Veille's coverage is built article by article, not by summarizing frameworks into checklists. Each obligation is mapped to a specific article, a specific penalty, and a specific set of conditions that determine compliance.
Frameworks
| Framework | Jurisdiction | Status | Key deadline | Obligations | Penalty |
|---|---|---|---|---|---|
| Law 25 Loi modernisant les dispositions législatives en matière de protection des renseignements personnels |
QC | In force | Sept. 2024 (fully) | 23 | $25M or 4% |
| OSFI E-23 Enterprise-Wide Model Risk Management Guideline |
Federal | Compliance: May 2027 | May 1, 2027 | 15 | Supervisory |
| EU AI Act Regulation (EU) 2024/1689 on Artificial Intelligence |
EU | In force (Annex III: 2 Dec 2027) | 2 Dec 2027 (Annex III, deferred from 2 Aug 2026, Digital Omnibus) | 10 | €35M or 7% |
| Bill 149 Working for Workers Four Act, 2024, ESA s. 8.4 (AI use in publicly advertised job postings) |
ON | In force | Jan. 1, 2026 | 1 | $100K |
| Bill 194 Strengthening Cyber Security and Building Trust in the Public Sector Act (obligations encoded as provisional drafts pending regulation) |
ON | Standards pending | TBD by regulation | 3 | TBD |
| TBS Directive Directive on Automated Decision-Making (Treasury Board of Canada) |
Federal | In force | In force since Apr. 2019 (full compliance Apr. 2020) | 8 | Administrative |
| AMF Québec Autorité des marchés financiers, Guideline on the Use of AI (Québec financial institutions). The provincial financial regulator, distinct from federal OSFI. |
QC | Effective May 1, 2027 | May 1, 2027 (guideline) | 8 | AMP up to $2M/day (Bill 92) |
| PIPEDA Personal Information Protection and Electronic Documents Act (federal private-sector privacy) |
CA | In force | In force | 13 | $100K (penal) |
| BC PIPA Personal Information Protection Act (British Columbia) |
BC | In force | In force | 12 | $100K (org.) |
| AB PIPA Personal Information Protection Act (Alberta), with mandatory breach notification |
AB | In force | In force | 11 | $100K (org.) |
| PHIPA Personal Health Information Protection Act, 2004 (Ontario health information) |
ON | In force | In force | 8 | $1M / $200K |
| OSFI B-13 Guideline B-13, Technology and Cyber Risk Management (federally regulated financial institutions) |
Federal | In force | In force | 8 | Supervisory |
| CSA / CIRO Canadian Securities Administrators and CIRO expectations on the use of AI by registrants |
CA | In force | In force | 12 | Disciplinary |
| ISED Code Voluntary Code of Conduct on Advanced Generative AI Systems (federal, voluntary) |
CA | In force (voluntary) | In force | 8 | Voluntary |
| Human Rights AI Canadian Human Rights Act and provincial codes applied to algorithmic discrimination |
CA | In force | In force | 6 | Orders + damages |
AMF Québec is fully encoded: its 8 obligations are anchored verbatim to the official AMF texts. The AMF guideline takes effect May 1, 2027, so those obligations are marked as effective on that date and do not count toward a system's current compliance score until then, the same way any not-yet-in-force obligation is treated.
Methodology
Map your obligations
Book a 30-minute call and we will map your AI systems to their applicable frameworks, so you know exactly what your compliance posture looks like before committing to anything.
Book a call →