Canada's AI Regulation Vacuum: What AIDA's Death, Bills C-34 and C-36, and Provincial Laws Mean for Your Business

If you've been waiting for Canada to pass comprehensive AI legislation before building your governance framework, you've been waiting on the wrong signal. The Artificial Intelligence and Data Act (AIDA) — Canada's first attempt at a standalone AI statute — died on January 6, 2025, when Parliament prorogued. It has not been reintroduced.

Sixteen months later, Canada still has no binding federal AI law. Two new bills were tabled in June 2026, neither is law yet, and the AI minister stated in late September 2026 that "AI deployment needs regulation" without offering a bill or a timeline.

But the absence of a comprehensive federal AI statute is not the same as no rules. The compliance environment for Canadian businesses deploying AI is already more demanding than "wait and see" — and the consequences of that confusion are showing up directly in the Office of the Privacy Commissioner's enforcement record.

What Happened to AIDA

Bill C-27 — the Digital Charter Implementation Act, 2022 — contained three components: a new private-sector privacy law (the Consumer Privacy Protection Act), an accompanying Tribunal Act, and AIDA, the Artificial Intelligence and Data Act. AIDA would have imposed risk-based obligations on high-impact AI systems, including requirements for impact assessments, human oversight, and transparency disclosures.

Bill C-27 died when the Governor General prorogued Parliament on January 6, 2025. The government has since confirmed that AIDA will not be revived in its C-27 form. The 45th Parliament tabled two narrower replacement bills in June 2026, each targeting a more limited scope than AIDA originally attempted.

Bill C-34: The Safe Social Media Act

Bill C-34 is primarily an online safety statute targeting social media platforms, AI chatbot services, and online content hosts. Tabled June 10, 2026 by the Minister of Justice, it would create a new "Digital Safety Commission of Canada" with order-making and penalty powers. Fines for non-compliance could reach 5% of a company's gross global revenue from the prior year or $20 million, whichever is greater, per the Torys analysis of the bill.

C-34 is at second reading as of October 2026 and is unlikely to receive Royal Assent before year-end. For most Canadian SMEs, it is not directly relevant unless your business operates a social media platform or AI chatbot service. Its significance is strategic: Canada is building regulatory infrastructure for AI-adjacent online services, and the window for deploying consumer-facing AI products without documented safety obligations is narrowing.

Bill C-36: The Protecting Privacy and Consumer Data Act

Bill C-36, tabled June 15, 2026 by the Minister of AI and Digital Innovation, is the more consequential bill for the majority of Canadian businesses. It replaces PIPEDA with a modernized private-sector privacy law and includes explicit requirements for automated decision transparency.

According to DLA Piper's analysis of C-36, organizations using AI systems to make significant decisions about individuals would be required to disclose this, explain the logic on request, and provide a pathway to human review. The bill would also:

• Replace the OPC's current recommendation-only enforcement model with a new tribunal empowered to issue binding orders and impose administrative monetary penalties
• Strengthen protections for children's personal information
• Introduce enhanced deletion rights
• Create more robust accountability requirements for AI system operators

Like C-34, Bill C-36 is at second reading and not yet law. If your organization already complies with GDPR Article 22 for European customers, your C-36 readiness posture is materially stronger than a Canada-only business — the structural requirements are similar.

What Is Actually Binding Right Now

With both federal bills still in Parliament, three existing frameworks carry the real compliance weight.

PIPEDA — Still in force, actively enforced

PIPEDA continues to apply to most federally regulated and interprovincial commercial activities, and the OPC is enforcing it aggressively on AI use cases. The OPC's 2025–2026 annual report, "Championing Privacy in the Age of AI," tabled June 4, 2026, documented 3,044 PIPEDA complaints — a 109% year-over-year increase. The OPC attributes part of that volume to AI-enhanced public awareness of privacy rights.

Two high-profile AI enforcement actions were resolved in 2026:

X Corp./Grok (June 2026): The OPC found that X Corp. and xAI breached PIPEDA when they launched Grok's AI image generation tool without adequate safeguards or a timely privacy impact assessment — enabling mass creation of non-consensual deepfakes. Commissioner Philippe Dufresne recommended xAI suspend the tool. The companies refused, committing instead to quarterly reporting and third-party audits. This outcome exposed the OPC's central enforcement limitation: it can find violations and recommend remedies, but cannot issue binding orders or impose fines under the current PIPEDA.

OpenAI/ChatGPT (May 2026): A joint investigation by four Canadian privacy regulators — the OPC plus the Alberta, British Columbia, and Quebec commissioners — released PIPEDA Findings #2026-002, identifying five categories of violations in OpenAI's Canadian operations, including overcollection, lack of valid consent, transparency failures, and accountability gaps. The investigation took nearly three years to conclude.

The pattern from both cases: the absence of a binding federal AI statute does not protect organizations from enforcement. Privacy commissioners are applying PIPEDA's existing consent, transparency, and accountability obligations directly to AI deployments.

