Is AIDA — the Artificial Intelligence and Data Act — a law you need to comply with in Canada? No. It died on the order paper in January 2025, alongside Bill C-27, when Parliament was prorogued. There is no dedicated federal AI statute in Canada, and nothing suggests a horizontal AI law comparable to the EU AI Act is imminent. That doesn't mean AI use in your business exists in a legal vacuum — quite the opposite, which is exactly why this guide exists.
This article lays out what actually happened to AIDA, what Bill C-36 (tabled June 2026) proposes, what the "AI for All" national strategy actually is, and — most importantly — the binding obligations that already apply to your business the moment an AI tool touches personal information, particularly in Quebec. We cover a comparison table, a readiness checklist, two SMB case studies, and a realistic CAD budget.
Who wrote this guide
Written and reviewed by IT Cares certified technicians who help Canadian SMBs sort fact from confusion on this kind of shifting regulatory ground. We are not a law firm and this isn't a substitute for legal advice on your specific situation — but we regularly help businesses turn "is this actually a law yet?" into a concrete, practical answer.
AIDA Is Dead: What Actually Happened to Bill C-27
To understand where federal AI regulation stands in 2027, start with what never became law. In June 2022, the federal government tabled Bill C-27, an omnibus bill with three parts: the Consumer Privacy Protection Act, meant to replace PIPEDA's privacy provisions; the Personal Information and Data Protection Tribunal Act; and, as Part 3, the Artificial Intelligence and Data Act — AIDA. It was Canada's first attempt at a horizontal law dedicated to AI, with risk-management, recordkeeping, and disclosure obligations for "high-impact" AI systems, backed by administrative penalties and criminal offences for the most serious cases of reckless or malicious use.
Bill C-27 passed second reading and moved to committee for detailed study. That's where it stalled. The Industry committee received hundreds of proposed amendments, and AIDA in particular drew criticism from multiple directions — called too vague by legal experts, insufficiently protective by civil liberties advocates, and drafted without adequate public consultation according to several committee witnesses. Detailed study was still incomplete when Parliament was prorogued in January 2025. Prorogation has an automatic, final procedural effect: every bill that hasn't received royal assent dies on the order paper, including ones already well into committee review. Bill C-27 — and AIDA with it — ceased to exist as legislation under consideration, without ever being passed or brought into force.
Worth stating plainly, because the confusion is common: AIDA was never a law in force, not even partially. It never created a single enforceable obligation for any Canadian business. Any reference to "AIDA requirements" you might encounter is either confusion with Quebec's Law 25, or speculation about a future law — never a currently binding legal requirement.
2026: Bill C-36 and the "AI for All" Strategy
After the election that made Mark Carney prime minister, the federal government created a new ministry: Artificial Intelligence and Digital Innovation, led by Evan Solomon, Canada's first-ever minister to hold that portfolio. His position was clear from the start: no reheated version of AIDA. The approach that emerged took shape in two moves over the summer of 2026.
On June 4, 2026, Prime Minister Carney and Minister Solomon unveiled "AI for All," Canada's national AI strategy, the product of consultations involving more than 11,000 Canadians. It's a $2.3-billion-plus investment plan built around six pillars — rights protection, technological sovereignty, workforce training, business adoption, public trust, and international partnerships — targeting roughly $200 billion in economic growth and up to 250,000 new jobs over five years. One piece is directly relevant to SMBs: $700 million earmarked for more affordable cloud compute for small and mid-sized businesses building or deploying their own AI tools. It's important to be precise about what this document is: an investment and policy roadmap, not a law. On its own, it creates no new legal obligation for your business.
The second, more directly legal development landed on June 15, 2026: the tabling of Bill C-36, proposing the Protecting Privacy and Consumer Data Act (PPCDA). It's the most significant overhaul of federal private-sector privacy law in more than 25 years, intended to replace PIPEDA's privacy provisions. It includes measures relevant to AI use: stronger transparency when an automated system makes a significant decision about a person, rules governing de-identification and anonymization of data — central to any business training or fine-tuning AI models on customer data — and expanded deletion rights plus stronger protections for minors' information.
