Canada AI Compliance
Resources for people who build, sell, audit or run AI systems in Canada. The pages map Canadian laws, guidance and standards to the wiki's control library. The GCC and EU sections cover their regions in more depth and hold the general templates.
Verification required. Everything in this section about Canadian law was compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read. Article, clause and section numbers are left blank unless a source showed them; fill them in from the primary text. Check the primary text before relying on any claim. This is not legal advice.
Canada's position in one line
Canada has no federal AI Act. The Artificial Intelligence and Data Act (AIDA) lapsed when Parliament was prorogued on 6 January 2025. Obligations come from privacy law (PIPEDA and provincial laws, notably Quebec Law 25), sector guidance (OSFI), federal public-sector directives and voluntary codes [Reported].
What is in this section
| Page | For | What it holds |
|---|---|---|
| Canada AI Regulatory Hub | Everyone | Instrument register, timeline, categories and roles, mapping to wiki controls, wiki coverage, verification checklist and sources |
| Canada: Role Guide | Practitioners, product companies, auditors, implementors | One guide with a part for each role |
| CA-T1 | All | Algorithmic impact assessment worksheet |
| CA-T2 | All | Quebec Law 25 automated decision record |
| CA-T3 | All | OSFI E-23 model inventory addendum |
| Canada Regulatory Crosswalk | GRC tooling | Instrument-to-control map with verification status, also as a CSV file |
How claims are tagged
| Tag | Meaning |
|---|---|
| [Reported] | Stated by secondary web sources found on 7 October 2026 (law-firm notes, vendor blogs, research notes). Not read in the primary text. |
| [Recalled] | Stated from memory of the law or guidance and not re-checked. Verify before citing it. |
| [Conflict] | Secondary sources disagree. Resolve from the primary text. |
| [Unverified] | Single source, marketing-grade source, or not researched. |
The templates are working documents, not regulator-approved forms.
Common templates to reuse
The GCC and EU sections contain working templates that are not tied to a region. Reuse them and adapt the regional lines.
| Need | Reuse | Adapt |
|---|---|---|
| System intake and tiering | GCC T01 or EU T01 | Replace the tier names with this region's categories (section 3 of the hub) |
| Inventory | GCC T09 or EU T09 | Add the regional columns listed in this section's templates |
| Audit checklist | GCC T08 or EU T08 | Replace the criteria with this region's instruments |
| Supplier due diligence | GCC T03 or EU T03 | Replace the regional questions |
| Incident workflow | GCC T05 or EU T05 | Fill in this region's authority matrix |
| Bias testing record | GCC T10 | Use as it is |
| Risk register | GCC T12 | Use as it is |
Keeping this section current
Re-check every quarter: federal bills, privacy reform and OSFI timelines.