Framework / Guideline | Does Canada Follow or Align? | Notes |
|---|---|---|
Bill C-36 – Protecting Privacy and Consumer Data Act | Proposed – Not Yet Law | Introduced June 15, 2026 to replace the privacy part of PIPEDA, with transparency rules for automated decision systems. Previously, Bill C-27 covered this ground, but it died in January 2025. Official source |
PIPEDA (Personal Information Protection and Electronic Documents Act) | Yes | Meanwhile, this is still the federal privacy law in force. It governs how private-sector organizations collect, use, and disclose personal info. Official source |
OPC AI Guidelines (Office of the Privacy Commissioner of Canada) | Yes | Official guidance on privacy, automated decision-making, AI transparency, and fairness. Official source |
CCCS AI Security Guidelines (incl. ITSAP.00.041 – Generative AI Security) | Yes | Provides national cybersecurity recommendations for safe AI development, including GenAI-specific guidance. Official source |
Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems (2023) | Yes | Introduced by the Government of Canada; signed by major tech companies. Promotes safe, transparent, and responsible GenAI. Official source |
ISO/IEC 42001 – AI Governance Standard | Yes | Canada supports this international governance framework via the Standards Council. Establishes management systems for AI. Official source |
ISO/IEC 23894 – AI Risk Management Standard | Yes | Global best-practice standard for AI risk identification, mitigation, and accountability. Official source |
ISO/IEC 27001 – Information Security Management System (ISMS) | Yes | Widely adopted in Canada. Supports secure AI and data practices. As a result, it is often required for compliance in public and private sectors. Official source |
NIST AI Risk Management Framework (USA) | Alignment Only | Although U.S.-based and not Canadian law, it is widely referenced in Canada for responsible AI risk management. Official source |
Framework / Guideline | Does Canada Follow or Align? | Notes |
|---|---|---|
MITRE ATLAS – Adversarial Threat Landscape for AI Systems | Alignment Only | Global framework from MITRE used to understand and defend against threats to AI systems. Although not Canadian, it is still referenced. Official source |
SOC 2 Type II Certification (for AI Service Providers) | Voluntary Alignment |
|
OECD AI Principles | Yes | Canada is a formal signatory (2019). As a result, these principles guide national AI ethics, fairness, transparency, and safety. Official source |
EU AI Act (Regulation (EU) 2024/1689) | Applies to Canadian Firms Selling into the EU | In force since August 1, 2024, with obligations phasing in through 2028. In particular, it applies to Canadian organizations that offer AI products or services in the EU market. Official source |
Privacy Commissioner’s Principles for Responsible AI | Yes | Core Canadian guidelines promoting fairness, transparency, privacy, and accountability in AI systems. Official source |
Quebec Law 25 – Private Sector Privacy Act (Automated Decisions) | Yes – In Force (Quebec) | Since September 2023, organizations must tell people about decisions made solely by automated processing, explain them on request, and allow review by a person. Official source |
Ontario Employment Standards Act – AI Disclosure in Job Postings | Yes – In Force (Ontario) | Since January 1, 2026, Ontario employers with 25 or more employees must state in public job postings whether AI is used to screen, assess or select applicants. Official source |
NCSC UK – Guidelines for Secure AI System Development (2023) | Yes | Canada is a co-signer. In short, it promotes secure-by-design development principles for AI systems. Official source |
Directive on Automated Decision-Making (DADM) | Yes (Gov’t use) | Mandatory for federal AI systems. In addition, it helps assess risk. Official source |
Framework / Guideline | Does Canada Follow or Align? | Notes |
|---|---|---|
AIA Tool (Algorithmic Impact Assessment) | Yes | Public sector AI risk scoring tool. Specifically, it is required by DADM. Official source |
ISO/IEC 38507 – Governance of IT & AI | Yes | Helps boards and executives govern AI within IT structures. Official source |
Toronto Declaration | Reference (Civil-Society Declaration) | A 2018 declaration led by human rights organizations, including Amnesty International and Access Now, on equality and non-discrimination in machine learning systems. Official source |
UNESCO AI Ethics | Yes | International guidance adopted by many states, including Canada. Official source |
Canadian Human Rights Act (AI-related) | Yes | In particular, it protects individuals from discrimination caused by automated systems. Official source |
OSFI Guideline E-23 – Model Risk Management | Yes – Federally Regulated Financial Institutions (from May 2027) | Sets expectations for how banks and insurers manage risk in their models, including AI and machine learning systems. Official source |
How to use this table: First, check which rows apply to your customers, staff and markets. Then, open the official source for each one. Finally, review this list at least once a year, because AI compliance frameworks in Canada and abroad change. For a short summary of what applies today, see our Regulatory Checkpoint. Status checked September 30, 2026. Not legal advice.
English