Overview of Bill C-27 and the Artificial Intelligence and Data Act
Bill C-27, introduced in November 2022, was a comprehensive legislative proposal aimed at modernizing Canada’s privacy laws and introducing the first federal framework for regulating artificial intelligence (AI). Part 3 of the bill, the AIDA, sought to establish Canada’s first dedicated statute for governing AI systems, addressing concerns related to transparency, accountability, and high-risk applications of AI technology.
The bill underwent second reading and referral to committee in the House of Commons on April 24, 2023. This stage marked the beginning of detailed scrutiny by parliamentary committees, where stakeholders, including civil liberties groups, industry representatives, and legal experts, provided input on the proposed legislation. The Library of Parliament published a legislative summary to aid understanding, and various analyses were conducted by legal firms and research institutions to assess the bill’s potential impacts on businesses, privacy rights, and technological innovation.
Despite the progress made during committee reviews, Bill C-27 did not advance further in the legislative process. In January 2025, Parliament was prorogued, effectively ending the session and causing the bill to die. As a result, Canada remains without a comprehensive AI statute, leaving the regulation of AI systems to existing frameworks such as privacy laws, sector-specific regulations, and the federal Directive on Automated Decision-Making.
Key Provisions of the Artificial Intelligence and Data Act
The Artificial Intelligence and Data Act, as proposed in Part 3 of Bill C-27, would have introduced several key regulatory measures to govern AI systems in Canada.
The AIDA also included provisions for accountability, requiring organizations to implement measures to mitigate risks associated with AI systems.
Additionally, the bill proposed the creation of a regulatory framework for high-risk AI systems.
Challenges and Criticisms of Bill C-27
Throughout the legislative process, Bill C-27 faced significant criticism from various stakeholders, particularly regarding its approach to AI regulation. Civil liberties groups raised concerns about the potential for the AIDA to infringe on fundamental rights, such as freedom of expression and privacy. Some argued that the bill’s broad definitions and vague language could lead to overly restrictive regulations, stifling innovation and imposing unnecessary burdens on businesses.
Legal and technical experts also highlighted ambiguities in the bill’s provisions, particularly around the scope of AI systems subject to regulation and the criteria for determining high-risk applications. Critics pointed out that the bill did not clearly define what constituted an AI system, which could lead to inconsistent enforcement and legal challenges.
A report by Citizen Lab, a research organization focused on digital security and human rights, recommended that the federal government consider withdrawing Bill C-27 and revising the legislation based on 19 proposed amendments. Other analyses, such as those conducted by legal firms like Dentons and Borden Ladner Gervais, also noted the bill’s potential impacts on businesses, including increased compliance costs and operational challenges.
Current Regulatory Landscape for AI in Canada
The primary legal instruments governing AI in Canada are privacy laws, sector-specific regulations, and the federal Directive on Automated Decision-Making.
The Consumer Privacy Protection Act (CPPA), which was part of Bill C-27, would have replaced PIPEDA and introduced more stringent requirements for data handling, including provisions for user consent and data minimization. However, with the bill’s expiration, the CPPA remains unenacted, leaving PIPEDA as the primary privacy law for the private sector.
Sector regulators also play a crucial role in overseeing AI systems within their respective domains. However, the lack of a unified AI statute means that regulatory approaches vary significantly across sectors, leading to inconsistencies in oversight and enforcement.
The federal Directive on Automated Decision-Making, issued by the Treasury Board of Canada Secretariat, provides guidance for government departments and agencies on the use of automated decision-making systems. While this directive does not apply to the private sector, it serves as a model for how AI systems could be regulated at the federal level. The expiration of Bill C-27 has left this directive as one of the few comprehensive frameworks addressing AI governance in Canada.
Required actions
- Would have required risk assessments, mitigation, monitoring and record-keeping for high-impact AI systems and disclosure of general-purpose systems, overseen by an AI and Data Commissioner