Reviewed
AI rules in Canada: where a small team should start
You do not need to wait for a new AI law to decide what staff may put into an assistant. Existing privacy obligations, confidentiality agreements and sector-specific requirements can already apply. The useful first question is not “Are we AI compliant?” It is “What does this particular use involve, and which requirements do we need to check?”
This guide is a starting point for readiness work, not a legal opinion or a complete inventory of Canadian law. The sources were reviewed on September 20, 2026; legislation and regulator guidance can change.
Separate a proposal from a requirement
The Artificial Intelligence and Data Act was proposed as part of Bill C-27. It was not enacted in that bill. The Parliamentary record for C-27 is the source to consult for that bill's status, not a vendor's compliance checklist. Do not describe proposed AIDA requirements as obligations already in force, or take their absence as permission to ignore existing law.
The Office of the Privacy Commissioner of Canada's PIPEDA overview explains the federal private-sector privacy framework. PIPEDA generally applies to personal information handled in commercial activities, with important scope and jurisdictional distinctions. Provincial privacy laws, health-information rules and employment context may change the analysis. An Ontario software company and a health-care provider should not assume they have identical duties.
Alberta and British Columbia each have private-sector privacy statutes, and Quebec's Act respecting the protection of personal information in the private sector was modernized through Law 25. Those provincial laws are substantially similar to PIPEDA for certain intra-provincial activities; PIPEDA can still apply when personal information crosses provincial or national borders. Treat jurisdiction as a question to verify, not a reason to apply one checklist across Canada.
Describe one use before approving it
Write a short record for each proposed use. Include:
- The business purpose and the person accountable for approving it.
- The information entered, retrieved or produced, including personal information.
- The provider, account type, connected systems and people who can access results.
- The provider's retention and training terms, processing locations and deletion options.
- Who checks the output, who may be affected and how an error can be corrected.
For example, summarizing a public product announcement is different from summarizing a client's support history. The second use may expose names, account details and information collected for another purpose. Removing a name alone may not make a record anonymous; context can still identify a person. Use synthetic examples while assessing the workflow.
Apply privacy principles to the actual workflow
The Canadian privacy authorities' generative AI principles address accountability, appropriate purposes, consent where required, limiting collection and use, safeguards, accuracy, transparency and individual access. They are guidance for applying privacy law, not a new stand-alone AI statute.
Translate those principles into decisions. Is personal information necessary for this task? Is the proposed use appropriate and supported by the applicable authority or consent? Can staff use less information? What will the organization tell affected people? Who handles a request to access or correct information? The OPC's AI guidance for businesses is a useful companion when identifying questions that need specialist advice.
An enterprise subscription is not, by itself, an answer to those questions. Review the actual service terms, settings and data flow. A claim that a provider does not train its foundation models on business data does not mean there is no storage, access, processing or retention to consider.
Keep sector-specific guidance in its lane
A requirement directed at a regulated institution is not automatically a rule for every Canadian small business. For example, OSFI's Guideline E-23 on model risk management is directed at federally regulated financial institutions and takes effect on May 1, 2027. A supplier may receive related questions from a financial-sector client, but that does not make the supplier directly subject to every part of the guideline. Distinguish a legal duty, a contractual commitment and a client's procurement request.
Leave a record someone else can use
Keep the use description, the sources checked, the approval decision, any conditions and the next review date together. Record open questions honestly. Revisit the decision when the tool gains connectors or action-taking abilities, when the data changes, or when the applicable requirements change. Turn the approved boundaries into an acceptable-use policy that staff can follow without interpreting legislation themselves.
This is general readiness guidance, not legal advice. Confirm the laws and contractual obligations that apply to your organization with a qualified professional.
Source: https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/. General readiness guidance — not legal advice.