Last updated: April 22, 2026. Reviewed quarterly.
The Artificial Intelligence and Data Act — AIDA — was Canada’s most prominent attempt to write a federal AI law. It was introduced in 2022 as part of Bill C-27, debated for three years, and quietly died in committee in 2025. This page explains what AIDA was, what killed it, what is actually regulating AI in Canada in its absence, and what is likely to replace it. It is updated quarterly. Read alongside Marcus Laporte’s column on why the next bill will be stricter.
What AIDA was
AIDA was the third part of Bill C-27, alongside two privacy reform statutes. Its core idea: create a federal framework for “high-impact” AI systems, requiring developers and deployers to assess risks, document mitigations, and report serious harm. It was modelled, loosely, on the EU AI Act, but with significantly less specificity. Most of the actual rules were left to be defined later in regulations.
The bill defined three obligations — assess, mitigate, monitor — and gave the Minister of Industry powers including the ability to order disclosures and impose administrative monetary penalties. The maximum fines on paper were significant: up to $25 million or five percent of global revenue, whichever is greater.
Why it failed
Three reasons, in roughly equal measure. Vagueness. Critical terms — “high-impact system,” “biased output,” “material harm” — were left undefined in the statute and reserved for regulation. That made it impossible for industry to plan and impossible for civil society to scrutinize. Process. The bill was introduced before the post-ChatGPT era of generative AI, and the government’s mid-stream amendments to address foundation models satisfied neither side of the debate. Politics. By 2024 the bill had no political champion and competing priorities — cost-of-living, immigration, an election cycle — consumed the legislative agenda. AIDA died less from opposition than from neglect.
What is regulating AI in Canada right now
Despite AIDA’s death, AI in Canada is regulated. The binding instruments in 2026 are:
- The Treasury Board Directive on Automated Decision-Making — in force since 2019 for federal departments, with mandatory Algorithmic Impact Assessments by risk tier.
- PIPEDA, as interpreted by the Office of the Privacy Commissioner, which now applies broadly to generative AI systems handling personal information.
- Quebec’s Law 25, which extends a stricter privacy regime to any system processing Quebec residents’ data.
- Provincial procurement guidance — particularly Ontario’s broader public-sector AI rules — which apply to vendors selling to school boards, hospitals, and municipalities.
- OSFI guidance on model risk for federally regulated financial institutions.
For most Canadian businesses deploying AI, this combination is already a meaningful compliance burden. The absence of AIDA does not mean a regulatory vacuum — it means a regulatory patchwork.
What is likely to replace AIDA
The shape of the next federal AI bill is becoming visible. The likeliest design takes the Treasury Board’s risk-tier framework, expands its scope from federal departments to private-sector “high-impact” systems, and adds enforcement teeth. That is a stricter outcome than AIDA proposed, not a looser one. Industry submissions to the federal AI strategy consultation already point in this direction; see our coverage of the consultation results.
Timing: the next bill is unlikely to be introduced before the next general election cycle resolves. Operators should plan for federal AI legislation arriving in 2027 at the earliest, with provincial rules continuing to tighten in the interim.
What operators should do now
- Map your AI systems against the Treasury Board’s risk-tier framework. It is the closest thing to a stable categorization in Canada.
- Document model governance — data sources, intended use, monitoring, human-in-the-loop controls. Whatever the next bill mandates, it will require this.
- Track Quebec. Quebec consistently leads federal Canadian regulation. What Quebec does on AI in 2026 will shape Ontario’s rules in 2027.
- Read the OPC’s AI guidance — not as a future obligation, but as a description of how PIPEDA is being enforced now.