AIDA Is Dead. The Vacuum Is Real.

Bill C-27's proposed Artificial Intelligence and Data Act never became law. That leaves a gap in the proposed federal framework, but it does not exempt AI systems from existing privacy, human-rights or professional rules. Firms need to distinguish the abandoned proposal, later bills and obligations already in force.

What Actually Happened

Bill C-27 combined proposed consumer-privacy legislation, a privacy tribunal statute and AIDA. It was introduced on June 16, 2022, passed second reading on April 24, 2023 and remained in committee when the parliamentary session ended on January 6, 2025. Its proposed AI regime therefore did not acquire legal force.

The House of Commons' prorogation notice explains the procedural effect precisely: government bills without royal assent cease to exist, but can be reintroduced or reinstated by motion in a new session. Private Members' Business follows a different automatic-reinstatement rule. The bill did not legally die in late 2024 merely because its progress had stalled.

This May 2026 essay concerns that abandoned proposal. A subsequent privacy proposal, Bill C-36, was introduced on June 15, 2026. Its parliamentary record identifies a bill at second reading, not an enacted replacement for AIDA. The legal effect of any later measure depends on its own text, parliamentary progress and commencement provisions.

The Provinces Did Not Wait

Quebec's private-sector privacy law already addresses some automated decisions. Section 12.1 requires notice of an exclusively automated decision, specified explanations on request and an opportunity to make observations to someone able to review it. These duties concern the use of personal information within the statute's scope. The CAI's administrative and penal regimes are separate: for persons other than natural persons, the respective ceilings are the greater of $10 million or 2% and $25 million or 4% of the previous financial year's worldwide turnover. Applying either regime requires examining the conduct and the particular statutory provision involved.

Ontario's Bill 194, assented to on November 25, 2024, created a public-sector digital-security and AI framework whose particular requirements depend on the applicable provisions and regulations. Separately, employment job-posting rules took effect on January 1, 2026. Subject to the statutory scope and exceptions, employers with at least 25 employees must disclose in a publicly advertised job posting their use of AI to screen, assess or select applicants. That is more specific than a general disclosure duty for every private employer or every use of AI.

No Federal Statute Is Not No Rules

PIPEDA continues to regulate personal information within its scope. Substantially similar provincial legislation affects which law governs intraprovincial activity, while PIPEDA can still govern commercial information flows across provincial or national borders. Public-sector regimes and sector-specific duties require their own analysis. AI does not create an exemption from these existing rules.

Professional obligations also remain. The Barreau du Québec's AI guide addresses responsible use, confidentiality and verification. A firm should consult its own regulator's guidance and the professional rules governing the proposed use.

An AI-related civil claim still requires its ordinary legal elements. Under art. 1457 CCQ, fault, injury and a causal link must be established where that regime applies. Producing a biased or incorrect output is not, without that analysis, automatic liability. The practical difficulty is identifying the applicable combination of rules, rather than assuming either that all AI is unregulated or that one checklist answers every regime.

Why Supacorp Was Built for This Mess

Supacorp is the entity-management product I am building for Canadian solo and small firms. Keeping the governing jurisdiction visible is a useful design aim for incorporations, registers, annual returns and client intake.

That aim does not mean all provincial duties apply to every private firm. A public-sector Ontario framework and a Quebec enterprise's privacy duties have different scopes. Record retention and audit requirements must be mapped to the actual information and governing rule, rather than inferred from a province label or a generic audit trail.

Any future federal AI law would need to be read alongside the constitutional and statutory framework then in force. Its relationship with provincial law cannot be decided before seeing the enacted text.

What to Watch Next

Track a proposal through Parliament, then check its commencement provisions and any necessary regulations. Follow published privacy decisions for the conduct and statutory provisions actually addressed. Ontario hiring disclosure should be applied within its established scope. Firms can improve their present controls without guessing the outcome of future legislation or litigation.