AIDA Is Gone. The OPC Is Not: What Actually Governs AI in Canada Right Now

When Canada's Artificial Intelligence and Data Act died on the order paper in January 2025, many Canadian business owners quietly exhaled. The compliance deadlines, impact assessments, and high-risk system designations that had been looming on the horizon disappeared with it. No legislation, no problem.

That reasoning is understandable. It is also wrong in a way that is becoming clearer with every enforcement action the Office of the Privacy Commissioner of Canada takes in 2026.

Canada does not have a comprehensive AI law. It does have PIPEDA — the *Personal Information Protection and Electronic Documents Act* — which applies to any organization that collects, uses, or discloses personal information in the course of commercial activity, regardless of whether the organization is building an AI system or simply using one. And the OPC has spent 2026 making it explicit that PIPEDA applies to organizations using AI tools in ways most SMEs have not fully thought through.

What Happened to AIDA

Bill C-27, introduced in 2022, bundled two major reforms: an overhaul of federal private-sector privacy law and a new Artificial Intelligence and Data Act (AIDA) that would have created specific obligations for high-impact AI systems. When Parliament was prorogued on January 6, 2025, both died on the order paper.

The government's successor privacy bill, Bill C-36, was introduced at first reading in June 2026 and has not advanced since. It would bring meaningful changes — penalties up to the greater of C$25 million or 5 per cent of gross global revenue, mandatory breach reporting improvements, and limited automated decision provisions — but it is not law. The minister responsible has indicated that any future AI-specific legislation would be a new design rather than an AIDA revival. No federal AI bill is before Parliament as of November 2026.

The practical reality is that Canada's AI governance framework in 2026 is PIPEDA plus provincial privacy law plus the OPC's interpretive guidance, enforced through investigation. That is a less tidy story than "the EU AI Act equivalent is coming," but it is the story that shapes what Canadian organizations must actually do right now.

PIPEDA Is Doing the Work

On May 6, 2026, the OPC — together with the privacy regulators of British Columbia, Alberta, and Quebec — released joint findings from their investigation into OpenAI's ChatGPT. The regulators found that OpenAI had violated federal and provincial privacy laws when it collected and used personal information to train its models. The finding — documented as PIPEDA Findings #2026-002 — determined that OpenAI had launched the product without fully addressing known privacy issues.

The federal complaint was rated well-founded and conditionally resolved, meaning OpenAI committed to specific remediation steps. British Columbia and Alberta's findings were unresolved under provincial PIPA requirements.

Three things stand out about this finding for any Canadian organization using AI tools:

First, PIPEDA applies to organizations that use AI, not just organizations that build it. The OpenAI investigation concerned how OpenAI sourced training data. But the accountability principle the regulators applied — PIPEDA Schedule 1, Principle 4.1.3 — holds that an organization is responsible for personal information in its custody or control, including information transferred to a third-party processor. When your organization uploads customer records, employee files, or clinical notes to an AI tool, your organization is the accountable party under PIPEDA, not the AI vendor.

Second, "it was just a productivity tool" is not a legal defence. The organizations whose customers' personal data was part of OpenAI's training corpus did not build AI systems. Many of them simply used ChatGPT. The OPC's investigation and the guidance it generated apply the same principles to downstream users as to developers.

Third, the OPC is not waiting for legislation. Commissioner Philippe Dufresne's remarks at the 2026 IAPP Canada Symposium made clear that his office intends to continue active AI enforcement under existing law. The annual report tabled in June 2026 — titled *Championing Privacy in the Age of AI* — cited a sharp rise in privacy complaints linked to AI tools.

The September 2026 Guidance: If You Use AI Vendors, This Is for You

On September 10, 2026, the OPC released draft guidance on assessing third-party service providers under PIPEDA. The comment period closes December 4, 2026, so the guidance may be revised — but its requirements reflect the OPC's current enforcement position and are worth taking seriously now.

The guidance rests on PIPEDA Principle 4.1.3 and covers every organization that outsources processing of personal information: cloud vendors, SaaS platforms, AI tool providers. Key requirements include:

• Due diligence before procurement: Organizations are expected to understand a vendor's data flows, security practices, and administrative controls before giving them access to personal information.
• AI training data scrutiny: If a vendor's service relies on training data, organizations are expected to verify that the sourcing is consistent with PIPEDA — specifically, that individuals whose data was used provided appropriate consent.
• Secondary use analysis: Organizations must assess whether using a service involves secondary uses of personal information, such as an AI vendor using customer data to train models after the initial task is completed. If secondary use is occurring, consent may be required.
• Anonymization claims: The guidance tells organizations not to accept anonymization claims at face value. If there is a reasonable risk of re-identification, the data is still personal information under PIPEDA.

For a Canadian SME evaluating whether to renew a ChatGPT Enterprise subscription, deploy Microsoft Copilot across a finance team, or connect a customer service AI to a CRM — this guidance describes what the OPC will expect you to have done before you made those decisions.

