Who regulates AI in Canada?
By Nick Jang, founder of MINERVA Studio ·
The short answer
No single body regulates AI in Canada, and there is no general federal AI law: the proposed Artificial Intelligence and Data Act (AIDA) died when Parliament was prorogued in January 2025. AI is governed sector by sector instead. For banks and insurers, OSFI (Guideline E-23 and its 2026 AI bulletin) and Quebec’s AMF set the expectations; privacy commissioners apply privacy law to AI; and Quebec and Ontario have specific rules on automated decisions and AI in hiring.
What happened to Canada’s AI law
AIDA was part of Bill C-27, tabled in June 2022. It would have regulated “high-impact” AI systems and created an AI and Data Commissioner. The bill stalled in committee, and when Parliament was prorogued on 6 January 2025 it died on the order paper.
Since May 2025 Canada has had a Minister of Artificial Intelligence and Digital Innovation, Evan Solomon. The government has favoured a lighter approach for most sectors and has said it will legislate on specific harms: in 2026 it tabled bills on privacy and consumer data and on online harms, and spoke of measures on deepfakes and AI chatbots. As of November 2026 there’s no general statute that regulates AI systems as AIDA would have. Check Parliament’s LEGISinfo for the status of any bill before relying on it.
Who regulates AI instead
| Area | Who | What applies |
|---|---|---|
| Federally regulated banks, insurers, trust and loan companies | OSFI | Guideline E-23 on model risk, covering AI models, from 1 May 2027; the July 2026 bulletin on generative and agentic AI; B-10 for AI vendors; B-13 for technology risk. |
| Quebec financial institutions (caisses, insurers, others) | Autorité des marchés financiers (AMF) | The Guideline for the Use of AI, from 1 May 2027, and the Model Risk Management Guideline. |
| Personal information in the private sector | Office of the Privacy Commissioner of Canada and provincial commissioners | PIPEDA and provincial privacy laws apply to AI that uses personal information; the commissioners have published principles for generative AI. |
| Automated decisions in Quebec | Commission d’accès à l’information | Law 25: since 22 September 2023, a person must be told when a decision about them is made exclusively by automated processing, and can ask for the reasons. |
| AI in hiring in Ontario | Ontario Ministry of Labour | From 1 January 2026, publicly advertised job postings must say whether AI is used to screen, assess or select applicants. |
| Competition and advertising | Competition Bureau | Misleading claims, including about AI, and AI-driven pricing conduct. |
| Discrimination | Human rights commissions and tribunals | Human rights law applies to biased outcomes, whether a person or a model made the decision. |
| Federal government’s own AI | Treasury Board Secretariat | The Directive on Automated Decision-Making and its Algorithmic Impact Assessment. |
There’s also the federal Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, from September 2023, which many companies have signed. It’s voluntary.
What this means for a Canadian bank or insurer
For a federally regulated bank or insurer, the missing AI law changes less than you might think, because OSFI already reaches the AI it uses. From 1 May 2027 every AI and machine-learning model is a model under E-23: it gets inventoried, rated, independently reviewed, approved and monitored. AI agents fall under the practices in OSFI’s bulletin. AI vendors fall under B-10. Privacy law sits on top of all of that, and Quebec’s Law 25 adds a notice duty when a decision is fully automated.
If the institution operates in Europe, the EU AI Act may also apply to some of its AI, with high-risk duties for credit scoring from 2 December 2027.
MINERVA keeps the record OSFI and the AMF will ask for: AI models, agents and vendors in one inventory, with approvals and evidence an examiner can verify, in English and French. See OSFI software.
Related questions
Is there an AI law in Canada?
Not a general one. AIDA, the proposed Artificial Intelligence and Data Act, died in January 2025. AI is governed through sector regulators, privacy law, human rights law and specific provincial rules.
Who is Canada’s minister for AI?
Evan Solomon has been Minister of Artificial Intelligence and Digital Innovation since May 2025.
Does OSFI regulate AI?
OSFI regulates how federally regulated financial institutions manage risk, and that includes AI: E-23 covers AI models from 1 May 2027 and its 2026 bulletin covers generative and agentic AI.
Does PIPEDA apply to AI?
Yes, whenever an AI system collects, uses or discloses personal information in the course of commercial activity, subject to provincial laws that replace it in Quebec, Alberta and British Columbia.
What is Canada’s voluntary AI code of conduct?
A September 2023 federal code for organizations developing or managing advanced generative AI systems, covering accountability, safety, fairness, transparency, human oversight and robustness.
Sources
- OSFI — Guideline E-23, Model Risk Management (2027)
- Innovation, Science and Economic Development Canada — Voluntary Code of Conduct on Advanced Generative AI Systems
- Treasury Board of Canada Secretariat — Directive on Automated Decision-Making
- Office of the Privacy Commissioner of Canada — Principles for generative AI
- Parliament of Canada — LEGISinfo
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.