Does Canada have an AI law in 2026?

No. Canada has no comprehensive AI law in force in 2026. Bill C-36 (successor to the original AI and Data Act in Bill C-27) and Bill C-34 are both pending in Parliament — neither has passed. What applies right now are existing laws: Quebec Law 25 (mandatory for Quebec-based firms and firms handling Quebec residents' data), Ontario's job posting AI disclosure rule (in force since January 1, 2026), and PIPEDA (federal privacy law, applies to personal data handling by private firms nationwide).

What is Quebec Law 25 and does it apply to my firm?

Quebec Law 25 (An Act to Modernize Legislative Provisions as Regards the Protection of Personal Information) is fully in force as of September 2023. It applies to any private organization that collects, uses, or discloses personal information about Quebec residents — including firms headquartered outside Quebec. For professional services firms, the relevant obligations include: transparency requirements when using automated decision-making that affects individuals, the right for individuals to be informed when a decision is made solely by automated processing, and a requirement to conduct Privacy Impact Assessments for new systems involving personal information.

What does Ontario's AI hiring disclosure rule require?

As of January 1, 2026, Ontario employers must disclose in job postings whether AI is used in the hiring process. This applies to any employer posting positions for Ontario-based roles, regardless of where the firm is headquartered. If your firm uses any AI tool — even an applicant tracking system with AI screening — to evaluate, screen, or score candidates for Ontario positions, that use must be disclosed in the job posting. There is no prescribed wording yet, but a clear statement in the posting is sufficient.

Does the Federal Directive on Automated Decision-Making apply to private firms?

No. The Federal Directive on Automated Decision-Making applies only to federal government institutions — departments and agencies subject to the Financial Administration Act. Private firms, including professional services firms, are not subject to this directive. Confusion about this is common because the directive was widely reported as a Canada-wide AI rule, but it has no bearing on private sector obligations.

What should a professional services firm do now about Canada AI compliance?

Two actions cover most Canadian firms right now. First, if you use any AI tool that makes or influences a decision about an individual (hiring, performance evaluation, credit assessment, service eligibility), review whether that use triggers Quebec Law 25 transparency obligations and add disclosure language to client-facing and HR documentation. Second, if you post jobs for Ontario-based roles, add an AI disclosure line to your job posting template now — before your next posting. These two actions cover the most active Canadian AI compliance obligations in force today.

Canada AI Law 2026: What Firms Must Know

If you run a professional services firm in Canada — or serve Canadian clients — you have almost certainly seen the headlines about AI regulation. "Canada's AI Act." "Sweeping new rules." "Compliance deadlines approaching."

Here is what is actually true: Canada has no comprehensive AI law in force in 2026. None. Not a single federal statute specifically governing artificial intelligence has been signed into law. The legislation you may have heard about — Bill C-27 and its successor Bill C-36 — is still pending in Parliament.

But "no AI law" does not mean no obligations. Three existing frameworks apply to professional services firms right now, and most firm owners either don't know about them or have confused them with federal AI legislation that doesn't exist yet. This is your two-minute orientation.

What Is Not Law Yet

Let's clear the slate first.

Bill C-27 / Bill C-36: Canada's original AI and Data Act was introduced as part of Bill C-27 in 2022. After years of committee hearings and amendments, the bill stalled. A successor version (Bill C-36) was introduced in early 2026. As of August 2026, neither version has passed. There is no federal AI Act.

Bill C-34: A separate bill covering investment review and critical systems — not a general AI law. Passed in a limited form but does not impose obligations on professional services firms.

The Federal Directive on Automated Decision-Making: This exists and is in force — but it applies only to federal government institutions (departments and agencies subject to the Financial Administration Act). If you are a private accounting firm, law firm, consulting firm, or staffing agency, this directive does not apply to you.

This confusion costs firms real time and money. Finance teams build compliance programs for rules that don't exist while missing the ones that do.

What Actually Applies Right Now

1. Quebec Law 25 — Mandatory for Any Firm Handling Quebec Data

Quebec's Law 25 (formally: An Act to Modernize Legislative Provisions as Regards the Protection of Personal Information) has been fully in force since September 2023. It is real, enforceable, and applies beyond Quebec's borders.

Who it covers: Any private organization — regardless of where it is headquartered — that collects, uses, or discloses personal information about Quebec residents. A Toronto-based accounting firm with Quebec clients, a Vancouver consulting firm whose employees live in Quebec: both are covered.

