Artificial Intelligence and Data Act

Overview

The Artificial Intelligence and Data Act (AIDA) is a proposed Canadian federal law introduced in June 2022 as Part 3 of Bill C-27, the Digital Charter Implementation Act. AIDA would establish the first national framework in Canada for regulating artificial intelligence. Its stated goals are to ensure AI systems are designed, developed, and deployed in a way that mitigates risks of harm and bias, and to prohibit reckless and malicious uses of AI.

AIDA's status is important context: Bill C-27 did not pass before Parliament was prorogued and then dissolved, so the bill died on the order paper. It remains a significant and widely studied legislative model that may inform future Canadian AI law.

Who It Applies To

As drafted, AIDA would apply to persons who carry out regulated activities in the course of international or interprovincial trade and commerce, including designing, developing, making available, or managing the operation of AI systems. The strongest obligations would attach to high-impact systems, a category to be defined through regulation.

Key Requirements

The bill would require those responsible for high-impact AI systems to assess and mitigate risks of harm and biased output, monitor compliance with mitigation measures, keep records, and publish plain-language descriptions of the systems. It would create the office of an AI and Data Commissioner to support enforcement, and establish offences for knowingly using unlawfully obtained data to build AI or for deploying AI likely to cause serious harm.

Penalties for Non-Compliance

AIDA proposed substantial administrative monetary penalties and, for the most serious offences, fines of up to the greater of a fixed maximum or a percentage of global revenue, along with potential criminal liability. Because the bill was not enacted, these penalties are not currently in force.

How to Comply

Organizations operating in Canada should treat AIDA as a planning baseline. Establishing an AI governance program aligned with the NIST AI Risk Management Framework and ISO/IEC 42001, documenting risk and bias assessments for high-impact systems, maintaining records, and preparing transparency disclosures will position organizations well for AIDA or any successor legislation.