Toward a Framework for Rights-Based AI Regulation in Canada

CIPPIC has submitted a legislative brief to the Standing Committee on Industry and Technology (INDU) Study on Opportunities, Risks, and Regulation of AI in Canada’s Strategic Industries.

Artificial intelligence presents Canada with a genuine strategic opportunity - and a real accountability crisis. Canada has world-class AI research talent, established institutions, and a rights-centred legal tradition. What Canada lacks is an AI legal framework that reflects our strongest traditions: rights, accountability, and the rule of law.

Legal certainty is an economic asset. Canada’s trading partners are offering their citizens and industry that certainty. Canada should as well. With dozens of jurisdictions globally - including the European Union, China, and other key trading partners - actively implementing formal AI frameworks, Canada’s legislative delay increasingly isolates our domestic tech sector. Reactive, voluntary frameworks create public anxiety, increase legal uncertainty for businesses, and stall commercialization. These frameworks also fail to protect Charter rights from algorithmic harms in sectors such as security, health, and immigration. 

 A General Overview of How to Approach Canadian AI Legislation

1. Legislate AI at the federal level - There is a need for federal legislation versus a patchwork of provincial laws that would be difficult for companies in the AI space to follow. In areas of federal jurisdiction, Canada should have federal legislation for AI.

2. Align with the EU AI Act - Canada should consider adopting the regulatory model of the EU AI Act and complying with its provisions. While AIDA, the Artificial Intelligence and Data Act, represented an important first attempt at federal AI legislation, its definitions, governance structure, and enforcement model attracted substantial criticism. Future legislation should build on lessons learned rather than reintroducing.

Canada should adopt a risk-based framework inspired by the EU AI Act while ensuring compliance obligations remain proportionate for open-source development. Canada should have a risk classification matrix of harms as the EU does but grounded in Canadian legal traditions and the public interest. Different AI systems have various levels of risk and require differentiated treatment.

The EU AI Act’s regulatory approach imposes positive obligations on its member states regarding the importing and usage of AI. This approach differs from those in the US and China. The US has taken a deregulatory approach, focusing on innovation and not constraining early development; yet there is a patchwork of state laws with varying levels of obligation. China employs a state-led, centralized, vertically integrated, and action-oriented governance model, in contrast to the fragmented approach of the US.

3. Align with international standards and frameworks - Canada should comply with internationally recognized AI standards and frameworks such as the OECD AI principles, NIST AI Risk Management Framework, UN principles for AI, ISO AI risk management standard, and ISO AI impact assessment. The EU AI Act largely complies with these standards and frameworks. Complying with them signals internationally that the country intends to respect responsible AI use and reduces risk for companies and consumers.

4. Promote public trust through transparency, explainability, and public accountability - There is a need for transparency and enforcement. Canada should create AI safety evaluations, AI transparency legislation, public reporting obligations, model and dataset disclosures, and notice requirements for when AI is used in significant decisions. Reporting requirements must address the “black box” barrier of AI, including a requirement for companies to disclose policies on user account bans or police reporting. This could help prevent further incidents such as the OpenAI / Tumbler Ridge incident.

5. Create individual rights and redress, and civil liability for AI harms - AI regulation should be grounded in human rights rather than just commercial law. Canada’s AI legislation should address the rights citizens have when an AI system harms them or makes a consequential decision about them, which entities are liable, and what meaningful redress includes. Canada should introduce rights-based AI regulations like those in the EU, including algorithmic transparency requirements, and data localization for sensitive sectors - as well as provisions regarding bias, discrimination, and youth. High-risk AI must respect fundamental rights. Regulatory tools can help achieve this, including mandatory impact assessments, human review rights, restrictions on automated decisions, protections for vulnerable groups, and safeguards in government use.

6. Provide AI assurance and independent oversight - Canada’s AI legislation should be insulated from industry lobbying and develop in an independent and transparent legislative process, and mandate public-interest oversight, transparent audits, complaint mechanisms, and regulatory accountability.

