Canada Has No AI Law - not yet. Your Business Still Has AI Obligations.

Most business owners we speak with assume one of two things about artificial intelligence and the law in Canada: either that a comprehensive AI statute already governs their use of these tools, or that nothing does. Both assumptions are wrong, and both create risk.

Here is the accurate picture, and what it means for a business operating in British Columbia today.

There is no Canadian AI Act — at least not yet

Canada’s first attempt at comprehensive AI legislation was the Artificial Intelligence and Data Act, introduced as part of Bill C-27 in June 2022. It died on the order paper when Parliament was prorogued in January 2025 and has not been reintroduced.

The federal government’s direction since has been deliberate. Rather than a single omnibus AI statute along the lines of the European Union’s AI Act, Ottawa has signalled that it will regulate AI through modernized privacy legislation, sector-specific rules, procurement standards, and targeted laws addressing specific harms.

That is not the same as deregulation. It means the obligations are spread across statutes you already have to comply with — which makes them easier to miss.

What actually applies to your business right now

Privacy law. This is the primary regulator of AI in Canada today. If your AI tool touches personal information — customer records, employee files, applicant resumes, client communications — then federal privacy law or BC’s Personal Information Protection Act applies to that use. Consent, purpose limitation, retention, accuracy and safeguards are all live obligations. Feeding personal information into a third-party AI service is a disclosure, and it needs to be treated as one.

Human rights law. If an AI system produces a discriminatory outcome in hiring, promotion, tenancy or service delivery, the BC Human Rights Code applies. The fact that an algorithm produced the result is not a defence. In practice, the vendor’s assurance that the model is unbiased is worth exactly as much as your contract makes it worth.

Contract and commercial law. Most AI risk that actually materializes for small and mid-sized businesses arrives through a vendor agreement nobody read closely. Who owns the outputs? Can the vendor train on your data? What happens if the tool produces infringing content, or defamatory content, or simply wrong content that you relied on? Who indemnifies whom?

Sector-specific rules. Federally regulated financial institutions are subject to OSFI’s model risk management guideline. Federal government institutions are bound by the Treasury Board Directive on Automated Decision-Making. If you sell into the public sector, procurement requirements are increasingly setting the standard regardless of what the general law says.

Cross-border exposure. If you have customers in Quebec, Law 25 imposes transparency obligations around automated decision-making. If you have customers in the EU, the EU AI Act likely applies to you already, whatever Canadian law says.

What is coming

Two developments this year will shape the next several years of compliance.

Canada’s National AI Strategy — “AI for All” was launched on June 4, 2026. It is a five-year framework built on six pillars, including protecting Canadians and building sovereign AI capacity. It commits the government to follow-on legislation addressing deepfakes, chatbot safety, children’s online protection and election integrity. Specific timelines remain largely unstated.

Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on June 15, 2026 and is expected to move to second reading when Parliament resumes in the fall. It is the third attempt at federal privacy reform in six years, and if passed it would:

•      repeal and replace the privacy provisions of PIPEDA;

•      recognize privacy as a fundamental right;

•      create a new regulator — the Digital Safety and Data Protection Commission of Canada — with audit, order-making and penalty powers;

•      introduce administrative monetary penalties up to the greater of $10 million or 3% of gross global revenue, with higher exposure for certain offences; and

•      introduce obligations specific to automated decision-making.

There is no standalone AI statute in Bill C-36. That is the point: the government is putting AI obligations inside privacy law rather than beside it.

A federal consultation on AI transparency requirements is also open until September 23, 2026. Businesses with a view on what disclosure obligations should look like have a narrow window to say so.

Five things to do before the rules harden

1.      Inventory your AI use. Most organizations underestimate this. Include the tools employees adopted on their own — the summarizer, the note-taker, the drafting assistant, the customer service bot.

2.      Identify which systems touch personal information. That subset is already regulated, today, under existing privacy law.

3.      Read your vendor agreements. Specifically: training rights over your data, output ownership, indemnities, data residency, and the vendor’s own subprocessors.

4.      Write an AI use policy. It does not need to be long. It needs to say what tools are approved, what information may never be entered into them, and who reviews output before it goes to a client or a regulator.

5.      Put a human in the loop where decisions affect people. Hiring, credit, pricing, tenancy, discipline. This is where privacy law, human rights law and forthcoming legislation all converge.

The practical takeaway

The absence of an AI statute is not a grace period. It is a patchwork, and patchworks are harder to comply with than single codes, not easier. The businesses that will have the least trouble in two years are the ones that started documenting their AI governance while it was still voluntary.

Whiteboard Law Corporation advises businesses across British Columbia on corporate governance, commercial agreements and privacy compliance. If you would like a review of your organization’s AI use, vendor agreements or privacy practices, please get in touch.

This article is provided for general information only and does not constitute legal advice. The law in this area is changing quickly; the information above is current as of August 2026. Please consult us about your specific circumstances.