Legal landscape of artificial intelligence in Canada

Canada’s evolving federal AI policy landscape

On June 4, 2026, the federal government released Canada’s National Artificial Intelligence Strategy: AI for All¹. The strategy prioritizes investment, innovation, and AI adoption, with proposed measures to improve transparency and modernize legislative frameworks for online safety and personal information protection.

On July 23, the government launched a public consultation on AI transparency², which was completed on September 23. The consultation sought input on detecting AI-generated content, disclosing AI interactions, improving access to understandable system information, tracking serious incidents, and monitoring AI agent activity. The inclusion of agentic AI is particularly relevant for providers exploring autonomous applications, though any resulting regulatory measures remain uncertain.

Federal and provincial consumer protection

Several provinces have proposed or enacted amendments to consumer protection legislation addressing algorithmic pricing, personalized pricing, and automated decision-making. Financial service providers operating across multiple provinces should monitor these evolving and increasingly divergent requirements.

• Québec’s Bill 24, in force since June 12, 2026, prohibits the commercial use of a person’s identity or image without consent—a measure aimed at restricting deepfakes and AI-generated content.
• Manitoba’s Bill 49, effective July 1, 2026, amends the Business Practices Act to require transparency for personalized algorithmic pricing and large-scale data collection: the first Canadian law directly targeting algorithmic pricing.
• Ontario’s Bill 104, introduced on April 15, 2026, would amend the Consumer Protection Act to make it an unfair practice to use personalized algorithmic pricing to vary the price offered to an individual consumer.

Although some of these amendments are targeted at the retail sector, their broad language may in some cases capture financial service providers that use AI to set, recommend, or vary prices, rates, or fees, such as personalized loan pricing, dynamic fees, or algorithmically tailored offers. Providers using AI-generated marketing content, synthetic voices, or chatbots should also consider consent requirements and prohibitions on misleading or deceptive representations.

Existing prohibitions under provincial consumer protection legislation and the Bank Act’s Financial Consumer Protection Framework should also be kept in mind when evaluating the use of AI tools as well as related customer consent processes, such as those respecting unfair practices and misleading or deceptive communications. It remains to be seen how financial consumer protection regulators such as the Financial Consumer Agency of Canada (FCAC) will interpret and apply such provisions in the context of AI use, including when considering the imposition of penalties; however, FCAC has confirmed in its consumer-facing notice on Artificial Intelligence in Banking that existing measures to protect a customer’s financial rights also apply to particular uses of AI, such as the Bank Act’s requirements around the sale of appropriate products and the provision of information in a manner that is clear, simple, and not misleading.

Competition law

Canadian competition laws must be considered when determining the appropriate use and disclosure—or consent to the use—of AI, including provisions relating to misleading advertising, deceptive marketing, and pricing practices and anti-competitive behaviour, such as abuse of dominance. The Competition Bureau has shown increasing interest in algorithmic pricing (and what has been referred to as "surveillance pricing") and how algorithms and AI-driven tools are used in decision-making, pricing, and conduct with potential to more broadly impact the market. Thus, financial service providers should expect greater scrutiny of AI-enabled practices going forward.

Privacy law

Canada’s federal private sector privacy law (PIPEDA) and provincial privacy laws apply to personal information used to train, fine-tune, or operate AI systems, which may include systems used for credit or other product decisioning, fraud detection, marketing personalization, and customer service chatbots or agents.

Key privacy principles financial service providers should keep in mind when deploying AI include the following:

• obtaining valid and informed consent for new or expanded uses of personal information involving AI (e.g., using personal information for training purposes, or as an AI system input);
• limiting the collection, use, and disclosure of personal information to what is necessary for purposes identified when consent was sought;
• providing meaningful transparency about the use of AI and automated decision-making involving personal information;
• ensuring appropriate safeguards for AI systems that involve personal information are used; and
• maintaining accountability and documentation for AI-related privacy risk assessments.

