful share of AI-related data practices even without AI-specific provisions.
• Provincial privacy law, most notably Quebec's Law 25, imposes its own obligations — including specific requirements around automated decision-making that produces legal or similarly significant effects on individuals, which is functionally close to the "consequential decision" concept used in Colorado's statute.

The practical approach for Canadian compliance programs

Build your program around PIPEDA and applicable provincial privacy law now, rather than waiting for or assuming a specific AIDA outcome. If AIDA or a successor bill is eventually enacted, a program already built around rigorous privacy-law compliance and documented risk assessment will need less rework than one built around anticipating a specific, uncertain statute.

Provincial variation

Quebec's Law 25 is materially more prescriptive than most other provinces' privacy frameworks regarding automated decision-making, which means a Canada-wide compliance posture built only to a national baseline can still under-cover Quebec-specific obligations.