What Regulations Are Expected to Impact AI in 2026 in Canada?

As we look forward to an exciting 2026, we can reflect on the landmark events of 2025 – like the tabling of the Artificial Intelligence and Data Act (AIDA), Canada’s first large-scale attempt to regulate AI. While Bill C-27 was shelved in early 2025, it was a good indication of how future AI regulation will be structured. While Canada is unlikely to mirror the EU any time soon (the EU’s AI Act classifies AI systems by risk category and includes explicit prohibitions), future regulation could mark a new regulatory age for AI in the “.ca”. 

What Changed in Bill C-27?

Although AIDA was never enacted, it pointed to federal and provincial government interest in future regulation. AIDA mandated rigorous assessment and enforcement of risks for high-impact AI systems. Under AIDA, regulators would have been expected to intervene in situations of non-compliance with safety or ethical guidelines, similar to how compliance is enforced in a professional discipline like engineering or accounting. 

The intended scope of AIDA was economy-wide, not just government entities or specific industries, and AIDA introduced concepts like high impact systems (including those used for employment and for processing biometric information) and AI-specific compliance obligations (like conducting AI risk assessments and ensuring continuous monitoring)

Prior to the proposed AIDA, AI was regulated through privacy law (via PIPEDA) in Canada, as well as human rights law (discrimination), and by sector (like finance or insurance). AIDA was Canada’s first serious effort to regulate AI as its own category of risk. Although the original Bill C-27 was tabled, its risk-based framework gave us a guideline for the future direction of Canada’s AI governance – with the government playing the role of regulator, and AI governed as its own unique issue. 

Canadian AI Regulation in 2026

In Budget 2025, the federal government announced $925.6 million over the next five years to establish large scale AI infrastructure. Regulations like AIDA could make their way into law this year, potentially with new rules that cover data transfer, deepfakes, and bias. Privacy legislation reform is expected to continue in 2026, including government policy, industry standards, and rigorous oversight. 

The federal government released the Digital Sovereignty Framework in November 2025, which outlines efforts to retain control over how Canadian data is governed, how infrastructure is operated, and how digital decisions will affect Canadians. The framework suggests that Canadian organizations will increasingly be expected to demonstrate who has legal authority over data, who can access data, and whether regulators can investigate, audit, or compel disclosure over it. Using a Canadian supplier or storing data in Canada does not guarantee this data will be outside the jurisdiction of foreign courts. 

Provincially, Quebec’s Law 25 is in full force and imposing rigorous obligations over data privacy and automated decision making. Organizations under Quebec’s provincial jurisdiction must now notify individuals when decisions are made via automated processing. Organizations can face a minimum fine of $15,000 for offenses like improperly collecting, using, or communicating personal information and for failing to report a confidentiality incident. 

In Ontario, changes to the Ontario Employment Standards Act mean that as of January 1, 2026, job postings must disclose if AI is used in the hiring process. The move towards mandatory AI transparency hints at a push toward broader workplace AI regulation. 

Overall, there is lots of change in the air when it comes to AI regulation. From early attempts like AIDA to digital sovereignty and new provincial regulations, it will be interesting to see what 2026 has in store for Canadians.