The Regulatory Landscape – What the Law Already Requires

Canada

Artificial Intelligence and Data Act (AIDA) – Status: Lapsed

Bill C-27, which would have introduced Canada’s first federal AI statute through the Artificial Intelligence and Data Act (AIDA) as part of a broader digital governance package, died on the Order Paper in January 2025 when Parliament was prorogued. According to the IAPP, AIDA would have imposed risk assessment, transparency, and human rights protection requirements on “high-impact AI systems.” As of June 2025, Minister Evan Solomon confirmed that AIDA as drafted will not return – only select elements may be incorporated into a future framework under a “light, tight, right” approach to AI regulation, per Cookie Script’s analysis of Bill C-27’s status. Canada is currently operating under PIPEDA (from 2000), with no federal AI law in force.

Voluntary Code of Conduct on Advanced Generative AI Systems (September 2023)

Issued by Innovation, Science and Economic Development Canada (ISED), the Voluntary Code of Conduct asks organizations developing or managing advanced generative AI systems to commit to six principles: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness. The Code includes a detailed matrix of specific measures for developers and managers. It is non-binding but was designed to bridge the regulatory gap until AIDA was enacted. With AIDA now lapsed, the Voluntary Code has taken on greater practical significance as the primary federal standard signal for Canadian AI operators.

Treasury Board Directive on Automated Decision-Making

The Treasury Board of Canada Secretariat’s Directive on Automated Decision-Making applies to federal government departments that use automated decision systems to fully or partially automate administrative decisions. It requires an Algorithmic Impact Assessment (AIA), transparency obligations, quality assurance, and meaningful recourse mechanisms. The Directive applies to all systems developed or procured after April 2020 and tiered requirements that escalate with the decision’s impact level. While it governs government use rather than private sector use, it establishes the federal government’s own standards for responsible AI use in public administration.

OSFI Guideline E-23 – Model Risk Management for Federally Regulated Financial Institutions

The Office of the Superintendent of Financial Institutions updated and expanded Guideline E-23 in September 2025, with compliance expected by 2027. The updated guideline significantly expands the scope to include AI and machine learning models, and requires federally regulated financial institutions (FRFIs) – including major Canadian banks, insurers, and trust companies – to maintain model identification registries, conduct robust model validation, implement data governance controls (including attention to bias and fairness), define escalation procedures for model performance issues, and ensure appropriate multidisciplinary team involvement throughout the model lifecycle. Torys LLP’s analysis notes that existing obligations may also include Quebec Law 25 notice requirements for automated decision-making.

Quebec Law 25 (Loi 25)

Quebec’s Law 25, fully in force as of September 2024, is Canada’s most comprehensive privacy statute currently in effect. It aligns closely with the EU’s GDPR and introduces binding obligations relevant to AI: mandatory Privacy Impact Assessments before launching new information systems or engaging in automated decision-making; obligations to inform individuals when significant decisions about them involve automated processing; a right to contest automated decisions; and penalties of up to CAD 25 million or 4 percent of worldwide turnover. It applies to any organization – including those headquartered outside Quebec – that processes personal information of Quebec residents.

United States

Executive Order 14110 – Status: Revoked

President Biden’s Executive Order 14110 on Safe, Secure, and Trustworthy AI – issued October 2023 and widely described as the most comprehensive U.S. government AI governance directive to date – was revoked by President Trump on his first day in office, January 20, 2025. The Trump administration’s approach emphasizes deregulation of AI at the federal level and, through a December 2025 executive order, seeks to pre-empt state AI laws that conflict with a national policy of minimal federal AI regulation. The White House’s December 2025 action explicitly states it “must forbid State laws that conflict with the policy set forth in this order” – though the legal authority to pre-empt state consumer protection laws in this manner remains contested.

NIST AI Risk Management Framework – Remaining Operative

The NIST AI RMF remains the U.S. government’s primary guidance for voluntary AI risk management and is directly referenced in the Colorado AI Act as the basis for safe harbour from liability. It is used by Microsoft, government agencies, and major financial institutions as an operational governance framework.

