The Regulatory Reality: No Federal AI Law, But Rules Still Apply

If you are waiting for a single federal AI statute to tell you what is allowed, you will be waiting a while. Bill C‑27, which carried the proposed Artificial Intelligence and Data Act, died when Parliament was prorogued in January 2025 and has not been reintroduced as of mid‑2026.

That does not mean the field is unregulated. Canada now relies on a patchwork of provincial laws, federal directives, and voluntary frameworks that together create real compliance obligations for any organization deploying AI. Manitoba, Ontario, Quebec, Nova Scotia, Alberta, and British Columbia have each enacted rules covering public‑sector AI governance, employment‑screening disclosure, automated‑decision privacy rights, and criminal provisions on AI‑generated intimate images.

• Manitoba requires public‑sector AI governance and restricts algorithmic business practices
• Ontario mandates disclosure when AI is used in job postings and court filings
• Quebec’s privacy law regulates automated decisions made without human judgment
• Nova Scotia criminalizes fake intimate images created with AI

At the federal level, the Treasury Board Directive on Automated Decision‑Making has applied to government systems since April 2019, and the Voluntary Code of Conduct on Responsible Development and Management of Advanced Generative AI Systems was published in September 2023. The code sets out six core principles but carries no enforcement mechanism, penalties, or audit requirements. Only about 30 Canadian companies had signed it by late 2024.

Meanwhile, 92% of Canadian business leaders say federal regulation of high‑impact AI should come “as soon as possible,” and the same share want any regime to stay “agile, flexible, and relatively light in touch.” In the absence of binding law, organizations are adopting ISO/IEC 42001 — endorsed by the Standards Council of Canada in 2024 — and the NIST AI Risk Management Framework as de facto governance standards.

Worqd helps clients navigate this landscape by building AI‑driven lead generation and conversion systems that respect provincial disclosure rules, privacy obligations, and emerging best‑practice frameworks from day one.

Provincial Patchwork: Key Laws Across Canada That Impact AI Use

Provincial governments have stepped in to regulate AI where federal efforts have stalled, creating a complex patchwork of rules that businesses must navigate based on where they operate or serve clients. This decentralized approach means compliance obligations can vary significantly from one province to another, particularly in areas like public sector procurement, employment practices, and consumer privacy.

Manitoba has taken a broad approach, enacting laws that govern AI use in the public sector, regulate business practices involving algorithms, and even update definitions of school bullying to include AI-generated content. Ontario requires employers to disclose when AI is used in hiring processes, mandates accountability frameworks for public sector AI systems, and has updated court rules to address the use of AI in legal filings. Quebec has amended its private-sector privacy law to place strict limits on automated decisions made without human judgment, directly impacting how businesses use AI for credit scoring, hiring, or service eligibility.

In Nova Scotia, legislation specifically targets the creation and distribution of deepfake intimate images using AI, criminalizing non-consensual generation and sharing. Alberta and British Columbia have introduced sector-specific rules, with Alberta focusing on data centre regulations that indirectly affect AI infrastructure and British Columbia updating privacy guidelines to cover automated decision-making in both public and private contexts. For companies like Worqd, which provides AI-powered lead generation and conversion services to clients nationwide, understanding these provincial nuances is essential when advising on compliance practices — especially when deploying AI systems that interact with personal data or influence hiring outcomes. Businesses should assess where their activities trigger provincial rules and align internal governance accordingly, leveraging voluntary frameworks like the federal Code of Conduct on Responsible AI Development as a baseline while monitoring for evolving provincial requirements.

Building Compliance: Voluntary Codes and International Frameworks as Best Practice

With no binding federal AI law in force, Canadian businesses can't point to a single rulebook for responsible AI use. Instead, compliance today means adopting voluntary codes and international standards — and that's quickly becoming the de facto expectation across the private sector.

The federal government's main instrument is the Voluntary Code of Conduct on Responsible Development and Management of Advanced Generative AI Systems, released in September 2023. It sets out six core principles for developing and managing advanced generative AI, but it comes with real limits: no enforcement mechanisms, no penalties, and no auditing requirements. Roughly 30 Canadian companies had signed on as of 2024, according to Field Law's analysis, which notes the code amounts to guidelines and best practices without the force of law.

That gap is why many Canadian organizations are turning to internationally recognized frameworks. ISO 42001 — the international standard for AI management systems — was adopted by the Standards Council of Canada in 2024, giving Canadian businesses a credible, structured way to demonstrate due diligence. The NIST AI Risk Management Framework is also widely adopted by Canadian entities as a foundation for AI governance, according to industry analysis.

For businesses evaluating AI providers, asking about these practices is one of the most practical due diligence steps available. A provider that can't explain how it manages AI risk is asking you to carry that risk yourself. When you're putting AI to work in lead generation, follow-up, or creative testing, the questions worth asking include:

• Does the provider follow the federal Voluntary Code of Conduct, or a recognized framework like ISO 42001 or the NIST AI Risk Management Framework?
• How do they handle personal information in line with PIPEDA, Canada's federal private-sector privacy law dating back to 2001?
• What transparency do they offer about where AI is used in their process — and where a human is in the loop?
• Do they use consent-based practices, like explicit opt-in before contacting someone on your behalf?

At Worqd, we take this seriously in how we operate: consent-aware outreach, no sensitive form fields sent to public analytics, and clearly marked placeholders rather than fabricated results. It's the same standard we'd want from any partner handling our customer relationships.

The voluntary landscape may not stay voluntary for long. Experts expect the Canadian government to reintroduce some form of AI regulation informed by the AIDA debate, so organizations that build governance habits now — codes, frameworks, transparency — will be ahead of whatever comes next.