Responsible AI in Canada: The rules that apply today

Canadian organizations often wait for “the AI law” before setting rules for AI. That is a mistake in both directions: the federal Artificial Intelligence and Data Act did not pass before Parliament was prorogued in January 2025, and the rules that do bind AI systems today were written before anyone used the phrase.

What applies now

PIPEDA governs personal information in commercial activity across most of Canada, and its principles—consent, purpose limitation, accuracy, and openness—apply to a model’s training data and outputs exactly as they apply to a database.

Quebec’s Law 25 goes further and is fully in force: privacy impact assessments before new systems, a right to be informed when a decision is made exclusively by automated processing, and rules on transferring personal information outside Quebec. For any organization with Quebec residents in its data, this is the AI law.

Sector regulators—OSFI for financial institutions, and provincial health privacy regimes such as PHIPA in Ontario—have model-risk and data expectations that reach AI systems whether or not the word appears in the guideline.

What we build in by default

• A record of the data the system uses, for what purpose, and under what consent.
• Human review for decisions that affect a person’s access, finances, or care.
• Residency decisions made explicitly and documented.
• An evaluation framework, because “we tested it” must mean something when a regulator asks.

This article is general information about how we work, not legal advice. Involving counsel early is considerably less expensive than involving them late.