Canada: Role Guide

Verification required. Claims on this page about Canadian law were compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read, and each claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.

Use the Canada AI Regulatory Hub for instrument detail, and the templates in this section.

AI practitioners

For engineers, data scientists and security staff.

Capture the facts that Quebec requires: the factors behind each automated decision and the human review route (CA-T2).
For public-sector work, run an impact assessment and set the impact level (CA-T1).
Limit the reuse of data in training beyond its original purpose.

Product companies

For vendors, SaaS providers and platforms.

Public-sector bids need AIA-style evidence.
Quebec customers expect explanation and human review features.
Financial institutions will ask for OSFI-style model documentation.

Auditors

For internal, external and assurance auditors.

Define the criteria by province and sector.
Test Law 25 notices, explanations and review.
State that no federal AI law applies.

Implementors

For programme leads, GRC teams, CISOs and DPOs.

Create a Canada overlay with federal, Quebec and sector layers.
Keep a watchlist of bills.
Align the model inventory with OSFI expectations if they apply to you (CA-T3).

Shared evidence list

AIA records
Law 25 notices and explanation logs
Model inventory
Purpose and consent records

Report limitation sentence for auditors

"Criteria were taken from a regulatory register dated 7 October 2026, compiled from secondary sources and not verified against primary legal text. This report is not a legal opinion."