Canadian AI Regulations & Frameworks

Below are the AI compliance frameworks Canada follows or aligns with, plus key laws and regulations, which CAICB uses to guide its certification and readiness resources:

Canadian Privacy Law, Guidance and Core Standards

Framework / Guideline	Does Canada Follow or Align?	Notes
Bill C-36 – Protecting Privacy and Consumer Data Act	Proposed – Not Yet Law	Introduced June 15, 2026 to replace the privacy part of PIPEDA, with transparency rules for automated decision systems. Previously, Bill C-27 covered this ground, but it died in January 2025. Official source
PIPEDA (Personal Information Protection and Electronic Documents Act)	Yes	Meanwhile, this is still the federal privacy law in force. It governs how private-sector organizations collect, use, and disclose personal info. Official source
OPC AI Guidelines (Office of the Privacy Commissioner of Canada)	Yes	Official guidance on privacy, automated decision-making, AI transparency, and fairness. Official source
CCCS AI Security Guidelines (incl. ITSAP.00.041 – Generative AI Security)	Yes	Provides national cybersecurity recommendations for safe AI development, including GenAI-specific guidance. Official source
Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems (2023)	Yes	Introduced by the Government of Canada; signed by major tech companies. Promotes safe, transparent, and responsible GenAI. Official source
ISO/IEC 42001 – AI Governance Standard	Yes	Canada supports this international governance framework via the Standards Council. Establishes management systems for AI. Official source
ISO/IEC 23894 – AI Risk Management Standard	Yes	Global best-practice standard for AI risk identification, mitigation, and accountability. Official source
ISO/IEC 27001 – Information Security Management System (ISMS)	Yes	Widely adopted in Canada. Supports secure AI and data practices. As a result, it is often required for compliance in public and private sectors. Official source
NIST AI Risk Management Framework (USA)	Alignment Only	Although U.S.-based and not Canadian law, it is widely referenced in Canada for responsible AI risk management. Official source

International Frameworks and Provincial Rules

Framework / Guideline	Does Canada Follow or Align?	Notes
MITRE ATLAS – Adversarial Threat Landscape for AI Systems	Alignment Only	Global framework from MITRE used to understand and defend against threats to AI systems. Although not Canadian, it is still referenced. Official source
SOC 2 Type II Certification (for AI Service Providers)	Voluntary Alignment	Although U.S.-based, this audit framework is often pursued by Canadian AI/tech providers for trust and compliance signaling. Official source
OECD AI Principles	Yes	Canada is a formal signatory (2019). As a result, these principles guide national AI ethics, fairness, transparency, and safety. Official source
EU AI Act (Regulation (EU) 2024/1689)	Applies to Canadian Firms Selling into the EU	In force since August 1, 2024, with obligations phasing in through 2028. In particular, it applies to Canadian organizations that offer AI products or services in the EU market. Official source
Privacy Commissioner’s Principles for Responsible AI	Yes	Core Canadian guidelines promoting fairness, transparency, privacy, and accountability in AI systems. Official source
Quebec Law 25 – Private Sector Privacy Act (Automated Decisions)	Yes – In Force (Quebec)	Since September 2023, organizations must tell people about decisions made solely by automated processing, explain them on request, and allow review by a person. Official source
Ontario Employment Standards Act – AI Disclosure in Job Postings	Yes – In Force (Ontario)	Since January 1, 2026, Ontario employers with 25 or more employees must state in public job postings whether AI is used to screen, assess or select applicants. Official source
NCSC UK – Guidelines for Secure AI System Development (2023)	Yes	Canada is a co-signer. In short, it promotes secure-by-design development principles for AI systems. Official source
Directive on Automated Decision-Making (DADM)	Yes (Gov’t use)	Mandatory for federal AI systems. In addition, it helps assess risk. Official source

Public-Sector, Human Rights and Financial Sector Rules

Framework / Guideline	Does Canada Follow or Align?	Notes
AIA Tool (Algorithmic Impact Assessment)	Yes	Public sector AI risk scoring tool. Specifically, it is required by DADM. Official source
ISO/IEC 38507 – Governance of IT & AI	Yes	Helps boards and executives govern AI within IT structures. Official source
Toronto Declaration	Reference (Civil-Society Declaration)	A 2018 declaration led by human rights organizations, including Amnesty International and Access Now, on equality and non-discrimination in machine learning systems. Official source
UNESCO AI Ethics	Yes	International guidance adopted by many states, including Canada. Official source
Canadian Human Rights Act (AI-related)	Yes	In particular, it protects individuals from discrimination caused by automated systems. Official source
OSFI Guideline E-23 – Model Risk Management	Yes – Federally Regulated Financial Institutions (from May 2027)	Sets expectations for how banks and insurers manage risk in their models, including AI and machine learning systems. Official source

How to use this table: First, check which rows apply to your customers, staff and markets. Then, open the official source for each one. Finally, review this list at least once a year, because AI compliance frameworks in Canada and abroad change. For a short summary of what applies today, see our Regulatory Checkpoint. Status checked September 30, 2026. Not legal advice.