Quebec Law 25: Harder Rules if You Operate There

For organizations with employees, customers, or operations in Quebec, Law 25 adds specific requirements beyond federal PIPEDA that have been in full force since September 2023.

The most consequential for AI use: Section 17 requires a Privacy Impact Assessment before any personal information is communicated outside Quebec. Claude Enterprise, Microsoft Copilot, and most SaaS AI platforms process data on US-based infrastructure. For Quebec-regulated organizations, that cross-border transfer likely requires a PIA — a documented assessment of the risks, the safeguards in place, and whether the transfer is proportionate to the purpose.

Law 25 also requires organizations to inform individuals when automated decision-making is used in a way that produces legal or significant effects on them, and to disclose that AI is being used. The Commission d'accès à l'information's 2025 guidance strengthened the accountability framework for automated decision systems. For any Quebec-based organization using AI to score credit risk, assess employee performance, or triage customer service requests, these disclosure and documentation requirements are not optional.

The Voluntary Code: Framework, Not Compliance

ISED's Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems has grown to 46 signatories as of March 2025, including CIBC, Intel, Cohere, and OpenText. The code asks signatories to implement risk management proportionate to the scale and impact of their activities, assess discriminatory impacts, and document their governance practices.

The voluntary code is a useful framework for organizations building or deploying AI systems at scale. It is not a compliance exercise for the SME deploying AI tools to a 50-person team. But the governance practices it describes — risk assessment, impact documentation, monitoring — are the same practices the OPC will ask about in an investigation. Using it as a template for internal governance costs nothing and provides defensible documentation if a complaint arises.

What AI Governance Actually Looks Like for a Canadian SME

The gap between "we have no AI-specific regulation" and "we have no AI governance obligations" is wider than most SMEs have recognized. What the OPC's 2026 enforcement record establishes is that any organization using AI tools to process personal information has PIPEDA obligations that apply right now.

Practically, that means five things for a Canadian SME:

An AI acceptable use policy. Which tools are permitted, for what purposes, and what data may not be provided to external AI systems. The absence of this policy is the single biggest gap in most SME AI governance programs.

Vendor due diligence before deployment. A documented review of how AI vendors handle personal information, whether they use customer data for model training, and what contractual commitments they provide. The OPC's September 2026 draft guidance is a reasonable checklist.

A data minimization practice. Employees using AI tools should understand that personal information — customer data, employee records, financial information — should not be provided to AI systems unless there is a clear business purpose and an appropriate agreement in place with the vendor.

A Privacy Impact Assessment for high-risk use cases. For Quebec-regulated organizations, this is a legal requirement for cross-border transfers. For all Canadian organizations, it is good practice before deploying AI in any customer-facing or HR context.

Contract review with AI vendors. Data processing agreements, confidentiality commitments, and explicit restrictions on secondary use of personal information should be in place before any AI tool with access to personal information goes live.

Statistics Canada's Q2 2026 survey found that 19.2 per cent of Canadian businesses are actively using AI — up from 6.1 per cent two years earlier. The growth is real. The governance infrastructure is not keeping pace. The OPC's enforcement posture in 2026 is a signal that the gap has a cost — and that the cost is not deferred until a new AI law passes.

Sources

• Office of the Privacy Commissioner of Canada. *Backgrounder: Summary of joint investigation into OpenAI's ChatGPT.* priv.gc.ca (May 6, 2026)
• Office of the Privacy Commissioner of Canada. *PIPEDA Findings #2026-002: Investigation into OpenAI.* priv.gc.ca (May 6, 2026)
• Office of the Privacy Commissioner of Canada. *OPC issues draft guidance on assessing third-party service providers.* priv.gc.ca (September 10, 2026)
• Bennett Jones. *OPC Issues New PIPEDA Guidance on Assessing Third Party Service Providers.* bennettjones.com (September 2026)
• IAPP. *OPC's Dufresne touts new age assurance guides, teases AI enforcement updates.* iapp.org (2026)
• Vorplabs. *Canada AI Regulation, September 2026: AIDA, C-34, C-36 & Provinces.* vorplabs.com
• Innovation, Science and Economic Development Canada. *Canada moves toward safe and responsible artificial intelligence.* canada.ca (March 2025)
• d-central.tech. *Quebec Law 25 Privacy Impact Assessment: A Practitioner's Guide for AI and Data Projects.* d-central.tech
• Statistics Canada. *Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026.* statcan.gc.ca (June 2026)

Cloud Forces' AI Advisory service covers the governance work that sits between "we're using AI tools" and "we're using AI tools with appropriate policy, vendor due diligence, and privacy documentation." We help Canadian SMEs and mid-market companies build AI governance programs that are proportionate to their current tool portfolio and defensible under PIPEDA and applicable provincial privacy law — without overpaying for enterprise compliance infrastructure they don't need. As an AWS Consulting Partner since 2019 and Microsoft Solutions Partner since 2022, we bring the infrastructure and vendor experience to make the assessment practical rather than theoretical. Book a consultation to review your current AI tool use and what your governance posture should look like.