If your organization is waiting for a standalone Canadian AI law before getting serious about AI governance, Bill C-36 is a reason to reconsider.
Introduced on June 15, 2026, Bill C-36, the Protecting Privacy and Consumer Data Act, would replace the private-sector privacy provisions of PIPEDA. It is privacy legislation, not an AI Act. But Ottawa describes privacy modernization as a cornerstone of its national AI strategy.
The implication for general counsel, privacy officers, CFOs and CEOs is straightforward: AI accountability is increasingly becoming a privacy and operational governance issue.
What Bill C-36 changes
The financial exposure is significant. The proposed legislation allows administrative penalties of up to the greater of $10 million or 3% of global revenue, while serious offences could attract fines of up to the greater of $25 million or 5% of global revenue. The Government of Canada’s Bill C-36 announcement also outlines stronger regulatory and enforcement powers.
For organizations using AI, two provisions deserve particular attention.
First, automated decisions. Where an automated system makes a prediction, recommendation or decision that could have a legal or similarly significant effect on an individual, Bill C-36 would give that person the right to request an explanation, including the personal information used and the principal factors behind the outcome.
Second, cross-border data. Organizations would need to assess privacy risks before transferring or disclosing personal information outside Canada and take reasonable measures to mitigate those risks.
That matters when AI tools process employee, customer or client information through cloud infrastructure and third-party providers.
As BLS discussed in Canada Now Has A Solid AI Readiness Strategy. Does Your Firm?, data sovereignty starts with knowing where your data is. Bill C-36 makes that knowledge increasingly important from a compliance perspective.
What should organizations do now?
Do not start with another policy. Start with visibility.
Inventory AI and automated systems. Identify systems across HR, finance, marketing, operations and customer functions that process personal information or influence decisions about individuals.
Map the data. Determine what information enters those systems, which vendors receive it, where it is processed and whether it leaves Canada.
Identify consequential decisions. If an automated system affects an employee, applicant or customer, ask whether your organization could explain that decision today.
Review vendors. Existing software may have acquired AI functionality after the original procurement review. Revisit data-processing terms, subprocessors and processing locations.
Assign accountability. Legal cannot govern AI alone. Privacy, IT, procurement and business leaders need clear responsibilities for approval, monitoring and documentation.
Bill C-36 may change before it passes. Those five actions still make sense.
The absence of a standalone AI Act does not mean Canadian organizations can wait. It means leadership needs to look at where AI accountability is actually emerging — and privacy law is now one of the most important places to look.
BLS Consulting helps organizations strengthen AI integration, risk management and compliance, legal operations, systems and processes so AI adoption is connected to practical business governance rather than treated as a standalone technology project.
