Ottawa decided against a standalone AI statute, then tabled a privacy bill whose obligations land on every automated decision your company makes.
- Bill C-36 received first reading on 15 June 2026 and is now at second reading in the House of Commons.
- It enacts the Protecting Privacy and Consumer Data Act and replaces Part 1 of PIPEDA.
- There is no AI chapter. The AI obligations arrive through consent, transparency, de-identification and automated decision disclosure.
Bill C-36 is not an AI law and it will still govern your AI. The bill, sponsored by the Minister of Artificial Intelligence and Digital Innovation, received first reading on 15 June 2026 and enacts the Protecting Privacy and Consumer Data Act in place of Part 1 of PIPEDA. Nothing in it creates an AI regulator. What it does create is a duty to explain automated decisions, a documented privacy program and penalties large enough to reach a mid-market balance sheet.
TL;DR
- Bill C-36 had first reading 15 June 2026 and sits at second reading in the House of Commons.
- It replaces Part 1 of PIPEDA with the Protecting Privacy and Consumer Data Act.
- Organisations must run a privacy management program, obtain meaningful consent in plain language and disclose the use of automated decision systems.
- The disclosure trigger is narrowed to systems that could have a legal or similarly significant effect on a person.
- Administrative penalties run to the greater of 10 million dollars or 3% of global revenue, with higher criminal maximums.
What is in Bill C-36
The long title is an Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts. Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, is the sponsor. LEGISinfo records first reading on 15 June 2026.
The obligations, as read by DLA Piper, cover privacy management programs, meaningful consent with plain-language transparency, privacy risk assessments for cross-border transfers, heightened standards for children’s information, breach notification, data mobility and de-identification safeguards with limits on re-identification.
And one line that matters more than the rest for anyone running AI. Organisations must disclose their use of automated decision systems.
Why Bill C-36 matters in Canada
This is the third federal attempt at private-sector privacy reform, and the first drafted after generative AI arrived in ordinary businesses. The drafters made a choice worth reading carefully. Rather than write an AI act, they put the AI obligations inside privacy law, where the enforcement machinery already exists.
That choice has a practical consequence. You do not get to wait for an AI law. If your company screens applicants, prices a policy, ranks a credit file or routes a complaint with a model in the loop, you are already inside the scope of a bill at second reading.
Commencement is tied to enactment of Bill C-34, the Safe Social Media Act, so the timing is not fully in this bill’s own hands. Treat that as breathing room, not as a reprieve.
What does the automated decision rule actually require
Less than the last attempt did, and the narrowing is the interesting part.
The disclosure duty attaches to systems that could have a legal or similarly significant effect on an individual, tighter than the significant impact language in the previous reform bill. A chatbot that answers store hours is out. A model that decides who gets an interview is in.
| Use of AI in a Canadian business | Likely inside the disclosure duty |
|---|---|
| Drafting marketing copy | No |
| Summarising internal documents | No |
| Screening or ranking job applicants | Yes |
| Setting an individual price, limit or premium | Yes |
| Deciding a claim, an account closure or eligibility | Yes |
| Routing a service ticket with no decision attached | No |
Read that against administrative penalty exposure of the greater of 10 million dollars or 3% of global revenue. The table is a cheap afternoon’s work.
What should leaders do next
- Build the list. Every system in your company that uses a model to reach or recommend a decision about a person, with the owner named next to it.
- Sort each one against the legal or similarly significant effect test. Write the reasoning down, because the reasoning is the record.
- Check what you tell people today. Most Canadian privacy notices say nothing about automated decisions, and rewriting one paragraph now is cheaper than rewriting under a deadline.
- Find out where the training data came from for any model you built or fine-tuned in house. De-identification obligations and re-identification limits both bite here.
- Ask vendors for their automated decision disclosure language. If they do not have any, that tells you how ready they are.
- Give the privacy program an owner with time in their week. A documented program with nobody running it is the shape of a penalty.
Alberta firms working through the provincial angle will find the governance section of the Alberta AI Advantage useful, since provincial privacy statutes sit alongside the federal regime rather than under it.
Why you might reasonably do nothing yet
A bill at second reading is not law. Two previous federal privacy reform bills died on the order paper, and a company that rebuilt its compliance posture for Bill C-11 in 2020 or Bill C-27 in 2022 spent money on statutes that never came into force. Commencement here is tied to another bill entirely, which adds a second way for the timeline to slip. Waiting for royal assent is a defensible use of a finite compliance budget.
The part that survives that argument is the inventory. Knowing which of your systems make decisions about people is useful whether or not C-36 passes, and you will need it for customers and insurers regardless.
What to watch over the next 90 days
- Second reading debate and committee referral in the House of Commons through the fall sitting.
- Movement on Bill C-34, since C-36 commencement is tied to its enactment.
- Office of the Privacy Commissioner guidance signalling how the automated decision threshold will be read.
FAQ
Is Bill C-36 Canada’s AI law?
No. It contains no standalone AI regime. AI is reached through privacy obligations, including the duty to disclose automated decision systems.
When does Bill C-36 come into force?
It is at second reading as of September 2026, and commencement is linked to enactment of Bill C-34. No in-force date is fixed.
What replaces PIPEDA under Bill C-36?
The Protecting Privacy and Consumer Data Act replaces Part 1 of PIPEDA, with amendments to PIPEDA and other Acts alongside it.
Which AI uses trigger the disclosure duty?
Systems that could have a legal or similarly significant effect on a person. Hiring, pricing, credit and eligibility decisions sit inside it. Drafting and summarising generally do not.
How large are the penalties under Bill C-36?
Administrative monetary penalties reach the greater of 10 million dollars or 3% of global revenue, with higher maximums on criminal conviction.
Closing analysis
Canada spent four years arguing about whether to write an AI act, then reached the same companies through privacy law instead. The businesses that come out of this comfortably will be the ones that can produce a one-page list of every system making decisions about people, on request, without a consultant. Build the list.
Sources
- Parliament of Canada, LEGISinfo, Bill C-36, 45th Parliament, first reading 15 June 2026. parl.ca
- DLA Piper, Canada tables Bill C-36, the Protecting Privacy and Consumer Data Act, June 2026. dlapiper.com
- Statistics Canada, Analysis on artificial intelligence use by businesses in Canada, second quarter 2026, 11 June 2026. statcan.gc.ca
- Bank of Canada, Canadian businesses use of AI, what the evidence shows, August 2026. bankofcanada.ca
Related reading
- AI Transparency in Canada Needs a Practical Company Record
- AI Implementation in Canada Needs Repeatable Workflows
- AI Tool Fatigue and the Business AI Switchboard
Disclosure
The author has no relevant financial, advisory, or board relationships with any party named in this column.
Zak Hussein writes on AI for Canadian business owners and operators. He is the founder of AI Magazine Canada and CEO of ORKA AI.
For the wider picture, see our reference on Canadian AI policy.
