What Canadian privacy law actually requires of your AI

Most Canadian companies asking about AI compliance are waiting for the wrong thing. They are watching for an AI law. Meanwhile the obligations that already bind them are sitting in privacy legislation that has been in force for years.

This is a practitioner's read on how these rules land operationally, not legal advice. Get counsel before you rely on any of it.

There is no federal AI statute in force

The Artificial Intelligence and Data Act — AIDA, the AI half of Bill C-27 — did not become law. It fell when Parliament was prorogued in January 2025.

Worth being precise here, because published summaries disagree. Some sources still describe C-27 as before Parliament and under Senate review; others state plainly that it died on the Order Paper. The weight of reporting supports the latter, and either way the operative fact is the same: there is no federal AI-specific statute in force in Canada right now. Anyone telling you confidently what AIDA requires of you today is describing a bill, not a law.

What is actually binding is PIPEDA, enforced by the Office of the Privacy Commissioner — plus the provincial regimes.

Which law applies to you

This trips up more companies than the AI question does.

PIPEDA applies across Canada except in provinces with their own private-sector law declared substantially similar. That is currently Quebec, British Columbia, and Alberta.

If you are a BC company: BC's PIPA displaces PIPEDA for intra-provincial private-sector activity, and you answer to the Office of the Information and Privacy Commissioner for BC rather than the federal OPC.

But PIPEDA does not disappear. It continues to apply to federally regulated organisations, and to personal information crossing provincial or national borders. In practice a Vancouver company with customers in Ontario, a payroll processor in the US, and a model API in another country is operating under more than one regime simultaneously.

The practical consequence for AI work: where your data goes matters as much as what your model does. Sending customer records to a third-party model endpoint outside the province is a cross-border transfer, and it is a privacy decision before it is an engineering one.

Quebec Law 25 already regulates automated decisions

This is the part most people miss. Quebec did not wait for a federal AI act. Law 25 contains obligations that read like AI regulation because, functionally, they are.

Under section 12.1, when a decision is made exclusively by automated processing, you must:

• Inform the individual, no later than the moment you tell them the decision
• Explain the personal information used, the logic involved, and the consequences
• Give them an opportunity to submit observations
• Offer human intervention on request

It applies to decisions producing legal effects or similarly significant effects — hiring, credit scoring, insurance underwriting, service provision, and account decisions made by an automated system.

Two things follow that are easy to get wrong.

"Exclusively" is doing real work. A system that recommends and a human who decides is a different obligation from a system that decides. But this is thinner ice than it looks: if your reviewer approves 99% of recommendations in eight seconds each, describing that as human decision-making is a position you would have to defend, not a settled fact.

A generic privacy notice does not satisfy it. The requirement is to explain the logic and consequences of that decision to that person. Boilerplate in a policy nobody reads is not compliance, it is documentation of intent.

Penalties reach CAD $25 million or 4% of worldwide turnover, whichever is greater, for serious violations.

What this means operationally

Reframed as engineering and process decisions rather than legal ones:

Inventory the automated decisions, not the AI tools. The obligation attaches to consequential decisions, not to whether something is called AI. A deterministic rules engine that declines applications is in scope. A large language model summarising meeting notes is not. Most organisations inventory their tools and miss the decisions.

Know where data crosses a border. Every model endpoint, vector store, logging pipeline, and analytics vendor is a potential transfer. This is the single most common gap we see, because it is invisible in an architecture diagram drawn at the wrong altitude.

Build the explanation at design time. Retrofitting "explain the logic involved" onto a system already in production is expensive and often produces a post-hoc rationalisation rather than an explanation. Deciding up front what the system will be able to say about itself is cheap.

Design the human intervention path. Not a mailbox — a route with an owner, a service level, and the authority to overturn the automated outcome. If the human cannot actually reverse the decision, the intervention is decorative.

Log enough to reconstruct a specific decision. Not aggregate metrics. The inputs, the version of the system, the output, and who reviewed it. This is what turns a complaint into a contained matter rather than an open-ended investigation.

Why this is an advantage, not a tax

The instinct is to treat this as friction. In practice, the organisations that handle it well end up with the thing everyone claims to want anyway.

Every requirement above — a decision inventory, known data boundaries, explainability, a human override with real authority, decision-level logging — is also what you need to operate an AI system with any confidence. You cannot debug a system you cannot reconstruct. You cannot improve a decision you cannot explain. The compliance work and the reliability work are substantially the same work, and doing it once for both reasons is far cheaper than doing it twice.

There is also a commercial angle. If you sell to Canadian enterprises or the public sector, being able to answer these questions in a procurement review is a differentiator. Most vendors cannot, and the ones who can tend to find the security questionnaire stops being the bottleneck.

That is the same argument as governance that helps AI move faster: the rules are only a drag when they are undifferentiated and bolted on late.

Where to start

Three questions, in order:

1. Which of our decisions are made exclusively by an automated system, and which of those significantly affect a person? That list is usually shorter than people fear and different from what they expected.
2. Where does personal information leave the province or the country? Follow the data, not the org chart.
3. For each in-scope decision, can we explain it, can a human overturn it, and can we reconstruct it six months later?

If the answer to any part of question three is no, that is your backlog.

This is the work we build into AI strategy engagements for Canadian clients, because for a company operating in BC or Quebec it is not a separate compliance workstream — it is a constraint on the operating model, and it is cheaper to design around than to remediate.