AI Regulation in Canada

Canada does not yet have a standalone, comprehensive AI law in force. The federal government's Directive on Automated Decision-Making applies to automated systems used within the federal government itself, requiring algorithmic impact assessments scaled to risk level before deployment, but it does not extend to private-sector AI use. Provincial privacy statutes — including Quebec's Law 25, with its specific provisions on automated decision-making and profiling — currently provide the most concrete enforceable obligations for AI systems processing personal data.

Federal courts have begun applying existing procedural rules to AI-specific harms rather than waiting for new legislation. Sanctions against litigants for AI-fabricated case citations signal that courts will treat AI-generated misinformation in legal and regulatory filings as a conduct issue under current rules, not a gap requiring new statutory authority. This pattern — enforcement through existing frameworks ahead of dedicated AI legislation — mirrors the approach taken by regulators in the US and UK.

Canada's national AI strategy has shifted toward emphasizing workforce literacy and sovereign AI infrastructure, reflecting a policy priority on domestic capability and compute independence alongside governance. For compliance teams, this means the near-term operative obligations remain provincial privacy law and sector-specific guidance, while a federal cross-sector AI law remains a developing rather than settled area to monitor.