AI Governance Gap in Canada

Canada's only attempt at comprehensive AI legislation — the Artificial Intelligence and Data Act (AIDA), Part 3 of Bill C-27 — died on the Order Paper when Parliament was prorogued on January 6, 2025. As of March 2026, no replacement has been tabled. The current government has explicitly adopted a "light, tight, right" approach to AI regulation that the government describes as balancing economic opportunity with governance.

AIDA was introduced on June 16, 2022 as part of the Digital Charter Implementation Act. It was widely criticized by 45 civil society organizations — including Amnesty International, the Assembly of First Nations, the Canadian Labour Congress, and the Writers Guild of Canada — for lacking independent oversight, excluding government use of AI, narrowing harm definitions to quantifiable individual damages, and having been developed through closed consultation with industry. The bill remained in the INDU committee through 2024 without reaching a vote.

The prorogation also killed Bill C-63 (the Online Harms Act) and Bill C-26 (cybersecurity legislation), compounding the regulatory gap. AI Minister Evan Solomon, appointed May 2025 as Canada's first minister responsible for AI, confirmed that AIDA will not return in its original form. The government launched a 30-day "national sprint" in September 2025 and received over 11,300 public responses, but as of March 2026 no legislation has been tabled.

What Canada does have is partial and fragmented. The Directive on Automated Decision-Making (DADM), effective since April 2019, applies only to federal institutions using automated systems for administrative decisions — and the CRA is excluded by operation of its enabling legislation (Canada Revenue Agency Act, s. 30(2)). A Voluntary Code of Conduct on Generative AI, launched September 2023, has no enforcement mechanism. PIPEDA and provincial privacy laws (Quebec's Law 25, Alberta and BC's PIPA) provide some data protection but were not designed for AI. No federal law addresses AI safety, mandatory incident reporting, biometric surveillance, deepfakes, or autonomous systems.

The result is that every AI incident documented in CAIM occurred in a jurisdiction with no comprehensive AI governance framework. The RCMP deployed without public disclosure Clearview AI facial recognition. OpenAI detected but did not report a future mass shooter. The CRA served incorrect information to millions. IRCC deployed opaque algorithmic screening. In each case, the harm occurred in the absence of any applicable AI-specific regulatory framework.

A Leger poll in August 2025 found that 85% of Canadians believe AI tools should be regulated. A separate KPMG and University of Melbourne global study (surveying 1,025 Canadians in late 2024) found that 92% are unaware of any existing laws governing AI in Canada. The gap between public expectation and institutional reality is the defining feature of this hazard.

The current government's approach reflects a deliberate policy choice. Proponents argue that premature comprehensive legislation could stifle innovation and economic competitiveness, and that existing legal frameworks — privacy law, competition law, criminal law, consumer protection — already apply to AI systems. The Canadian AI Safety Institute (CAISI) and the Voluntary Code of Conduct represent non-legislative governance mechanisms. Critics counter that voluntary frameworks lack enforcement mechanisms and existing laws were not designed for AI-specific risks.