Ottawa legislates on privacy. Not on AI.

On 15 June 2026 the Government of Canada tabled Bill C-36, which would replace the Personal Information Protection and Electronic Documents Act. The text introduces the concept of an automated decision system, defined broadly enough to cover machine learning, predictive analytics and rules-based systems.

Two duties deserve compliance teams' attention. On request, an organization would have to provide a plain-language explanation of the prediction, recommendation or decision, and state which personal information was used. Where the decision carries a legal or similarly significant effect, the individual could also request human review.

The bill is not enacted. None of these duties is in force, and the real timetable will depend on passage and then on standing up the structures the text provides for. We track its progress and will encode its obligations only once they are enacted.

Neither the Autorité des marchés financiers nor the Office of the Superintendent of Financial Institutions amended its text in June. The AMF guideline on the use of artificial intelligence, published 7 April 2026, takes effect 1 May 2027. Guideline E-23 on model risk management, published 11 September 2025, takes effect the same day.

We flag it because the absence of news is itself information. Both texts are final and published. There is no consultation left to wait for, no draft left to comment on, and no reason left to defer reading them.

The Council of the European Union gave final approval to the Digital Omnibus on AI on 29 June 2026. The text defers the obligations applying to Annex III high-risk systems from 2 August 2026 to 2 December 2027.

What was not deferred matters more to most Canadian organizations. The Article 50 transparency obligations still apply on 2 August 2026, as do the governance and enforcement provisions. The deferral targets high risk, not transparency.