AI regulation in Canada: New laws and regulations to know

The rise of AI in every industry propels the need for AI regulation in Canada. Know more about the steps taken by the government and how they are so far

AI regulation in Canada: New laws and regulations to know
Canada started its AI regulation with the proposing of bills, both federally and provincially

More people are now becoming hooked on AI. It’s not just commercial businesses that use it regularly, but also the common folk that rely on it for their daily lives, either for work or just for fun. From integrating it for work, to making your dogs’ still pictures move like videos, AI has been everywhere, and its growth has become unprecedented. 

But how does AI regulation in Canada keep up with this fast technological development? At what stage are our laws right now when it comes to laws on AI? 

What is AI regulation? 

Artificial intelligence (AI) regulation refers to either or both the legal promotion or restriction of its use by all sectors of society and its development by private companies. Part of this regulation is the ethics of AI’s use, both by individuals and industries. Collectively, AI regulation refers to:  

  • establishing the standards the development of AI by companies 
  • deterrence of crimes using AI from happening when used by the public 
  • definition and punishment of illegal acts using AI and other similar technologies 
  • managing AI’s use, while at the same time promoting it for commercial efficiency 

Here’s a video that explains the impact of AI on Canadian economy, and how AI regulation may affect all of it: 

AI has already been making rounds among the legal profession. Check out our Special Report on the Top Legal Tech, Service Providers, and Products in Canada to know which products are trusted by most lawyers nowadays. 

What are Canada’s laws on AI regulation? 

As one of the global forefronts in AI development and regulation, some eyes will look at Canada’s position on AI issues. Aside from the pending Bill C-27, a Voluntary Code was released by the federal government. 

Specific sectors and industries have also adopted their own guidelines with the use of AI. For example, some law societies of the different provinces have released guidelines for lawyers using generative AI

Proposed Bill C-27 

The most prominent proposed law for AI regulation is Bill C-27 or the Digital Charter Implementation Act, 2022. It was sponsored by the Minister of Innovation, Science and Economic Development Canada (ISED), which was introduced in 2022. As of the writing of this article, it’s still pending before the Standing Committee on Industry and Technology (INDU) in the House of Commons. 

When passed, Bill C-27 will create three new laws, namely: 

  • Consumer Privacy Protection Act (CPPA) 
  • Personal Information and Data Protection Tribunal Act (Tribunal Act) 
  • Artificial Intelligence and Data Act (AI Act or AIDA) 

The CPPA and the Tribunal Act are both previous subjects of Bill C-11, whose content is now incorporated with Bill C-27. Back in 2020, Bill C-11 was introduced but was not passed, until Parliament was dissolved in 2021.  

Bill C-27 will also amend the Personal Information Protection and Electronic Documents Act (PIPEDA). It will repeal PIPIEDA’s Part 1 and will change its short title to “Electronic Documents Act.” 

Consumer Privacy Protection Act (CPPA) 

The CPPA aims to protect every person’s personal information, while at the same time regulate commercial activities that collect, use, or disclose personal information. Some may find that the CPPA works similarly to the PIPEDA; as it seems, it takes away from PIPEDA its regulation of personal information. This is why if Bill C-27 is passed, the PIPEDA will simply remain as the Electronic Documents Act. 

Briefly, the CPPA will: 

  • codify PIPEDA’s fair information principles 
  • maintain PIPEDA’s prior valid consent requirement and its exceptions 
  • introduce two new exceptions to the valid consent requirement 
  • establish an individual’s right to erasure of their personal information upon request 
  • introduce algorithmic transparency of organizations’ handling of personal information 
  • allows the concept of data portability between two organizations 
  • introduces the de-identification of personal information and organizations’ obligations 
  • grants the Privacy Commissioner additional powers and adjusts some of the fines for violations of the CPPA 

Personal Information and Data Protection Tribunal Act (Tribunal Act) 

Simply put, the Tribunal Act establishes the Personal Information and Data Protection Tribunal, which shall have the following jurisdiction: 

  • appeals from the decision of the Privacy Commissioner under the CPPA 
  • imposition of penalties for violations of the CPPA or upon the Privacy Commissioner’s recommendation 

Artificial Intelligence and Data Act (AI Act or AIDA) 

The forefront of Canada’s AI regulation is the third part of Bill C-27, which is the AI Act or AIDA. When enacted, it will be administered and enforced by the Minister of ISED and Artificial Intelligence and Data Commissioner. The main purposes of the AI Act are to:  

  • regulate the trade and commerce in AI systems 

  • establish requirements for AI systems’ design, development, and use 

  • prohibit certain behaviours in relation to AI systems which may harm individuals 

Here are some of the important highlights of the AI Act: 

  • regulation of AI systems: prescribing the requirements for developers of high-impact AI systems to ensure the safety and human rights of individuals 
  • new orders by the ISED Minister: empowering the Minister of ISED to issue the appropriate orders related to the ceasing of AI systems development 
  • a new Data Commissioner: appointment of an Artificial Intelligence and Data Commissioner, who shall support the Minister of ISED in enforcing the AI Act 
  • offences related to AI systems: prescribing penalties (e.g., administrative monetary penalties, fines, and/or imprisonment) for the violation of the AI Act 

