CIPPIC’s Initial Analysis of Canada’s AI Strategy

Analysis: Canada's AI Strategy Compared to CIPPIC's

Canada’s new AI strategy, AI for All, gets important things right. It treats AI adoption as a national priority. It recognizes that trust, opportunity, and sovereignty belong in the core of a Canadian AI strategy. It invests in compute, skills, commercialization, health data, open-source AI, and Canadian capacity. Those are welcome commitments. They also mirror many of the policy positions CIPPIC called on the government to adopt in its submission to INDU and its submission to Canada’s AI strategy sprint consultation in the fall of 2025.

But the strategy remains legally thin. The government’s press release promises new legislation, investments, and programs. The strategy makes trust its “north star,” but the aspiration, funding, and voluntary frameworks promised by this strategy do not provide the grounding for trust. Trust requires law: enforceable rights, transparency obligations, meaningful privacy protection, and meaningful remedies when AI systems cause harm.

That is the core of CIPPIC’s position on AI regulation: Canada should govern AI through a risk-tiered, rights-based, and enforceable legal framework. The AI for All strategy moves in a positive direction on adoption, but misses the bigger opportunity: to make Canada a leader in trustworthy AI by grounding national adoption in rights, accountability, and the rule of law.

The Strategy notes that “the Government of Canada will continue to review and update this plan”; this signals that the strategy is designed to evolve. CIPPIC offers its recommendations as a contribution to the next iteration.

Recommendations

CIPPIC has performed an initial comparison of the Canada AI Strategy and the recommendations in the CIPPIC legislative brief submitted to the House of Commons, titled “Beyond Infrastructure: Toward a Framework for Rights-Based AI Regulation in Canada”. Checkmarks indicate if the item is mentioned.

1) How to Approach Canadian AI Legislation

✓  1.1. Legislate AI at the federal level

X  1.2. Align with the EU AI Act

X  1.3. Align with international standards and frameworks

X  1.4. Align trade agreements with public policy

X  1.5. Promote public trust through transparency, explainability, and public accountability (explainability not mentioned)

X  1.6. Create individual rights and redress, and civil liability for AI harms (liability not mentioned)

✓  1.7. Provide AI assurance and independent oversight

✓  1.8. Do not govern with a sole AI regulatory authority

X  1.9. Regulate public sector use of AI (mentions government use of AI but not regulations)

2) AI and Sovereignty

✓  2.1. Prioritize Canadian commercialization of AI innovation

✓  2.2. Establish Canadian data sovereignty

X  2.3. Promote Indigenous data sovereignty  (has mention of Indigenous leadership but does not mention OCAP or legal rights)

3) AI and the Rule of Law

X  3.1. Regulate the use of AI in law

✓  3.2. Regulate the use of AI in democracy

4) AI and Climate and Energy

X  4.1. Regulate the environmental impacts of AI  (mentions standards, not regulations. No mention of assessments)

✓  4.2. Invest in innovation that reduces the environmental impacts of AI

5) AI and Innovation

✓  5.1. Provide education and frameworks on using AI to boost productivity

✓  5.2. Stimulate domestic AI capacity

✓  5.3. Public procurement as an engine

✓  5.4. Encourage domestic AI models that are open rather than closed

X  5.5. Provide open funding calls for AI  (mentions funding but not whether it is open)

6) AI and Education/Workforce

✓  6.1. Build Canadian AI workforce capacity

✓  6.2. Introduce initiatives to attract foreign AI innovators

✓  6.3. Provide AI literacy training for each citizen

X  6.4. Address labour impacts of AI  (only mentions tracking labour impacts to guide policy decisions)

7) AI and Intellectual Property

X  7.1. Prohibit patent protection for purely AI-generated assets  (not mentioned)

X  7.2. Maintain copyright’s requirements for a human author  (not mentioned)

X  7.3. Create a formalized Text and Data Mining (TDM) exception to data mining (not mentioned)

8) AI and Privacy

✓  8.1. Address cybersecurity concerns  (sort of mentioned)

X  8.2. Comply with EU AI Act privacy standards

✓  8.3. Ensure users’ rights to privacy in AI data processing

Notes on Specific Areas

1) How to Approach Canadian AI Legislation

1.2 A missed opportunity on the EU model

The government has declined, at least for now, to take up the call for an AI regulatory approach inspired by the European Union’s AI Act. That is a missed opportunity. The EU chose the hard but necessary path: governing AI adoption through a rights-oriented and risk-based legal framework. The premise is sound: Canada should approach AI adoption with like-minded democratic partners around a common commitment to rights, accountability, and the rule of law. In a world increasingly shaped by power politics, Canada should help anchor a counterweight grounded in law.