What it requires, in plain language:

Transparency on automated decisions: If you use AI that makes or significantly influences a decision about a person — evaluating a job candidate, scoring a client for a service, flagging a file for review — that person has the right to know. You must be able to explain that a decision involved automated processing and provide a human contact for follow-up.
Privacy Impact Assessments: Before deploying a new technology system that processes personal information, you must conduct a formal Privacy Impact Assessment. This is not a checkbox exercise — it requires documenting what data is collected, how it is used, what the risks are, and what safeguards are in place.
Appointment of a Privacy Officer: Every organization subject to Law 25 must designate a person responsible for privacy compliance. For most small firms, this is the owner or a named senior employee.

The fines for non-compliance reach $25 million CAD or 4% of worldwide revenue — whichever is higher. The regulator (Commission d'accès à l'information) has issued guidance and begun enforcement activity.

The practical action: If your firm uses any AI tool in a workflow that touches personal information about Quebec residents — client data, employee data, prospect data — review that workflow against Law 25 requirements. Add a plain-language disclosure statement to your client engagement letters and HR documentation.

2. Ontario Job Posting AI Disclosure — In Force Since January 1, 2026

Ontario's Employment Standards Act was amended to require employers to disclose when AI is used in the hiring process. This rule has been in force since January 1, 2026.

Who it covers: Any employer posting positions for roles based in Ontario, regardless of where the employer is headquartered. A US-based staffing firm posting for an Ontario contract role is covered.

What it requires: Job postings must state whether AI is used to evaluate applicants. "AI" is interpreted broadly — applicant tracking systems that automatically screen or rank resumes qualify. Any tool that scores, filters, or ranks candidates based on automated processing requires disclosure.

There is no prescribed format for the disclosure. A sentence in the job description — "This role uses AI-assisted screening to evaluate applications" — is sufficient. What is not sufficient: silence. A posting that uses AI screening and says nothing is non-compliant from day one.

The practical action: Add a standard AI disclosure line to your Ontario job posting template today. If you are not sure whether your ATS uses AI screening, ask your vendor. Almost every modern applicant tracking system does.

3. PIPEDA — Existing Privacy Law Still Applies to AI Data Use

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It predates AI, but its obligations apply to how you collect, use, and disclose personal information — including data used to train or operate AI systems.

Who it covers: All private-sector organizations in Canada that collect personal information in the course of commercial activity (with the exception of provinces that have substantially similar provincial laws — Quebec, Alberta, and British Columbia have their own laws that take precedence within those provinces).

What it means for AI use: If you feed client data into an AI tool, that data handling is subject to PIPEDA's consent and purpose limitation rules. Using a client's financial records to train a custom AI model without their knowledge is not permitted. Using an AI platform that stores client data on servers outside Canada may trigger cross-border transfer obligations.

The practical action: Review your AI vendor contracts for data storage and training practices. Most enterprise AI platforms (Microsoft Copilot, the major legal AI tools) have explicit data residency and training opt-out provisions in their contracts. Activate the opt-outs. Document that you did.

If You Serve Canadian Clients From the US

US-based professional services firms with Canadian clients face a layered situation:

Quebec clients: Law 25 applies to you. The trigger is handling personal data about Quebec residents, not being located in Quebec.
Ontario roles: If you post jobs for Ontario-based roles (including contract or remote), the Ontario disclosure rule applies to those postings.
No federal AI Act to worry about yet: Until Canadian federal AI legislation passes, there is no US-to-Canada AI compliance obligation at the federal level.

The most immediate risk for US firms is Law 25 — specifically the automated decision-making transparency provisions. A US firm that uses AI to evaluate Canadian job candidates or make recommendations about Canadian clients should add Quebec Law 25 disclosure language to its documentation now.

The Two Actions That Cover Most Firms

If you want to get current on Canadian AI compliance without building a full compliance program, these two actions address the most active obligations in force today:

Action 1: Add AI disclosure to your job posting template. If you post positions for Ontario-based roles and use any AI-assisted screening tool, your next posting needs a one-sentence disclosure. Do this before your next open role goes live.

Action 2: Review your Law 25 exposure. If you handle personal information about Quebec residents and use AI in any workflow touching that data, add a brief transparency notice to your client-facing and HR documentation. The notice should explain that automated processing may be used, what data is involved, and who the human contact is for questions.

Neither of these is a multi-month project. Both can be done this week.

Canada's AI regulatory environment will look different in 2027 — federal legislation is coming. But the obligations that exist today are not hypothetical, and the confusion about what does and doesn't apply is real. The firm owners who understand the actual landscape are better positioned for whatever comes next.

For US-focused AI regulatory updates, see Colorado's rewritten AI law (SB 189) and AI citation sanctions now reaching bar discipline.

Canada Has No AI Law Yet. Here's What Actually Applies to Your Firm.