What Bill C-36 is not
Unlike AIDA, Bill C-36 creates no risk-tiered AI classification, no AI Commissioner, and no specific obligations for "high-impact" AI systems. Civil liberties groups have criticized it for leaving broad exceptions for commercial data use and not substantively addressing documented AI harms. As of this writing, C-36 is still working through Parliament and is not yet law.
What Actually Governs AI Use in Your Business Right Now
The absence of a federal AI-specific law does not mean a legal vacuum. Three layers of rules already apply, today, to any Canadian SMB using AI tools — a writing assistant, a marketing content generator, a customer-service chatbot, or a candidate-screening system.
The first and most consequential layer for a Quebec-based business is Law 25. It doesn't mention "artificial intelligence" by name, but it governs any processing of personal information regardless of the technology involved — including a generative or predictive AI model. The moment an AI tool has access to customer, candidate, or employee personal information, the full range of Law 25 obligations applies: consent, defined purposes, retention limits, security measures, and — the point most often missed — its specific rules on automated decision-making, covered below.
The second layer is federal PIPEDA, which continues to apply as a baseline for organizations in provinces without substantially similar legislation, and which would eventually be modernized if Bill C-36 passes. A business handling customer data across multiple provinces needs to keep this layer in view alongside Law 25.
The third layer, often overlooked, is existing sector-specific regulation, which continues to apply to AI use cases without a dedicated AI law. A financial institution using AI for credit scoring remains subject to the regulation already governing financial institutions; a professional firm using AI to assist a client decision remains subject to its usual professional obligations. The "AI for All" strategy leans on these existing instruments rather than creating a single horizontal regime — a fundamental difference from the EU's approach, which classifies AI systems by risk tier within one cross-sectoral law.
Using AI tools without knowing what Law 25 already requires?
Our certified technicians review your AI tools — chatbots, screening systems, pricing engines — and tell you exactly what needs to be documented today.
AIDA (Dead) vs Law 25 vs PIPEDA — What Actually Applies
The table below compares what AIDA would have required had it become law, what Law 25 actually requires in Quebec today, and where federal PIPEDA — and its proposed successor under Bill C-36 — currently stands. Our companion guide on Law 25 vs PIPEDA for multi-province business covers the underlying provincial/federal relationship in more depth; this table adds AIDA as the point of comparison most relevant to AI specifically.
| Dimension | AIDA (dead bill) | Law 25 (Quebec, in force) | PIPEDA / Bill C-36 (federal) |
|---|---|---|---|
| Current legal status | None — died on the order paper in January 2025, never enacted | Fully in force since its 2022–2024 phased rollout | PIPEDA in force today; Bill C-36 tabled June 2026, still in the legislative process |
| Scope on AI specifically | Would have created risk-tier classification for "high-impact" AI systems | Not AI-specific, but covers any processing of personal information by any system, including AI models | Not AI-specific; Bill C-36 adds de-identification/anonymization rules relevant to AI training data |
| Automated decisions | Would have required impact assessments and documentation for high-impact systems | Section 12.1: must inform the individual, explain the decision on request, and allow submitted comments | PIPEDA has no equivalent today; Bill C-36 proposes stronger transparency for significant automated decisions |
| Regulator | Would have created an AI and Data Commissioner | Commission d'accès à l'information du Québec (CAI) | Office of the Privacy Commissioner of Canada |
| Penalties | Would have included administrative penalties and criminal offences for the most serious cases | Up to $25,000,000 or 4% of global revenue (penal); up to $10,000,000 or 2% (administrative) | Historically limited under PIPEDA; Bill C-36 proposes materially higher maximums |
| What actually applies to your business today | Nothing — no enforceable obligation exists | Full personal information rules, including for any AI tool that processes it | PIPEDA baseline today; watch Bill C-36 for what changes once passed |
The takeaway: a Canadian SMB that wants to know "what the law actually requires" of its AI use should look to Law 25 first if it operates in Quebec, not to AIDA. If your business also serves EU customers, our guide on GDPR compliance for Canadian SMBs covers the European regime, whose automated-decision rules (Article 22) are already more developed than anything proposed federally in Canada.
Law 25's Automated Decision-Making Rules: Already Binding in Quebec
This is the single most directly relevant rule for AI use in Quebec business today, and one of the least understood by SMB owners. Since September 2023, Law 25 has required that any organization making a decision based exclusively on automated processing of personal information inform the affected individual, at or before the time of the decision. That person can then request the personal information used, the reasons and main factors behind it, and their right to correction — plus the right to submit comments to a staff member able to review the decision.
