The three laws that matter
If you ship AI systems in Canada in 2026, three regulatory instruments define your floor: PIPEDA, the Artificial Intelligence and Data Act (AIDA), and the federal Directive on Automated Decision-Making. Provincial regimes (Quebec Law 25, Alberta PIPA, BC PIPA) sit on top.
PIPEDA in one paragraph
Personal information cannot be used to train models without meaningful consent, a legitimate business purpose, or an exemption. "We had it lying around" is not a purpose. Document lineage.
AIDA in one paragraph
High-impact systems require risk assessment, mitigation, human oversight, and record-keeping. Definitions and thresholds are still being finalized — build the artifacts now so you are not scrambling later.
The Directive on ADM
Applies to federal automated decisions. Four impact levels, four assessment tiers. Even if you sell to the private sector, mirroring the framework is the fastest way to earn enterprise trust.
What to do this quarter
- Stand up a model registry with owner, purpose, data sources, and impact tier for every deployed model.
- Publish an internal governance doc covering the four questions any regulator or auditor will ask: purpose, data, oversight, redress.
- Train your team on the vocabulary. Compliance is a language problem before it is a legal one.