AI Governance in Canada in 2026: The Rules That Actually Apply to Your Organization

If you are looking for one Canadian AI law to comply with, you will not find it. In committee briefing materials dated June 15, 2026, Innovation, Science and Economic Development Canada (ISED) states: “While Canada does not have federal horizontal AI legislation, a number of Canadian laws already apply to certain aspects of the development, operation, and use of AI,” naming PIPEDAPIPEDA — Personal Information Protection and Electronic Documents ActA Canadian federal privacy law protecting personal information collected, used, or disclosed in electronic commerce., the Copyright Act and the Criminal Code.

The same ISED briefing adds that sectoral laws, such as the Food and Drugs Act for medical devices, “can address deployment risks caused by AI in specific sectors.”

For a private-sector organization, that means AI governance in Canada is mostly about applying privacy law, sector regulation and your customers’ procurement requirements to the AI you already use. This guide covers the official rules and guidance that apply today or are scheduled to apply, who each one applies to, and what to do about it. It is general information, not legal advice.

ISED describes the Personal Information Protection and Electronic Documents Act (PIPEDA) as “the federal law that governs the handling of personal information in the course of commercial activities.” If an AI tool collects, uses or discloses personal information about customers, employees or prospects, PIPEDA is the starting point for your obligations.

On December 7, 2023, the Office of the Privacy Commissioner of Canada (OPC) published the Principles for responsible, trustworthy and privacy-protective generative AI technologies with privacy authorities across Canada. The OPC document states that “Organizations developing, providing, or using generative AI are obligated to ensure” their activities comply with applicable privacy law, and it addresses both developers and providers and organizations that use generative AI. Its principles are legal authority and consent, appropriate purposes, necessity and proportionality, openness, accountability, individual access, limiting collection, use and disclosure, accuracy, and safeguards.

The principles are written with “should”, but the OPC document notes that “many of the considerations listed will be required for an organization to comply with applicable privacy law.” Treat them as a checklist, not optional reading.

Regulators are enforcing the underlying law against AI developers. In PIPEDA Findings #2026-002, dated May 6, 2026, the OPC reported on a joint investigation of OpenAI with Quebec’s Commission d’accès à l’information and the British Columbia and Alberta information and privacy commissioners. The OPC found that OpenAI “failed to obtain valid consent” for collecting, using and disclosing personal information, and also found failures on openness, accuracy and accountability. The OPC concluded the issues were “well-founded and conditionally resolved” based on OpenAI’s commitments; the OPC’s overview notes that Quebec’s CAI reached its own conclusions, finding the consent and retention issues “well-founded and unresolved.”

If you use AI through a vendor, the accountability stays with you. On September 10, 2026, the OPC announced its Guidance on assessing third-party service providers, and the OPC’s announcement says businesses remain accountable for personal information they control, including “data that is collected by a third party on their behalf or transferred to a third party for processing.”

Quebec’s Act respecting the protection of personal information in the private sector contains a specific rule for automated decisions. The Commission d’accès à l’information du Québec (CAI) states in its compliance tool Vers la conformité à la Loi sur le privé that, by September 22, 2023, businesses needed mechanisms to “informer une personne lorsqu’elle fait l’objet d’une décision fondée exclusivement sur un traitement automatisé”, that is, to inform a person when they are the subject of a decision based exclusively on automated processing.

The obligation is backed by penalties. The CAI’s page on sanctions for businesses lists, among breaches that can attract an administrative monetary penalty, failing to inform people of decisions based exclusively on automated processing “(sans intervention humaine)” and of their right to present observations to a member of the business’s staff who is in a position to review the decision. The CAI says administrative monetary penalties, the regime under which these breaches are listed, can reach up to 2% of worldwide turnover or $10 million; the CAI page states that maximum for administrative monetary penalties as a whole, not a separate amount for each breach.

In practice: if an individual in Quebec receives a decision produced by an AI model or rules engine with no human involved, such as an automated screening outcome, you need a notice and a working route to human review. Find those decisions in your processes now, rather than after a complaint.

The Legislative Assembly of Ontario records that Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 received Royal Assent and is Chapter 24 of the Statutes of Ontario, 2024, and the Assembly’s Royal Assent text of the bill dates that assent November 25, 2024. According to the explanatory note in that text, Schedule 1 enacts the Enhancing Digital Security and Trust Act, 2024, which “addresses cyber security and artificial intelligence systems at public sector entities”: institutions under Ontario’s two freedom of information and protection of privacy statutes (other than the Assembly), children’s aid societies and school boards.

Under the Act as enacted, the AI duties apply only to public sector entities that are prescribed by regulation. A prescribed entity must provide information to the public about its use of an AI system, “develop and implement an accountability framework” for that use, and take prescribed steps “to manage risks associated with the use of the artificial intelligence system.” Regulations can also prohibit specific uses and require an individual to oversee AI use in prescribed circumstances.

The Government of Ontario’s Order in Council 361/2025 named January 29, 2025 as the day sections 1 to 16 of the Enhancing Digital Security and Trust Act, 2024 came into force. As of November 2026, the Government of Ontario’s Enhancing Digital Security and Trust Act page lists regulations under the Act on cyber security and on digital technology affecting individuals under 18, and lists no AI-specific regulation. In short, the AI provisions are in force as law, but we could not confirm from an official Ontario source that any entity has yet been prescribed to carry the AI duties.