The Canadian government recently introduced legislation that would replace PIPEDA with the Protecting Privacy and Consumer Data Act (PPACDA)³. Violations of the PPACDA could carry administrative monetary penalties up to the greater of 3% of global revenue or $10 million. Criminal offences could attract fines up to the greater of 5% of global revenue or $25 million. Similar penalty powers are already in force under Québec’s privacy laws.

As federal and provincial privacy regulators increasingly turn their attention to AI systems, including automated decision-making and generative AI tools, financial service providers using AI tools should ensure privacy risks are adequately considered when adopting AI. A provider’s specific privacy obligations will depend on the personal information involved, the jurisdictions in which it operates, and the nature of its AI use case.

Regulatory guidelines and reports

Various regulatory guidelines and reports establish principles, recommendations, and practices that financial service providers are expected to consider.

OSFI’s July 2026 Technology Risk Bulletin, Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational Resilience, sets out sound practices for managing the risks of generative and agentic AI at federally regulated financial institutions⁴. It also reinforces that that existing OSFI Guidelines (including Guidelines B-10, B-13, E-21, and E-23) apply to the adoption and use of these technologies. OSFI’s Guideline E-23 on Model Risk Management, which sets out OSFI requirements and expectations on model (including AI) governance and risk management, comes into force in May 2027. While OSFI’s guidelines apply only to federally regulated financial institutions, they may nonetheless be relevant to fintechs where they provide services to a regulated institution. Those institutions are expected to manage third-party risk and often require their fintech vendors to demonstrate AI governance that is aligned with OSFI expectations.

On the provincial side, Québec’s Autorité des marchés financiers (AMF) issued a draft Guideline for the Use of Artificial Intelligence in 2025, followed by a final version in March 2026 that will take effect on May 1, 2027. The guideline establishes the AMF's expectations for AI governance, risk management, lifecycle controls, and consumer protection, requiring regulated financial institutions to adopt a risk-based framework for the oversight of AI systems. To date, no other provincial financial sector regulators have issued similar guidance.

OSFI and the Global Risk Institute have co-sponsored two phases of the Financial Industry Forum on Artificial Intelligence (FIFAI), bringing together financial industry stakeholders. The FIFAI I report, A Canadian Perspective on Responsible AI (April 2023), established the EDGE principles—Explainability, Data, Governance, and Ethics—as pillars for responsible AI adoption in financial services. These principles emphasize appropriate explainability and disclosure of AI decisions; consumer-centric approaches that uphold ethical values and protect privacy; and strong, risk-based governance supported by sound data practices.

The FIFAI II final report, AI Risks and Opportunities: Adopting an AGILE Framework in Canadian Financial Services (March 2026), builds on EDGE by introducing the AGILE framework—Awareness, Guardrails, Innovation, Learning, and Ecosystem Resiliency—to address risks that have expanded beyond EDGE’s original scope, including escalating cyber threats, third-party concentration risk, financial crime, financial stability implications, and consumer protection impacts. The consumer protection workshop identified three key principles: Inclusion by Design (integrating consumer interests from the outset when developing AI tools), Innovation and Resilience (recognizing that a competitive and innovative financial sector benefits consumers), and AI Literacy (promoting consumer understanding to improve access, inclusion, and protection). The FIFAI II report also emphasized that institutions should provide plain-language, tiered disclosure when consumers are dealing with AI, maintain accountability for AI-driven consumer outcomes, and provide clear avenues for redress when AI outcomes negatively affect consumers.

Key takeaways

• Canada does not have a comprehensive AI statute. Existing privacy, competition, and consumer protection and other legal frameworks apply to AI.
• The federal AI for All strategy and AI transparency consultation signal a sustained government focus on AI adoption and trust.
• Competition Act principles apply to AI-driven pricing, marketing, and market conduct, and the Competition Bureau is stepping up its scrutiny of algorithmic practices.
• Federal and provincial privacy laws govern personal information used to train or operate AI systems, including as system inputs and outputs.
• Existing federal and provincial consumer protection laws relating to unfair practices and misleading representations must be considered. Additionally, several provinces have proposed or enacted amendments to consumer protection legislation to address algorithmic pricing and automated decision-making.
• OSFI guidance and the FIFAI EDGE and AGILE frameworks are shaping industry expectations.