Canada's AIDA: What It Would Have Required, and Why It Died

Canada does not have a general AI statute. The Artificial Intelligence and Data Act was never enacted: it died on the Order Paper when Parliament was prorogued on 6 January 2025, and it had not been reintroduced at the time of writing. Any document describing AIDA as Canadian law is wrong.

It died on prorogation, in January 2025

Prorogation ends a parliamentary session. Under the practice of the House of Commons, government bills that have not received Royal Assent die when the session ends and must be reintroduced in the new session, which restores them to the legislative process only if the House agrees to reinstate them. Parliament was prorogued on 6 January 2025 to 24 March 2025. Bill C-27, which contained AIDA, was at committee stage in the House of Commons Standing Committee on Industry and Technology at the time and had been there for over a year. It died. A general election followed in the spring of 2025 and a new Parliament was returned; AIDA was not brought back as a government bill in the period covered by this page.

The bill it was part of

AIDA was Part 3 of Bill C-27, the Digital Charter Implementation Act, 2022, introduced on 16 June 2022 by the Minister of Innovation, Science and Industry. The bill bundled three instruments: the Consumer Privacy Protection Act, which would have replaced the private-sector parts of PIPEDA; the Personal Information and Data Protection Tribunal Act, creating an appeal tribunal; and AIDA. Bundling was a drafting choice with a consequence — the privacy reform and the AI regime rose and fell together, and AIDA’s difficulties at committee delayed both.

AIDA was criticised throughout for delegating almost all of its substance to regulations that did not exist. The bill as introduced did not define which systems were “high-impact”, leaving it to be set by regulation. In November 2023 the Minister proposed a set of amendments to the committee that would have written classes of high-impact system into the schedule — covering areas such as employment decisions, provision of services, biometric processing, content moderation and prioritisation, health care, and use by courts or law enforcement — and would have added distinct obligations for general-purpose systems. Those amendments were never adopted into an enacted text.

What AIDA would have required

The bill’s architecture is worth knowing because a successor will probably reuse it. Obligations attached to persons carrying out “regulated activity” in the course of international or interprovincial trade and commerce — the constitutional hook, which limited its reach compared with the EU approach. Distinct duties were proposed for those who design or develop a system, those who make it available for use, and those who manage its operations.

• Assessment. Assess whether a system is high-impact, and keep records of the assessment.
• Risk mitigation. Establish measures to identify, assess and mitigate risks of harm or biased output, proportionate to the system.
• Monitoring. Monitor compliance with those measures and their effectiveness in operation.
• Transparency. Publish a plain-language description of the system, including its intended use, the content it generates or the decisions it makes, and the mitigation measures established.
• Notification. Notify the Minister where use of a high-impact system results or is likely to result in material harm.
• Data. Requirements on anonymised data used in designing or developing a system, including keeping records of how it was anonymised.

Administration would have sat with the Minister and a designated Artificial Intelligence and Data Commissioner — a senior official within the department, not an independent officer of Parliament, which was one of the more contested design decisions. The Commissioner would have had audit and order-making powers exercised through the Minister.

The penalties and the offences

AIDA proposed administrative monetary penalties, with the detail to be set by regulation, alongside statutory maxima on the face of the bill that were widely reported as the greater of a fixed multi-million-dollar ceiling and a percentage of gross global revenues, scaled by the seriousness of the contravention. It also created true criminal offences rather than only regulatory penalties: knowingly using unlawfully obtained personal information to design or develop a system; making a system available knowing or being reckless as to whether its use is likely to cause serious physical or psychological harm or substantial property damage; and making one available with intent to defraud the public and cause substantial economic loss.

Because the exact figures depended on provisions that were never enacted and were under active amendment in committee, this page does not state them as facts. If you need them, read the bill text at the reading stage you care about on LEGISinfo, and note which version you are reading.

What actually governs Canadian AI now

Three things, none of which is an AI statute.

• PIPEDA and its provincial equivalents govern personal information in AI systems, through consent, appropriate purposes, accuracy and safeguards. This is the operative federal framework and it is the subject of the OPC guidance page.
• Quebec’s Law 25 is the only Canadian statute with express automated-decision transparency rights, in force since September 2023 — see its automated decision provisions. It is provincial, and it applies to enterprises operating in Quebec regardless of where they are headquartered.
• The Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, launched by the federal government on 27 September 2023, which signatories adopt by choice and which creates no legal obligation.

Sector law continues to apply as it always did: human rights legislation to discriminatory outcomes, consumer protection law to misleading claims, and financial and health regulators to their own domains. The correct description of Canada’s position is that AI is regulated by general law and one provincial privacy statute, with a federal AI bill having failed. Anything more definite than that is overstating it.