Requirements for AI developers 

As part of AI regulations, there are specific requirements and obligations that the AI Act imposes upon developers of AI systems. For greater clarity, the law defines the specific “regulated activities” where these requirements apply. These are: 

  • processing or making available for use any data relating to human activities to design, develop, or use an AI system 
  • designing, developing, or making available for use of an AI system 
  • managing the operations of an AI system 

When an entity is engaged in any of the regulated activities, the following are their obligations under this AI regulation: 

  • if they process or make available for use anonymized data: they must establish measures on how data is anonymized and its use or management 

  • if they’re responsible for an AI system: they must identify if it meets the criteria for a high-impact system under the AI regulations 

  • if an AI system is identified as high impact, they must:  

  • establish measures to identify, assess, and mitigate the risks of harm or biased output arising from its use 

  • notify the Minister, as soon as feasible, if the use of the high-impact AI system results, or will likely result, in material harm
  • if they do any of these activities, they must:

  • keep records of the measures on the anonymization of data and the high-impact AI systems they establish
  • keep records of the reasons that support their assessment that their AI system is high impact
  • if they make available for use or manage a high-impact AI system: they must publish on a website a description of the AI system and its mitigation measures

Violations and penalties 

The AI Act lays down the following offences when it comes to the use and development of AI systems: 

  • contravention of obligations: makes the non-compliance of the obligations set out for the regulated activities an offence 
  • false or misleading information: punishes the giving of false or misleading information to the Minister of ISED by those who are engaged in regulated activities 
  • possession or use of personal information: punishes the possession and use of personal information, that were obtained through an offence of different statutes, to design, develop, use, or make available the use of an AI system 
  • making system available for use: punishes the following when it comes to making available an AI system to be used by others: 
    • knowingly or negligently letting an AI system to be made available for use even though they know it can cause harm to others
    • letting an AI system be made available for use by others, with intent to defraud and to cause substantial economic loss to a person, and the AI system’s use is the cause of that loss

In the context of AI systems, the harm may have either physical or psychological impact to a person. It can also mean substantial damage to a person’s property. 

Penalties for the offences under this AI regulation can either be holding the offender liable for conviction on indictment or summary conviction. These include a fine and/or imprisonment, which can be imposed whether the offender is an individual or a corporation. 

Canadian Artificial Intelligence Safety Institute (CAISI) 

Another measure of AI regulation is the Canadian Artificial Intelligence Safety Institute (CAISI), which was just been recently launched by the federal government. The CAISI aims “to bolster Canada’s capacity to address AI safety risks” and for Canada to become “a leader in the safe and responsible development and adoption of AI technologies.” This is only a part of the federal government’s AI regulation involving ISED and other bodies. 

Know more about CAISI with this video: 

For other Special Reports that rank lawyers and law firms across the country according to geographical and practice area, head over to our page on Special Reports and Rankings

Are there laws that regulate AI in the provinces? 

Just like the federal version of AI regulation, most AI laws in the provinces are still pending in the halls of the lawmaking authorities. Here are some of the provincial legislations to look out for: 

  • Ontario: Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024) 
  • Québec: amended the provincial Act respecting the protection of personal information in the private sector 

What are the concerns in regulating AI in Canada? 

Socio-economic considerations, and preventing the creation of a dangerous superintelligence, are just some of the concerns when it comes to enacting AI regulations. Not to mention that the political implications of creating laws also affect how AI regulations are passed, not just in Canada, but in every jurisdiction. 

A slow legal process 

The slow development of laws and regulations about AI can be an advantage for developers, but a disadvantage for those who feel they’re aggrieved by it. While it depends on what perspective you’re looking at, the lagging AI regulation is an overall con for all of us.  

Without the proper guidelines, the efforts of companies and developers in pursuing AI may be halted, or even barred, by future laws that when passed, might not have kept pace. On the other hand, the public is kept unrestricted, whose activities may not always be in the good. 

This slow, burning process of passing AI laws and regulations can be attributed to a lot of factors, including: 

  • hard lawmaking process: enacting a law is not an easy-peasy process and it can take years before a law can be passed and even be implemented 
  • politics getting in the way: as with everything else and not just for AI regulation, politics can be a hindrance in passing laws in every jurisdiction 
  • contrasting views on AI: not all lawmakers have the same views on how AI should be used and regulated, or even if it should be regulated in the first place 

Extent of AI regulation 

Aside from the lagging process of enacting AI regulations, its content is another contentious issue between lawmakers and the companies that develop these AI systems. Both sides agree that its development must be done in a cautious manner and that human rights must still be protected along the way. However, to what extent AI development and use must be regulated is still up for debate. 

AI regulation: challenges for policy developments 

In this booming — and inescapable — age of AI, finding the right balance will take time and careful consideration, especially in passing laws and regulations concerning AI systems. In Canada, efforts are already underway; however, we still have to see how these laws apply to actual cases and how courts adjudicate these cases. For the meantime, we’ll have to make use of current laws that may apply on the matter, and of course, our innate human nature which distinguishes us from AI in the first place. 

For more resources about AI regulation and other related topics, bookmark our page on Legal education.