The AI Act That Died: What Actually Binds US SaaS in Canada
Canada spent two years drafting AIDA, and then it died on the order paper. The lesson most US companies took from that — "Canada is unregulated, deprioritize it" — is wrong. The binding obligations are in provincial privacy and employment law, and one of them started January 1, 2026.
First, the Thing That Didn't Happen
The Artificial Intelligence and Data Act was the third part of Bill C-27, a package that also contained a replacement for Canada's federal private-sector privacy law. It got through committee, collected substantial amendments, and never made it out. When Parliament was prorogued in January 2025, every bill on the order paper died with it — including AIDA.
Canada has since restructured how it approaches AI at the federal level, including creating a dedicated ministerial portfolio for artificial intelligence and running policy consultation on what a Canadian framework should contain. What it has not done is enact a horizontal AI statute. If your compliance tracker has a row for "Canada AI Act," the honest current value is: does not exist.
That absence is exactly why US teams misread the country. There is no single document to read, so there appears to be nothing to do. The obligations are real; they are just distributed.
Quebec Law 25: The Automated Decision Rule Nobody Budgeted For
Quebec modernized its private-sector privacy law through a reform commonly called Law 25, phased in across several years. One provision matters enormously for AI and has been in force since September 2023 — long enough that "we didn't know" is no longer an available position.
When a decision about an individual is based exclusively on automated processing of their personal information, you must inform them of that fact at the time of the decision or before. And on request, you must tell them:
- What personal information was used to make the decision
- The principal factors and parameters that led to it
- That they have the right to have the information corrected
They must also be given the opportunity to submit observations to a member of your staff who is in a position to review the decision. That last clause is the operational one. It means an automated decision path needs a human review path attached — not an aspirational escalation policy, an actual person with authority to change the outcome.
The word doing the work is "exclusively"
A decision with genuine human involvement is not exclusively automated. But "a human clicked approve on whatever the model recommended" is a design many organizations believe exempts them and which regulators across privacy regimes have consistently treated with skepticism. If the human cannot realistically deviate — no time, no information, no authority, no training — you are running an exclusively automated process with a person shaped like a rubber stamp.
Ontario: AI Disclosure in Job Postings, Live Since January 2026
Ontario amended its employment standards legislation through the Working for Workers series of bills. Among the changes: publicly advertised job postings must disclose whether artificial intelligence is used to screen, assess, or select applicants. That requirement took effect on January 1, 2026.
This is a different regulatory shape from New York City's Local Law 144 and worth understanding as a contrast. Local Law 144 requires a bias audit and publication of results. Ontario requires disclosure in the posting itself. One is an assurance regime; the other is a notice regime. A US company hiring in both jurisdictions cannot satisfy Ontario with an audit or NYC with a disclosure line — the obligations are not interchangeable.
If You're the Employer Hiring in Ontario
- ☐Audit which of your ATS features constitute AI screening
- ☐Add the disclosure statement to Ontario job postings
- ☐Confirm your posting template propagates to job boards
- ☐Ask your ATS vendor, in writing, what AI it applies
- ☐Track other posting-content requirements in the same amendments
If You're the HR Software Vendor
- ☐Your Ontario customers will ask what your product does
- ☐Ship a plain-language description of AI use they can rely on
- ☐Surface which features are AI-driven in your admin UI
- ☐Expect the same question from Quebec, NYC, Illinois, and Colorado
- ☐One clear vendor disclosure answers all of them
PIPEDA and the Rest of the Federal Layer
Federally, Canada's private-sector privacy law — PIPEDA — continues to apply to commercial handling of personal information, including by organizations outside Canada that have a real and substantial connection to it. Its consent, purpose-limitation, and accountability principles constrain AI development and deployment even without an AI-specific statute.
The Office of the Privacy Commissioner has also published principles for responsible development and use of generative AI, jointly with provincial counterparts. Guidance is not law, but it is the clearest available signal of how the regulator will read existing principles when applied to AI — and it is what an investigator will reach for.
Add to this the ordinary law that never went away: human rights codes that prohibit discrimination in employment and services regardless of whether a model or a manager produced the outcome, consumer protection law that reaches deceptive claims about what your AI does, and sector regulation in financial services and health. None of these were written for AI. All of them apply to it.
What to Actually Do
- Find your Quebec exposure first. Quebec has the sharpest in-force AI-adjacent obligation and a regulator willing to use it. Provincial residency, not just "Canadian customers," is the relevant question.
- List every decision your product makes about a person. Approvals, denials, scores, rankings, eligibility, pricing, flags. That list is the whole compliance surface.
- For each one, ask whether a human can actually change it. If not, you owe notice, explanation on request, and a real review path.
- Fix Ontario job postings today if you hire there. The requirement is live and it is the cheapest item on this list to satisfy.
- Write the vendor disclosure once. If you sell HR, lending, or screening software, a single clear statement of what AI your product applies will be requested by every customer in every jurisdiction on this page.
- Stop waiting for the federal act. Nothing on this list becomes unnecessary if Canada passes one.
Frequently Asked Questions
Is AIDA coming back?
Some form of federal AI legislation remains under discussion, and Canada has continued consulting on what a framework should look like. But AIDA as drafted died with Bill C-27, and any future bill would start over with new text, new consultation, and a new parliamentary timeline. Planning your compliance program around a bill that does not exist is not planning.
We're a US company with a few Canadian customers. Does Quebec Law 25 really reach us?
The practical trigger is whether you are handling the personal information of people in Quebec in the course of commercial activity. Quebec's regulator has taken an expansive view of its reach, consistent with the broader international trend. The proportionate response for a small footprint is to make sure any exclusively-automated decision you make about an individual carries notice and a human review path — which is good practice regardless.
Does the Ontario rule apply if our company is in California?
The rule attaches to publicly advertised postings for positions in Ontario, not to where the employer is headquartered. A US company advertising an Ontario-based role is the intended audience. The same is true of your screening vendor — using an American ATS does not move the obligation off you.
How does this compare to what we've already built for the EU?
Most of the substance transfers. If you have built AI-interaction disclosure, an explanation capability for consequential decisions, and human oversight for automated decision-making to satisfy GDPR Article 22 and the EU AI Act, Quebec's requirements will feel familiar and Ontario's is a copy change. The mistake is assuming Canada needs nothing because it has no AI act — the notice and review obligations are already there.
What about the other provinces?
Alberta and British Columbia have their own private-sector privacy statutes, and several provinces have been reviewing or modernizing their privacy and employment legislation. Quebec is currently the sharpest for automated decisions and Ontario for hiring disclosure, but this is an active area — treat the provincial layer as something to re-check annually rather than settle once.
No Statute Is Not the Same as No Obligation
The reason Canada gets skipped in US compliance planning is that there is no single document to point at. That is a research problem, not a regulatory holiday. Quebec has required notice and human review of automated decisions since 2023, and Ontario has required AI disclosure in job postings since January 2026.
Both of those are satisfied by the same underlying capability: knowing which decisions your product automates, telling people when one is made about them, and being able to explain it. Build that, and Canada stops being a gap in your matrix.
This article is general information, not legal advice. Canadian federal and provincial requirements in this area are actively changing — confirm current obligations with Canadian counsel before relying on them.