Quebec's Law 25 — In force since September 2023

Quebec's Act to modernize legislative provisions regarding the protection of personal information (Law 25, or Loi 25) reached its full implementation phase in September 2023. Section 12.1 requires any organization that uses an AI system to make a decision exclusively based on automated processing — about a customer, employee, or other individual — to:

• Notify the affected person in advance
• Explain the factors considered, on request
• Provide a mechanism for the person to request human review of the decision

Law 25 applies to any organization handling Quebec residents' personal information, regardless of where the organization is incorporated or headquartered. Penalties under the Act reach up to $25 million or 4% of worldwide turnover for the most serious violations. There is no small-business exemption, and the role of privacy officer defaults to the business owner unless formally delegated in writing.

If your organization has Quebec-based customers, employees, or users of a digital product, this rule already applies to you. It is the de facto Canadian AI governance baseline for automated decisions today.

Manitoba's Public Sector AI and Cybersecurity Governance Act — Royal Assent June 2026

Manitoba's Bill 51 — now the Public Sector Artificial Intelligence and Cybersecurity Governance Act (S.M. 2026, c. 43) — received Royal Assent on June 1, 2026, and covers public sector entities: provincial government, municipalities, universities, school divisions, and health authorities. The Act is enabling rather than prescriptive — most substantive obligations will be defined through future regulations and directives. It has not yet been proclaimed in force.

For private-sector businesses, the primary relevance is as a contracting signal. Once proclaimed, organizations selling AI-assisted services to Manitoba public sector clients can expect governance documentation and accountability requirements to appear in procurement terms.

The Current Compliance Map

Here is a practical summary of what applies to a private-sector Canadian organization using AI tools in October 2026:

What Your Organization Should Be Doing Now

The governance work that prepares you for C-36 when it passes is the same work that addresses your current PIPEDA and Law 25 obligations. For organizations that have been waiting on federal legislation to start, the starting line is now — not Royal Assent.

Practically, that means:

• A privacy impact assessment for each AI use case that processes personal information — particularly any system making automated decisions about individuals, even partially.
• A documented inventory of AI systems and data flows so your organization can respond to OPC investigations or Privacy Act access requests without reconstructing history under pressure.
• Vendor due diligence with written accountability clauses: confirm data residency, sub-processor disclosure, and what training or model improvement activities touch your data. The OPC's ChatGPT investigation turned heavily on vendor accountability gaps that the deploying organization had not addressed contractually.
• Quebec Law 25 compliance mechanics if you have Quebec residents in scope: advance notices, explanation procedures, and accessible human-review pathways for automated decisions.
• A monitoring posture on C-36: when the bill advances to committee or third reading, organizations will typically have a 12- to 24-month implementation period. Those that start the underlying governance work now will have a significant head start over those that wait for Royal Assent.

The governance framework you build in the next twelve months is not wasted if the federal legislative timeline shifts again. Every Canadian AI law currently on the horizon — federal or provincial — rewards the same foundational work: mapped data flows, documented AI systems, vendor accountability clauses, and a clear process for handling automated-decision inquiries. None of that depends on which bill receives Royal Assent first.

Sources

• Schwartz Reisman Institute, University of Toronto. *What's Next After AIDA?* srinstitute.utoronto.ca
• Torys LLP. *Bill C-34: Canada proposes legislation to regulate social media, AI chatbot, and online services.* torys.com (June 2026)
• DLA Piper. *Canada tables Bill C-36: The Protecting Privacy and Consumer Data Act.* dlapiper.com (June 2026)
• Office of the Privacy Commissioner of Canada. *Privacy Commissioner tables 2025–2026 Annual Report.* priv.gc.ca (June 2026)
• Lexpert. *Federal privacy commissioner's annual report notes 109 percent increase in PIPEDA complaints.* lexpert.ca
• MLT Aikins. *What the OPC's Grok decision means for your organization.* mltaikins.com (2026)
• MLT Aikins. *Canada's new AI strategy and OPC Annual Report: What organizations need to know.* mltaikins.com (2026)
• Torys LLP. *Manitoba introduces algorithmic pricing and public sector AI regulation.* torys.com (June 2026)
• Vorplabs. *Canada AI Regulation, September 2026: AIDA, C-34, C-36 & Provinces.* vorplabs.com

Building an AI governance framework before federal legislation passes is exactly the work that protects your organization from OPC enforcement, positions you for C-36 compliance when it arrives, and documents your AI posture for board and client trust. Cloud Forces' AI Advisory service — including our AI Governance & Security Review for mid-market organizations — helps Canadian businesses map their AI use cases, build documented accountability frameworks, and align with both current PIPEDA obligations and incoming federal and provincial requirements. As an AWS Consulting Partner since 2019 and a team certifying on Claude, we understand both the technical and compliance dimensions of AI deployment in Canada. Book a consultation to start.