The practical point for vendors: entities that are prescribed will have transparency, accountability and risk duties, so clear documentation of what your AI does, what data it uses and how it is overseen can make you easier to buy from.

The Treasury Board’s Directive on Automated Decision-Making binds federal departments, not private companies, but it shapes what vendors are asked for. According to the Government of Canada’s guide on the scope of the Directive, it applies to departments “using automated decision systems to fully or partially automate an administrative decision”, and the Government of Canada’s guide says it covers systems “developed or procured after April 1, 2020.”

The Government of Canada describes its Algorithmic Impact Assessment as “a mandatory risk assessment tool intended to support the Treasury Board’s Directive on Automated Decision-Making”, a questionnaire that “determines the impact level of an automated decision system.” Those impact levels determine the mitigations the Directive requires. If your product makes or supports decisions about people, a federal client may need information from you about data, logic and oversight to complete that assessment.

The Office of the Superintendent of Financial Institutions (OSFI) published Guideline E-23 – Model Risk Management (2027) on September 11, 2025, and OSFI lists its effective date as May 1, 2027. OSFI states that the guideline “applies to all federally regulated financial institutions”, and its definition of a model expressly includes “AI/ML methods.”

OSFI says E-23 covers models or data sourced from “third-party vendors”, and that “Institutions should identify and track all models in use or recently decommissioned.” One of its stated outcomes is that “Model governance covers the entire model lifecycle.”

If you are a software or AI vendor to a bank or insurer, E-23’s coverage of vendor-sourced models means your customer may ask you for model documentation to support its own model risk management. For more on AI in that sector, see AI consulting for financial services.

ISED’s Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, dated September 2023, is described on ISED’s page as a “voluntary commitment” by developers and managers of advanced generative systems. Its principles are accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness, and ISED’s page lists signatories including Cohere, IBM and TELUS. Even if you never sign it, its measures are a reasonable reference for your own policy.

On June 4, 2026, the Prime Minister’s Office announced that Prime Minister Mark Carney had launched AI for All: Canada’s new national artificial intelligence strategy, and the release quotes the Hon. Evan Solomon, Minister of Artificial Intelligence and Digital Innovation. The Prime Minister’s Office says the strategy is “anchored in three guiding principles: building trust, creating opportunities, and reinforcing Canadian sovereignty,” and lists a commitment to “modernising legislative frameworks for the digital age that prioritise trust and safety and reduce the risks of AI.”

ISED then ran a public consultation on AI transparency, which ISED says ran from July 23 to September 23, 2026, on topics including “detecting and identifying AI-generated content” and “helping individuals know when they are interacting with an AI system.” ISED says the feedback will inform “next steps to advance safe, responsible and reliable AI in Canada”; the announcement does not commit to specific legislation or dates.

Build an AI inventory. List every AI tool and model in use, who owns it, what data it touches, and whether it makes or supports decisions about people. OSFI’s expectation to “identify and track all models in use” is a useful benchmark even outside financial services.

Map each use to the rules above. Personal information points to PIPEDA and the OPC’s generative AI principles. Exclusively automated decisions about people in Quebec need a notice and a review route. Ontario public sector and federal clients may need transparency, accountability and impact assessment information from you. Sector rules can add obligations; ISED’s briefing cites the Food and Drugs Act for medical devices, and if you work in health care see AI consulting for healthcare.

Confirm legal authority and consent before personal information goes into an AI tool, and limit what goes in to what the purpose needs.

Assess your vendors against the OPC’s third-party guidance, and put data handling, retention and access terms in the contract.

Keep a human in the loop where decisions affect people, and document who reviews what. In Quebec, a staff member able to review an exclusively automated decision is part of the obligation.

Write it down and train people. A short AI policy, a named owner and staff who understand it turn these rules into practice. HCC’s corporate AI training can help teams learn safe, compliant use.

HCC’s AI governance and compliance service can help you build the inventory, map it to these rules and draft the policies and documentation your customers and regulators may ask for. To see where you stand first, try the AI readiness assessment, and for the security side read AI security threats every enterprise should prepare for.

Innovation, Science and Economic Development Canada — Minister of Artificial Intelligence and Digital Innovation at the Standing Committee on Industry and Technology (briefing materials, June 15, 2026) Office of the Privacy Commissioner of Canada — Principles for responsible, trustworthy and privacy-protective generative AI technologies Office of the Privacy Commissioner of Canada — PIPEDA Findings #2026-002: Overview of the Joint Investigation of OpenAI OpCo, LLC Office of the Privacy Commissioner of Canada — Guidance for businesses working with third-party service providers (news release) Commission d’accès à l’information du Québec — Vers la conformité à la Loi sur le privé Commission d’accès à l’information du Québec — Sanctions et poursuites (entreprises) Legislative Assembly of Ontario — Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 Legislative Assembly of Ontario — Bill 194, Royal Assent text (Chapter 24 of the Statutes of Ontario, 2024) (PDF) Government of Ontario — Order in Council 361/2025 Government of Ontario — Enhancing Digital Security and Trust Act Government of Canada — Guide on the scope of the Directive on Automated Decision-Making Government of Canada — Algorithmic Impact Assessment tool Office of the Superintendent of Financial Institutions — Guideline E-23 – Model Risk Management (2027) Innovation, Science and Economic Development Canada — Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems Prime Minister of Canada — Prime Minister Carney launches AI for All: Canada’s new national artificial intelligence strategy Innovation, Science and Economic Development Canada — Government of Canada launches public consultation on AI transparency