AIDA (Artificial Intelligence and Data Act)

The Artificial Intelligence and Data Act (AIDA) was Canada's first serious attempt at a national framework for regulating artificial intelligence. Tabled in June 2022 as Part 3 of Bill C-27, the Digital Charter Implementation Act, 2022, AIDA set out to govern "high-impact" AI systems — those posing risks to health, safety, or human rights, or capable of producing biased and discriminatory outcomes — and to create a new AI and Data Commissioner within the federal industry ministry to administer and enforce the regime. Examples regularly cited as high-impact included hiring and résumé-screening tools, biometric and facial-recognition systems, and the content-recommendation algorithms that shape what millions of people see.

What the Act would have required

AIDA followed a risk-based logic: obligations would have scaled with a system's potential for harm, concentrating on the high-impact tier rather than regulating all AI uniformly. Businesses responsible for such systems would have faced duties to assess and mitigate risks of harm and bias, to monitor systems in operation, to publish plain-language descriptions of how they work, and to notify the government of serious incidents. The Act also contemplated real teeth, including administrative monetary penalties and criminal provisions for the most egregious conduct, such as knowingly deploying an AI system that causes serious harm. Much of the substance, however — including the precise definition of "high-impact" — was deliberately left to future regulations, which became one of the loudest criticisms: Parliament was being asked to pass a frame and trust the picture to come later.

What happened to it

AIDA never became law. Bill C-27 spent over two years in the legislative process and was still in committee when Parliament was prorogued in early January 2025 amid the Prime Minister's resignation; the bill died on the order paper. As of mid-2026 it has not been reintroduced, which means Canada has no dedicated federal AI statute. Federal private-sector privacy law still runs on PIPEDA, a statute dating to 2000, whose modernization was itself another casualty of C-27's collapse. Along the way AIDA drew sustained criticism beyond its unfinished definitions — a thin consultation process, enforcement housed in the same ministry that promotes the AI industry, and carve-outs around government and national-security uses were all flashpoints.

Why it still matters

Even dead, AIDA remains the clearest signal of where Canadian AI regulation was headed: risk tiers, impact assessments, transparency duties, incident reporting, and a designated regulator. Any future federal framework is likely to revisit these same building blocks, and businesses that build toward them now are unlikely to regret it. In the meantime, the regulatory vacuum cuts both ways — fewer compliance obligations today, but also less certainty about tomorrow's rules and no statutory guardrails to point to when customers ask hard questions. That makes voluntary good practice more valuable, not less: transparency about how AI systems reach decisions, meaningful human oversight of consequential ones, and keeping sensitive data under your own control. Running models on-premise — on hardware you own, inside a jurisdiction you understand — is one of the few compliance postures that is robust to whatever framework eventually replaces AIDA, and it pairs naturally with sound data residency and data sovereignty practices. It is also worth remembering that "no federal AI statute" has never meant "no law that touches AI": Quebec's Law 25 already imposes real obligations around automated decision-making and cross-border data flows, and Canadian firms selling into Europe answer to the EU's AI Act regardless of what Ottawa does next.

This is general information, not legal advice — consult a qualified professional before relying on it. For the current landscape, see AI regulation in Canada and the US CLOUD Act and Canadian AI data.