1.9. Regulate public sector use of AI

The strategy's public sector AI commitments are mostly about adoption and service delivery efficiency, but not as much about the rights Canadians enjoy when government AI use affects them.

2) AI and Sovereignty:

2.3. Promote Indigenous data sovereignty

While the AI strategy mentions Indigenous leadership in AI, it does not mention OCAP principles (Ownership, Control, Access, and Possession) or legal rights surrounding Indigenous data sovereignty.

4) AI and Climate and Energy

4.1. Regulate the environmental impacts of AI

The AI strategy mentions standards but no regulations. There is also no mention of environmental assessments or prohibition on using the least environmentally friendly technology. More explicit engagement with doubling down on green in the AI Strategy would be better. Canada’s cold climate makes it uniquely situated to offer data centers in an environmentally responsible way. Yet regulations and transparency are needed to ensure this is the case.

Canada has 309 data centres operating already (The Logic). It has 5 hyperscale data centres and another 96 are in development (CBC). Various estimates value the Canadian data center market around $10B (CBRE); the government of Alberta has allocated $100B to data centres (MLT Aikins).

Some geographies seem not ready to enact laws regarding AI data centers, perhaps because they do not know enough about the technologies or what rules should apply. Instead, some have offered ‘soft law’ such as standards they hope companies will meet. In the meantime, real environmental harms are happening to citizens. While there will always be some growing pains with legislation, the government needs to impose some burdens. Otherwise, the freedom of the marketplace means that companies will do what they want.  Real harms require pause points. If regulations make things difficult for firms when they are creating harms and need to disclose information, to the extent that the regulation is requiring companies to pause, that’s good and is not a problem with the regulation but a sign that the regulation is working. Technology giants have shown that they will do everything they are not explicitly prohibited from doing, including in grey areas – so if the government sees harms, it needs to regulate them without delay. Other jurisdictions such as states and cities in the US have banned the development of new data centers. If the Canadian government does not understand the technology, it needs to build that knowledge capacity –immediately.

5) AI and Innovation

5.5. Provide open funding calls for AI

The strategy mentions funding, but not whether funding calls will be open. The document lists various companies and organizations, which is not something we have seen in other countries’ AI strategies and potentially reflects cherry-picking. It is important that funding and other AI opportunities are subject to open calls, rather than being closed and allocated to known firms. Canada has allowed tech giants to insulate themselves from competitive markets; we cannot repeat that and need to do everything we can to ensure the AI marketplace is open, competitive, and subject to the discipline of the market – not amenable to its capture.

7) AI and Intellectual Property

The strategy also sidesteps the intellectual property questions raised by AI. It does not address authorship, inventorship, text and data mining, training, or the legal treatment of AI-generated outputs. The government has effectively left these issues for courts to address. Courts can do some of that work, but litigation is no substitute for principled policy. Leaving the field to case-by-case development gives Canada uncertainty instead of the foundation for creativity and innovation that innovators, creators, educators, businesses, and users need.

8) AI and Privacy

While privacy is only one part of the AI governance challenge, the strategy’s commitment to renewed federal privacy legislation is nonetheless a welcome one. But privacy reform is arriving in an uncomfortable context: the government’s approach to privacy in Bill C-22. CIPPIC’s submission on C-22 warns that the bill lowers thresholds for state access to subscriber information, seriously understates the privacy implications of metadata, and builds a new lawful access architecture with profound implications for privacy and cybersecurity. We await the proposed successor to our federal private sector privacy law with anticipation – and some trepidation.

Conclusion

While Canada’s AI strategy offers a good start, much of what is listed is vague. It is important that the strategies are turned into regulations and incentives as quickly as possible. Still, there are significant gaps, mostly in the arena of rights. The strategy aligns with CIPPIC’s recommendations in several places, but it misses some. Enforcement mechanisms, legal architecture, and hard obligations are not present. The government is prioritizing adoption and infrastructure, not rights and legal architecture.

Canada has pioneered innovations in deep learning, yet the commercialization has happened elsewhere; the same is true for quantum computing, phosphate batteries, etc. The current moment in the AI industry resembles the early days of the internet: we are still going to see many opportunities for new, category-defining innovation. Canada should do a much better job at capturing those benefits rather than selling them off. Canada can draw on the commercialization and GDP-boosting lessons of programs like China's 'Made in China' (without following its problematic parts) as well as innovation programs in Nordic countries that have permitted the emergence and survival of domestic technology successes. This AI moment offers an opportunity for economic and technological growth while preserving and expanding rights for Canadian citizens. CIPPIC remains available to assist the government in this work.