Here's a plain-English guide to AI regulations in Canada, plus the international standards Canadian organizations most often need to follow. Each entry has a short description and a direct link to the official source.
○ Description: Quebec's modernized private-sector privacy law. Since September 2023, organizations must tell people when a decision about them is made solely by automated processing, explain how the decision was made on request, and allow it to be reviewed by a person.
○ Description: Canada's federal privacy law governing how private-sector organizations handle personal information.
○ Link: PIPEDA
○ Description: Guidelines provided by the OPC on privacy and the responsible development and use of AI.
○ Link: OPC AI Guidelines
○ Description: Security guidance for AI systems provided by Canada's authority on cybersecurity.
○ Link: CCCS AI Security Guidance
○ Description: A code introduced by the Government of Canada to promote safe and responsible development of generative AI systems.
○ Link: Voluntary Code of Conduct
○ Description: An international standard providing guidelines for the governance of AI within organizations.
○ Link: ISO/IEC 42001
○ Description: An international standard outlining risk management principles and guidelines specific to AI.
○ Link: ISO/IEC 23894
○ Description: A widely adopted international standard for information security management systems.
○ Link: ISO/IEC 27001
○ Description: A framework developed by the National Institute of Standards and Technology to manage risks associated with AI.
○ Link: NIST AI RMF
○ Description: A knowledge base detailing adversarial threats to machine learning systems.
○ Link: MITRE ATLAS
○ Description: A certification standard for service organizations, focusing on controls relevant to security, availability, processing integrity, confidentiality, and privacy.
○ Link: SOC 2 – AICPA (official)
○ Description: Principles adopted by the Organization for Economic Co-operation and Development to promote AI that is innovative and trustworthy and that respects human rights and democratic values.
○ Link: OECD AI Principles
○ Description: The European Union's Artificial Intelligence Act (Regulation (EU) 2024/1689), in force since August 1, 2024, with obligations phasing in from 2025 through 2027. It sets risk-based rules for AI systems and applies to Canadian organizations that offer AI products or services in the EU.
○ Description: Principles set by Canada's Privacy Commissioner to guide the responsible development and use of AI.
○ Description: Proposed federal legislation introduced on June 15, 2026 to replace the privacy part of PIPEDA. It includes transparency requirements for automated decision systems that could significantly affect individuals. It is not yet law.
○ Description: Since January 1, 2026, Ontario employers with 25 or more employees must state in publicly advertised job postings whether they use artificial intelligence to screen, assess or select applicants.
○ Description: Guideline from the Office of the Superintendent of Financial Institutions setting expectations for how federally regulated banks and insurers manage risk in their models, including AI and machine learning systems. Takes effect in May 2027.
○ Link: OSFI Guideline E-23 (2027)
○ Description: Guidelines from the UK's National Cyber Security Centre on developing secure AI systems.
○ Link: NCSC UK AI Guidelines
○ Description: A mandatory policy for federal institutions in Canada using automated decision systems. Requires the use of an algorithmic impact assessment and sets transparency and accountability expectations.
○ Description: Canada’s official tool to assess the potential impact of an AI system used by federal institutions. Required under the DADM and aligned with responsible AI use.
○ Description: An international standard providing high-level guidance for organizations on how to manage AI within their existing IT governance structure.
○ Link: ISO/IEC 38507
○ Description: A declaration co-led by Canadian civil society organizations to ensure AI systems uphold international human rights standards, especially in sensitive use cases like policing and hiring.
○ Link: Toronto Declaration
○ Description: A global ethical framework adopted by over 190 member states, including Canada, focusing on dignity, transparency, sustainability, and fairness in AI.
○ Link: UNESCO AI Ethics
○ Description: This federal law prohibits discrimination in services, housing, and employment — including AI systems that may reinforce bias or automate unfair treatment.
○ Link: Canadian Human Rights Act
○ Description: A voluntary cybersecurity certification program by the Government of Canada to help SMEs demonstrate strong cyber hygiene and protect AI systems and data.
○ Link: CyberSecure Canada
○ Description: Guidelines created for secure cloud use in Canadian federal institutions, including hosting of sensitive data and AI models on cloud infrastructure.
○ Link: GC Cloud Guardrails
English