In practice, this touches several common SMB AI use cases: automated credit scoring, resume screening that rejects applicants without human review, dynamic pricing that adjusts automatically to a customer's profile, or fraud detection that blocks a transaction outright. The key word is "exclusively" — if a human reviews and confirms the AI's recommendation before a final decision, Section 12.1's obligation generally doesn't apply the same way, which is why many businesses deliberately build a human checkpoint into the process, both for ethical caution and to simplify compliance.
Why this rule is more concrete than AIDA ever was
AIDA would have imposed a heavy impact-assessment regime, but only for systems judged "high-impact" under criteria never finalized by regulation. Law 25 applies today, with a clear trigger — an exclusively automated decision affecting a person — and no further implementing regulation needed to make it enforceable.
AI Governance Readiness Checklist for Canadian SMBs
A working checklist regardless of what happens with Bill C-36 or any future federal AI legislation:
- ☐ Inventory every AI tool in use (writing assistants, chatbots, marketing tools, screening or scoring systems)
- ☐ Identify which of those tools have access to personal information about customers, candidates, or employees
- ☐ Determine whether any tool makes a decision about a person exclusively through automated processing
- ☐ Where an automated decision affects a person, build an information-and-review process meeting Law 25 Section 12.1
- ☐ Write an internal AI use policy: which tools are approved, what data may enter them, what needs human sign-off
- ☐ Train staff on the risk of pasting confidential or personal data into public AI tools not vetted by the business
- ☐ Review AI vendor terms — data storage location, model training use, retention — and prefer business-tier plans with contractual guarantees for sensitive use cases
- ☐ Track Bill C-36's progress and any new federal AI-specific bill; revisit this checklist annually or after deploying a significant new AI tool
Case Study: A Quebec Recruitment Agency's AI Screening Tool
A 12-person recruitment agency outside Montreal had used an AI-powered applicant tracking system for about a year to automatically screen incoming resumes for its employer clients, filtering out candidates before a human recruiter saw the rest of the pool. Nobody had connected this to Law 25 until a candidate emailed asking why they'd been rejected and requesting an explanation "under Quebec privacy law." The agency had no process for this: no documented record of the tool's criteria, no designated person to review a contested decision, and no disclosure mentioning automated screening at all.
The fix took about four weeks: a clear notice disclosing automated screening was added to the application process, the tool's criteria were documented well enough to explain a decision on request, and a simple internal process now lets any rejected candidate ask for human review. Total cost: roughly $4,800 CAD, split between a short legal consultation on Section 12.1 and internal time building the workflow. The founder's takeaway: the AI tool wasn't the problem — the complete absence of a documented review process was, and it went unnoticed for a year.
Case Study: An Ontario E-Commerce Store's AI Content Tools
A smaller, lower-stakes example: a two-person home goods e-commerce store uses AI writing tools for product descriptions, newsletters, and ad copy — no automated decisions about people anywhere in the workflow. After a short review, the owners concluded their AI-specific regulatory exposure was minimal, but still documented that analysis and added a line to their privacy policy disclosing AI use in content production, for transparency and as a hedge against future regulatory change. Total cost: under $600 CAD, mostly time spent on the privacy policy and a vendor terms review.
📊 IT Cares field note: It isn't "using AI" that creates regulatory exposure — it's whether the AI decides something about a person without human review. Content generation carries far less exposure than screening or scoring.
Budget: What Basic AI Governance Costs a Canadian SMB (CAD)
Costs scale sharply with whether your AI use involves automated decisions about people or general productivity tasks. Realistic ranges for a typical SMB:
| Item | Productivity use only (no automated decisions) | Automated decisions about people |
|---|---|---|
| AI tool audit | $400 – $900 | $900 – $2,200 |
| Internal AI use policy | $400 – $800 | $800 – $1,600 |
| Law 25 review / disclosure updates | $300 – $700 | $1,200 – $2,800 |
| Human review process & documentation | Not applicable | $1,200 – $2,400 |
| Staff training | $250 – $600 | $600 – $1,400 |
| Total, first year | $1,350 – $3,000 | $4,700 – $10,400 |
A business using AI purely for productivity and content generation can budget lean. One using AI to screen, score, or price people automatically should budget for real documentation and legal input — the risk isn't hypothetical, and Quebec's regulator doesn't need a new AI law to act on a Section 12.1 gap.
