What Replaced Canada’s AIDA? What Actually Governs AI in Canada in 2026

Nothing replaced Canada’s AIDA — there is no federal AI-specific law. Bill C-27, which contained the Artificial Intelligence and Data Act, died when Parliament prorogued on January 6, 2025. What actually applies today is a patchwork: PIPEDA for private-sector data handling, OSFI Guideline E-23 for federally regulated banks and insurers, and provincial laws like Quebec’s Law 25.

Enterprises searching for “Canada’s AI Act” keep running into the same dead end, because they’re looking for something that stopped existing in early 2025 and was never replaced. That gap matters for two different reasons depending on who’s asking. A compliance team assumes silence means no obligations and skips AI governance work it should be doing under laws that already apply. A due-diligence team assumes Canada is unregulated territory and misses a real, binding deadline — OSFI’s Guideline E-23 — sitting on the calendar for May 2027.

The AI Act Canada Almost Had

The Artificial Intelligence and Data Act (AIDA) was never a standalone bill. It was Part 3 of Bill C-27, the Digital Charter Implementation Act, introduced in June 2022 alongside a rewrite of Canada’s private-sector privacy law (the proposed Consumer Privacy Protection Act, meant to replace PIPEDA). AIDA would have created a federal AI Commissioner, classified general-purpose generative AI systems as automatically “high-impact,” and imposed documentation and risk-assessment obligations on both developers and deployers.

Bill C-27 spent over two years in committee review at the House of Commons Standing Committee on Industry and Technology, with amendments still being debated into late 2024. It never reached a final vote. On the morning of January 6, 2025, Prime Minister Trudeau met with the Governor General to request prorogation of Parliament until March 24, 2025 — and every bill still before the House of Commons died with that prorogation, Bill C-27 and AIDA included. No standalone AI-specific successor bill has been tabled as of this writing; the privacy half of the old bundle was revived separately as Bill C-36 (the Protecting Privacy and Consumer Data Act, tabled June 2026), but it does not replace AIDA’s AI-specific provisions. Canada does not have, and has never had, a dedicated federal AI statute.

What Actually Governs AI in Canada Right Now

The honest answer is: several things, none of them a single “AI law,” and each with a different scope.

PIPEDA (the Personal Information Protection and Electronic Documents Act) is Canada’s existing federal private-sector privacy law. It doesn’t mention AI, but it still applies whenever an AI system processes personal data — consent, purpose limitation, and accuracy obligations don’t disappear just because a model is doing the processing. The CPPA rewrite that would have modernized PIPEDA for the AI era died in the same prorogation as AIDA, so PIPEDA remains the operative (if dated) baseline.

OSFI Guideline E-23 is the closest thing Canada has to binding AI-specific regulation today, but it’s sector-specific. Published by the Office of the Superintendent of Financial Institutions on September 11, 2025, it applies to all federally regulated financial institutions — banks, life insurers, property and casualty insurers, and trust and loan companies, foreign bank branches included. It explicitly calls out “the surge in artificial intelligence / machine learning (AI/ML) models” and requires an enterprise-wide model inventory, risk-tiered governance across each model’s full lifecycle, independent review, and explainability and bias monitoring for models that self-learn or make autonomous decisions. The compliance date is May 1, 2027 — an 18-month runway from publication that’s already ticking.

The Treasury Board Directive on Automated Decision-Making governs how federal government institutions use automated systems — published Algorithmic Impact Assessments, peer review before deployment, bias testing, and disability-impact assessment. It’s a useful template for what “good” looks like, but it binds federal departments, not private companies.

Quebec’s Law 25 is a provincial private-sector privacy law with real AI-relevant teeth: businesses operating in Quebec must disclose when a decision is made “exclusively” by an automated system and explain the logic behind it on request. It’s already covered in depth elsewhere on this site (see the internal link below) — the short version here is that it’s Quebec-specific, not a Canada-wide AI law.

Rule	Who it covers	AI-specific?	Status / deadline
AIDA (Bill C-27)	Would have been all sectors	Yes — was the point	Dead since Jan 6, 2025
PIPEDA	Private sector, federal	No (but applies to AI-processed data)	In force, unchanged
OSFI Guideline E-23	Federally regulated banks & insurers	Yes, explicitly	In force now; compliance required by May 1, 2027
TB Directive on ADM	Federal government departments	Yes	In force; not binding on private sector
Quebec’s Law 25	Businesses operating in Quebec	Partially (automated decisions)	In force

What This Means If You Operate in Canada, the US, or Both

For a federally regulated bank, insurer, or trust company, this isn’t optional or theoretical: OSFI E-23 has a hard compliance date, and 18 months sounds longer than it is once you factor in building a real model inventory across every AI/ML system already in production, not just the ones a compliance team happens to know about. That inventory step is usually where enterprises discover they have more shadow AI in production than anyone budgeted governance for.

For everyone else — retail, healthcare, energy, public sector vendors, or any enterprise without a federal financial-services charter — there’s no equivalent binding deadline, which is exactly the trap. The absence of a Canadian AI Act doesn’t mean the absence of AI risk, and US and EU-headquartered enterprises with Canadian operations often default to whichever framework their head office already tracks. That’s a reasonable instinct: NIST’s AI Risk Management Framework and ISO/IEC 42001 are both referenced directly inside OSFI E-23’s own expectations for model governance, and adopting one of them as a de facto internal standard — rather than waiting for a Canadian equivalent that may not arrive for years — is what OSFI-regulated institutions are already being pushed toward for their AI/ML models specifically.

Quebec’s Law 25 penalty structure ranks among the largest of any Canadian provincial privacy law, but the exact current maximum figures should be verified directly against the Act’s text before being cited in any compliance communication — treat any specific dollar figure you see quoted online as a claim to check, not a fact to repeat.

Three Things to Do Before 2027

1. Build the model inventory now, not in 2027. OSFI E-23 requires knowing what AI/ML models exist, where, and at what risk tier — federally regulated or not, this is the same first step every AI governance framework starts with, and it’s usually the slowest one because it surfaces AI use nobody logged centrally.
2. Pick a standard and apply it consistently. With no binding Canadian AI law to default to, NIST AI RMF and ISO/IEC 42001 are the two frameworks enterprises operating in Canada keep landing on — partly because they’re the same ones a US or EU parent company is likely already tracking, and partly because OSFI’s own guideline points toward them.
3. Don’t confuse “no AI Act” with “no obligations.” PIPEDA, OSFI E-23 (if applicable), Quebec’s Law 25 (if applicable), and sector rules all keep applying regardless of what happens to future federal AI legislation — a wait-and-see posture on AI governance in Canada is a bet on silence that several existing laws already contradict.

Next step: See how Fruggr tracks AI Act obligations across jurisdictions — including sector rules like OSFI E-23 alongside NIST AI RMF and ISO/IEC 42001 — in one place: AI Regulatory Compliance Software.

FAQ

This article was drafted with AI assistance and reviewed by our editorial team before publishing.