AI regulation in Canada, October 2026: where things stand for small businesses

Canada still has no federal AI statute. On October 23, 2026, the Office of the Privacy Commissioner of Canada published its submission to the government’s consultation on AI transparency. The OPC agrees that transparency issues can arise in five areas: AI-generated content, AI interaction, information about AI systems, AI incidents, and AI agents.

This article explains where AI regulation stands in Canada and what small businesses should do while the rules evolve.

What did the Privacy Commissioner say?

The OPC responded to Innovation, Science and Economic Development Canada’s discussion paper on enhancing trust in AI through transparency. According to the OPC announcement, the submission concurs that transparency issues can arise in the five areas ISED identified.

The OPC noted that addressing these areas will be an important step toward responsible innovation. It referenced the G7 Data Protection and Privacy Authorities Roundtable statement from 2025, which emphasized that transparency is essential to building public trust in AI.

What about Bill C-36?

Bill C-36, the Protecting Privacy and Consumer Data Act, had first reading on June 15, 2026, according to LEGISinfo. As of October 2026, there has been no second-reading activity.

According to the government’s backgrounder, Bill C-36 does not include standalone AI legislation, but it would increase transparency around automated decision systems, including those powered by AI. The bill focuses on privacy reform rather than comprehensive AI regulation.

This follows the earlier AIDA (Artificial Intelligence and Data Act), which was part of Bill C-27 in the previous Parliament. That bill died when Parliament was prorogued in January 2025, leaving Canada without dedicated AI legislation.

What this means for your business

The absence of federal AI law does not mean there are no rules. Existing privacy legislation, including PIPEDA federally and provincial laws like BC’s PIPA, still applies to personal information that AI tools process.

Know which AI tools you use. Create an inventory of AI services connected to your business, including who can access them and what data they touch.

Tell people when they are dealing with AI. The direction of regulation is toward transparency. If customers interact with an AI receptionist, chatbot, or agent, disclosure is becoming the expected practice.

Keep a human on decisions that affect people. Automated decisions about hiring, credit, services, or other consequential matters should have human oversight.

These practices are not current legal requirements for all businesses in all situations. They are prudent steps that align with where regulation is heading.

A watch list for the next 12 months

ISED consultation outcome. The government will review submissions and may propose transparency requirements or guidance.

Bill C-36 progress. If the bill advances, it could introduce new duties for automated decision-making. Monitor for second-reading activity.

Provincial guidance. The BC Office of the Information and Privacy Commissioner has published tips on generative AI. Other provinces may follow with their own guidance or enforcement priorities.

Frequently asked questions

Do I have to disclose that I use an AI receptionist?

There is no federal rule requiring disclosure for all AI interactions. However, transparency is the direction regulators are moving. Disclosing that callers are speaking with an AI is a reasonable practice that aligns with emerging expectations. For more on voice agents, see our guide to AI receptionists for small business.

Does this apply to sole proprietors?

PIPEDA applies to commercial activities. Whether a sole proprietor is covered depends on the nature of the business. Provincial privacy laws may also apply. The AI-specific regulatory picture is the same: no federal statute yet, but existing privacy rules still apply to personal information.

Should I wait for regulations before using AI?

No. Businesses that wait for perfect regulatory clarity may fall behind. The practical approach is to use AI responsibly now: know what tools you use, be transparent with customers, and keep humans involved in consequential decisions.

See where AI would touch customer data

The AI readiness quiz takes about two minutes and helps identify which of your workflows involve customer data. That is the starting point for understanding your obligations under existing privacy law and preparing for future AI transparency requirements.