AI risk, privacy, and policy in Canada

There is no in-force general AI statute in Canada as of September 2026. The proposed Artificial Intelligence and Data Act was part of Bill C-27, which died on the Order Paper when Parliament was prorogued on 6 January 2025 without the bill receiving Royal Assent. Sector regulators and existing law still apply, so the absence of an AI-specific statute is not an absence of rules.

Yes. PIPEDA governs how private-sector organisations collect, use, and disclose personal information in commercial activity, and it applies regardless of which software does the processing. Putting a customer's personal information into an AI tool is a use or disclosure of that information and carries the same obligations as any other handling of it.

The Office of the Privacy Commissioner published principles for responsible, trustworthy and privacy-protective generative AI technologies on 7 December 2023. They cover legal authority and consent, appropriate purposes, necessity and proportionality, openness, accountability, individual access, limiting collection, accuracy, and safeguards. The guidance states that generative AI does not sit outside existing legislative frameworks.

The Privacy Commissioner's guidance states that inferring information about an identifiable individual, including outputs about a person from a generative AI system, is considered a collection of personal information and requires legal authority. That matters for any use that profiles, scores, or draws conclusions about customers or staff, even when no new data was gathered from the person.

Customer personal information, employee records, health details, financial account numbers, material covered by a confidentiality agreement, and unreleased commercial information. The practical control is a written one-page rule listing what may and may not be pasted, distributed before an incident. Most exposure in small businesses comes from a well-meaning employee, not from a deliberate breach.

A one-page policy is enough for most businesses under 50 people and considerably better than nothing. It should state which tools are approved, what may never be entered into them, who to ask when unsure, and the requirement that a person checks output before it reaches a customer. A long policy nobody reads provides documentation rather than protection.

Consent is one route to legal authority, and the Privacy Commissioner's guidance requires that it be valid and meaningful, as specific as possible, and free of deceptive design patterns. Burying AI processing in a long terms-of-service update is unlikely to meet that standard. If you cannot describe the processing plainly enough for a customer to understand it, the consent is doing less work than you think.

Four recur: confidently wrong output reaching a customer, personal information leaving the business through a consumer tool, over-reliance where nobody retains the skill to check the work, and vendor dependency where the system cannot be operated without one provider. Statistics Canada found cybersecurity and privacy concerns were the most cited barrier to AI use at 13.4 percent, ahead of cost at 10.6 percent.

It depends entirely on the tier and the contract, and this differs between the consumer and business versions of the same product. Check the specific terms for the plan you are on rather than the vendor's general marketing, and re-check after any pricing or terms change. If you cannot determine the answer in writing, treat the tool as unsuitable for anything confidential.

Your business is answerable to the customer for what your systems tell them; the vendor's terms typically limit the vendor's own liability. This is not legal advice, and a lawyer should review anything material. The practical control is keeping a person between the output and the customer wherever a wrong answer would be costly.

Avoid using AI to screen, rank, or make decisions about individuals. The reasoning is difficult to audit, errors affect people's livelihoods, and inference about an identifiable individual is a collection of personal information under the Privacy Commissioner's guidance. Drafting job descriptions and summarising policies are safe. Deciding who gets hired or dismissed is not.

No replacement for the Artificial Intelligence and Data Act had been enacted as of September 2026, and the timing of any future bill is a matter for Parliament rather than something to plan around. The practical position is that existing law, particularly privacy law, already governs most of what a small business would do with AI. Build to that and a future statute is less likely to require rework.