Common Mistakes Canadian SMBs Make with AI Right Now
Assuming "there's no AI law yet, so there's no risk"
This is the most common and costly mistake. The absence of a federal AI-specific law does nothing to excuse a Quebec business from its Law 25 obligations the moment an AI tool processes personal information. The CAI doesn't need a new AI law to act on a Section 12.1 breach — that provision has been in force since 2023.
Pasting confidential data into public AI tools
A widespread and rarely governed habit: an employee copies customer information, contracts, or financial data into a free generative AI tool for a quick summary or rewrite, without knowing whether that data is retained or used to train the vendor's model. Depending on the tool's terms, this can amount to disclosing personal information to a third party without adequate consent.
Deploying screening or pricing automation without legal review
Many SMBs adopt AI features bundled into software they already use — an applicant tracking system, a pricing platform — without realizing the automation feature triggers Law 25 Section 12.1. The vendor generally does not take on that compliance burden for its customers.
For broader provincial compliance context, our guide on Law 25 vs PIPEDA for multi-province business covers the five concrete obligations that apply across Canada, while our article on GDPR compliance for Canadian SMBs covers the regime that applies if your business also serves EU customers. Our teams also support these efforts through a security audit and business cybersecurity services tailored to SMBs adopting AI tools.
Canadian Government & Reference Resources
Several public resources are relevant to a Canadian business tracking this shifting ground, though none replace legal advice specific to your situation:
- Commission d'accès à l'information du Québec (cai.gouv.qc.ca) — the provincial regulator for Law 25, including its application to AI, and the first stop for guidance on Section 12.1.
- ISED (ised-isde.canada.ca) — the federal department tracking the "AI for All" strategy and Bill C-36's progress through Parliament.
- Office of the Privacy Commissioner of Canada (opc.gc.ca) — guidance on PIPEDA and AI-driven processing, and the source to watch as Bill C-36 moves forward.
- BDC (bdc.ca) — advisory support and financing for responsible AI adoption, including potential access to compute capacity announced under "AI for All."
If you're building broader AI governance rather than tackling this in isolation, our managed IT services can maintain AI usage policies and documentation over time, and a security audit is a practical starting point for mapping which AI tools touch personal information.
Where This Goes Between Now and the End of 2027
Based on the trajectory since Bill C-36 was tabled, a few patterns are emerging. C-36 should continue through the normal legislative process — second and third reading, committee study, Senate review — which typically takes many months, sometimes over a year, for a bill this size, and its passage in current form isn't guaranteed given criticism from civil liberties groups. The federal approach continues to favour targeted instruments over a single horizontal AI law: nothing signals an AIDA-equivalent bill, with risk-tier classification and a dedicated commissioner, is in preparation near-term. Canadian SMBs should expect Law 25 to remain the primary framework actually governing their AI use touching people in Quebec, supplemented by sector regulation and, eventually, Bill C-36 once passed.
Pressure won't come from legislation alone, either. Contractual requirements from large enterprise customers, cyber-insurance underwriters, and financial partners increasingly include AI governance clauses, independent of what the law formally requires — a business that already documents its AI governance is better positioned to meet these expectations as they become standard.
Frequently Asked Questions
Adopting AI Without an Undocumented Compliance Gap
IT Cares reviews your actual AI tools against Law 25's requirements — chatbots, screening systems, pricing engines — and gives you a right-sized action plan, not a generic checklist.
Comments (3)
I genuinely thought AIDA was still moving through Parliament somewhere. Good to finally get a straight timeline of what died and what's actually new (C-36 vs AIDA is a totally different thing, apparently).
We use an AI tool for resume screening and had zero idea Section 12.1 of Law 25 applied to it. This is the first article that actually connected AI tools to a real, existing obligation instead of just talking about laws that don't exist yet.
The comparison table made it click for me — Law 25 is doing more real work on AI right now than the federal government is. Wasn't expecting that.
Leave a Comment