Beyond static, pre-deployment Algorithmic Impact Assessments (AIAs), Canada must mandate a "Run-Time Layer of Control" for AI systems deployed in safety-critical strategic sectors, such as energy grids, telecommunications, and healthcare. Unlike traditional software, physical AI systems learn and adapt post-deployment, creating lifecycle risks that static checks cannot mitigate. A run-time layer acts as a technical "kill switch," continually observing system behaviour and intervening in real-time if an agent initiates unauthorized processes or evades human instructions.

7. Do not govern with a sole AI regulatory authority - Similar to how Canada does not have a single internet regulatory authority, Canada should not have one AI regulatory authority. AI affects different sectors, so government departments and regulators must possess AI capacity relevant to their jurisdictions. For example, the government must support the Office of the Privacy Commissioner of Canada in its need to develop capacity related to AI’s implications for privacy rights.

8. Regulate public sector use of AI - Canada’s AI legislation must address the rights Canadians have when a federal or provincial AI system makes or informs a decision affecting them, e.g., when the government uses AI in immigration, tax assessment, benefits, policing, or border services. There are structural issues with the Directive on Automated Decision-Making, which Canada has had since 2019 and requires federal institutions to complete Algorithmic Impact Assessments before deploying automated decision systems, with explanation and human review rights scaling with impact level. It applies only to the federal public service; compliance is self-assessed with no audit or enforcement; its impact level thresholds predate generative AI and no longer reflect actual risk; and individuals have no private right of enforcement when departments fail to comply. Canada's AI legislation should convert the Directive principles into statutory rights applying across sectors - mandatory Algorithmic Impact Assessments, explanation and human review rights, independent audit authority, and a private right of action. It should also resonate with Charter values. Procedural fairness, the right to reasons, and judicial review must apply (as appropriate to the import of the decision) to government AI systems, which do not map cleanly onto doctrines designed for human decision-makers.

Recommendations on Specific Areas Relating to AI

In the report, there are sections that address specific areas relating to AI, including AI and Sovereignty, AI and the Rule of Law, AI and Climate and Energy, AI and Innovation, AI and Education/Workforce, AI and Intellectual Property, and AI and Privacy. Below are two sample recommendations from the AI and Innovation, and AI and Climate and Energy sections. You can access the full list of recommendations in the report.

9. Prioritize Canadian commercialization of AI innovation - Create a publicly owned national compute utility, tying public funding to IP retention within Canada. Canada has been a pioneer in AI research, but commercialization of Canadian AI technology has largely happened in the US and elsewhere. The government needs to ensure that Canada’s AI innovations boost Canada’s GDP. Canada should look to stimulate the creation of domestic AI companies instead of becoming a regional market for large US AI companies. Contributing factors include talent education, attraction, and retention; IP development; private/VC funding; access to compute resources, etc.

10. Regulate the environmental impacts of AI - AI poses meaningful climate harms that worsen climate change. Climate harms at scale undermine the economy. In Ireland, data centers already consume 20% of electricity (Wired).  Canada should implement a meaningful carbon price (widely considered the most effective climate change solution), require the disclosure of AI use and environmental impacts (California has introduced legislation along these lines), regulate AI-related emissions and resource use, promote energy efficiency, stimulate renewables, and prevent AI greenwashing (Turliuk & Sterman). Algorithmic Impact Assessments should include a mandatory Environmental Footprint Assessment (measuring compute efficiency, projected water utilization, and grid load) before a large or high-impact system can be cleared for procurement or high-risk commercial deployment. Other jurisdictions have a right to a healthy environment in their constitutions and Canada should consider the same.

Conclusion

Canada is at an important moment. The country that produced foundational AI research, that trained much of the world's AI talent, and that was first to propose a national AI strategy now risks being the last among its peers to translate those advantages into a coherent legal framework. The cost of delay is the accumulation of harms without recourse, the erosion of public trust, the flight of innovation to jurisdictions with clearer rules, and the potential loss of Canada's adequacy status under European privacy law.

Canada's AI future will be shaped by the choices Parliament makes, or fails to make, in the coming years. CIPPIC urges this Committee to recommend legislation that makes Canada not merely a participant in the global AI economy, but a model for how democratic societies can govern it.