Government · Canada · 11 min read · Rody Nigel, PhD
Canada's AI Governance Landscape: PIPEDA, Quebec's Law 25, and the Federal Directive
Canada does not have a single AI law that governs every deployment. It has a layered set of federal and provincial privacy obligations, plus a specific directive for public-sector automated decision-making.
The federal layer: PIPEDA
PIPEDA governs collection, use, and disclosure of personal information by private-sector organizations, and its core obligations — meaningful consent, purpose limitation, accountability, reasonable safeguards — apply directly to AI systems processing personal data. In May 2026, Canadian federal and provincial regulators published joint findings from an investigation into a major AI provider, confirming AI systems are actively assessed under current privacy law.
The Quebec layer: Law 25
For organizations operating in Quebec — including RN Consultants itself — Law 25 adds privacy impact assessments in defined circumstances, governance-of-personal-information requirements, cross-border and third-party data transfer rules, and transparency requirements around automated decision-making, including a right for affected individuals to be informed. Any deployment touching Quebec residents' data needs to be assessed against Law 25 specifically.
Other provinces
Depending on the organization, Alberta's and British Columbia's private-sector privacy statutes, and applicable public-sector privacy regimes, may also apply.
The public-sector layer
The Treasury Board's Directive on Automated Decision-Making has been in force for several years and requires algorithmic impact assessments and quality-assurance requirements scaled to impact level. Most public-sector teams aware of the Directive still have not fully operationalized it into delivery.
How PMAIS handles the Canadian layer
PMAIS's regulatory crosswalk evaluates the applicable federal and provincial privacy obligations for the specific organization, sector, and data involved, and incorporates the resulting requirements directly into the Data Governance Record and Human Oversight Plan.
If you're not certain which of these layers applies to your organization, that determination is the first output of a PMAIS engagement. Book a discovery call to start mapping it.
Book a discovery call →