Colorado AI Act (SB 24-205)

Colorado’s SB 24-205, signed May 17, 2024, is the first state law in the U.S. to impose broad AI governance obligations on both developers and deployers of “high-risk AI systems” – defined as systems making or substantially influencing consequential decisions in employment, housing, credit, education, or healthcare. Requirements include conducting impact assessments, providing consumers with notice and explanation of AI-driven decisions, offering the opportunity to correct erroneous data, and publishing a public statement on the organization’s risk management approach. Full implementation has been delayed to June 2026 per Akin Gump’s analysis. Organizations that comply with the NIST AI RMF receive a rebuttable presumption of reasonable care.

NYC Local Law 144

As described in Chapter 5, NYC Local Law 144 requires any employer using automated tools in New York City employment decisions to conduct and publish an annual bias audit by an independent auditor, and to notify affected candidates. Enforcement began July 2023. Civil penalties of USD 500 to USD 1,500 per violation per day apply.

Sectoral Enforcement

Absent a comprehensive U.S. federal AI law, enforcement is proceeding through existing sectoral regulators. The EEOC applies employment discrimination law to AI hiring tools. The FTC applies consumer protection and deceptive trade practices laws to AI systems that mislead consumers. The SEC has signalled scrutiny of AI use in investment advice and market activities. The FDA regulates AI used in medical devices and clinical decision support. These overlapping authorities create a complex compliance landscape that requires organizations to map each AI deployment to the relevant sectoral regulator.

European Union

EU AI Act

The EU AI Act was published in the Official Journal on July 12, 2024 and entered into force August 1, 2024. It is the world’s most comprehensive legally binding AI governance framework, built on a tiered risk structure: prohibited uses (biometric surveillance for mass monitoring, social scoring, real-time remote biometric identification in public spaces); high-risk systems (employment, credit, education, law enforcement – subject to mandatory conformity assessments, data governance requirements, transparency obligations, and registration in an EU database); limited-risk systems (chatbots – subject to disclosure requirements); and minimal-risk systems (subject only to voluntary codes of conduct).

The EU AI Act implementation timeline provides the following key compliance milestones:

Penalties reach EUR 30 million or 6 percent of global annual turnover for the most serious violations. Canadian organizations that operate in the EU market, sell AI-enabled products in Europe, or process data of EU residents must assess their obligations under the AI Act.

United Kingdom

The UK has chosen a “pro-innovation” approach to AI regulation, avoiding a single omnibus AI law and instead directing existing regulators (financial, healthcare, competition, data protection) to apply existing frameworks to AI within their sectors. The UK AI Security Institute – established after the November 2023 Bletchley AI Safety Summit – conducts independent pre-deployment safety evaluations of frontier AI models. With £100 million in public funding, it has tested 16 models, including at least three frontier models before public launch. The Institute is now working on “capability thresholds” – defined risk levels that would trigger mandatory regulatory intervention.

Asia

Singapore

Singapore’s IMDA and AI Verify Foundation have produced the most practical government-backed AI governance toolkit in Asia: the Model AI Governance Framework (first published 2019, updated), the AI Verify testing toolkit (voluntary, principle-based), and as of May 2026, a new Model AI Governance Framework for Agentic AI – one of the world’s first governance frameworks specifically designed for autonomous AI agents.

Japan

Japan has adopted what CSIS describes as a “light touch” approach – relying on existing sector-specific laws and voluntary commitments from industry, rather than imposing sweeping AI-specific legislation. Japan’s AI Policy Study Group’s February 2025 Interim Report explicitly rejected the idea of regulating only large-scale foundational models and emphasized reliance on existing legal frameworks.

China

China’s Interim Measures for the Management of Generative Artificial Intelligence Services entered into force August 15, 2023. They require generative AI service providers to conduct security assessments, label AI-generated content, maintain complaint mechanisms, and cooperate with government oversight inspections. They represent the first legally binding framework anywhere in the world specifically targeting generative AI.

South Korea

South Korea enacted an AI Basic Act creating a framework for classifying AI systems by risk level, establishing an AI oversight authority, and creating obligations for high-impact AI systems. The Future of Privacy Forum’s analysis describes it as attempting to balance innovation promotion with risk management.