AI Regulation in Canada 2026: A Guide for Municipalities

If you work in a Canadian municipality — a small township, a mid-sized city, or a regional district — you have probably had some version of this conversation in the last six months: a staff member is using ChatGPT to draft council reports, a vendor is pitching an "AI-powered" permitting tool, and someone on council has asked whether the city has an AI policy. Usually the answer is "not yet," followed by a nervous pause.

Mid-2026 is the moment that pause stops being acceptable. Not because a single federal law is coming into force — it is not — but because the ground underneath municipal operations has shifted. Ottawa launched a national AI strategy in June. Provincial privacy regulators are actively investigating public-sector AI use. Insurers are asking about it in renewal questionnaires. Residents are filing access-to-information requests about algorithmic decision-making. And staff are already using these tools whether policy exists or not.

This guide is written for the people who actually have to answer for AI in a municipality: CAOs, clerks, IT directors, privacy officers, and the councillors who sit on governance committees. It walks through the federal picture (including the new AI for All strategy), the provincial landscape, what it means for local government, and a concrete 90-day plan you can start on Monday.

The federal picture: less than the headlines suggest

Canada does not have a comprehensive AI law in force in mid-2026. The Artificial Intelligence and Data Act (AIDA), tabled as part of Bill C-27, died on the Order Paper when Parliament was prorogued in early 2025 and has not been reintroduced in its original form. Any successor legislation is unlikely to bind municipalities directly in the first instance — AIDA was drafted around "high-impact" AI systems in trade and commerce, not local government service delivery.

AI for All: the June 2026 national strategy

On June 4, 2026, Prime Minister Carney and Minister Solomon launched AI for All: Canada's National Artificial Intelligence Strategy — a $2.3-billion package built on four pillars: protecting Canadians and safeguarding democracy, ensuring AI empowers Canadians, powering AI adoption for shared prosperity, and building the compute/data infrastructure to support all of it. It is a strategy, not a statute. It does not impose new obligations on municipalities. But it signals where federal funding, procurement guidance, and eventual legislation are heading — and it is the document your council will hear about in the news cycle. Two things matter for local government: the strategy commits to sector-specific adoption support (which will likely include public-sector streams) and it reaffirms that any future binding AI law will be built around the same responsible-use principles already in the federal Directive on Automated Decision-Making. Read the strategy so you can answer the question when it comes up; do not restructure your policy around it.

What else exists federally is softer, but not irrelevant:

• The Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems — signed by most large Canadian AI developers. It shapes what your vendors are (or are not) doing, even though it does not bind you.
• The Treasury Board Directive on Automated Decision-Making — binding on federal departments only, but the algorithmic impact assessment (AIA) tool it uses is the most-copied municipal AI risk template in Canada. If you adopt anything from Ottawa, adopt this.
• OSFI Guideline E-23 (model risk management) — banking-focused, but the governance pattern (inventory, tiering, validation, monitoring) translates cleanly to a small municipal AI program.

The practical read: do not wait for a federal AI Act. It is not the thing that will land on your desk first.

The provincial and territorial landscape

This is where the real mid-2026 obligations live. A quick tour of the provinces that matter most for municipal AI policy:

Ontario — Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act)

Bill 194 received Royal Assent in late 2024 and its AI-related provisions are being phased in through 2026. It applies to "public sector entities," which explicitly includes municipalities. The core obligations: publish an AI use framework, maintain accountability for AI systems used in public-facing decisions, and manage risks around specific prohibited or restricted uses. Regulations are still being finalized, but Ontario municipalities should assume that by end of 2026 they will need a documented AI framework and the ability to answer questions from the province about what systems they are running.

Quebec — Law 25 and the CAI's AI position

Quebec does not (yet) have a standalone AI law, but Law 25 — the province's overhauled privacy regime — is already the strictest AI-adjacent law in the country. It requires privacy impact assessments before any project involving personal information, imposes automated decision-making disclosure obligations, and gives residents the right to request human review of decisions made "exclusively" by automated systems. The Commission d'accès à l'information (CAI) has published guidance treating generative AI use as a regulated processing activity. For Quebec municipalities, Law 25 is the AI law in practice.

British Columbia, Alberta, and the rest

BC's Office of the Information and Privacy Commissioner has issued joint guidance (with federal and other provincial privacy commissioners) on generative AI in the public sector — worth reading regardless of province, because it is the clearest "what would a regulator expect" document available in Canadian French or English. Alberta's PIPA modernization is in consultation. The Atlantic provinces are largely relying on existing FOIPOP/ATIPP frameworks. The territories are watching. None of this replaces the need for a local policy — it just shapes what that policy has to cover.

What this actually means for municipalities

Strip away the acronyms and the practical situation is this: your municipality is already using AI (staff are using ChatGPT, your permitting vendor added an AI feature last quarter, your recreation software is doing predictive scheduling), and the accountability for that use rests with you regardless of whether federal legislation exists. Provincial law — especially privacy law — is what will drive complaints, orders, and reputational hits in mid-2026.

The gaps we see most often when reviewing municipal AI posture:

• No inventory. Nobody can name every AI system in use, so nobody can govern them.
• Shadow use. Staff are pasting resident data into consumer chatbots because the municipality never said what was allowed.
• Procurement silence. RFPs do not ask vendors whether their product uses AI, what training data was used, or how bias is tested.
• No incident path. When an AI-generated council report contains a hallucinated citation, there is no defined process for how to correct the public record.
• Training as a checkbox. A 30-minute lunch-and-learn is treated as "we did AI training."

The mid-2026 municipal AI policy checklist

You do not need a 40-page policy to be defensible in mid-2026. You need a short, council-approved document that covers seven areas. In order of urgency:

1. Acceptable use

A plain-language statement of what staff can and cannot do with AI tools. Which tools are approved (municipal Copilot, an enterprise ChatGPT tenant, a specific translation tool), what data classes are prohibited from being pasted into any AI (personal information, in-camera council material, active litigation, HR files), and what the default is for everything else ("if it is not on the approved list, ask IT before using it").

2. A live AI system inventory

A single spreadsheet — literally a spreadsheet is fine — listing every AI system in use, the department that owns it, what decisions it informs, whether personal information is involved, and when it was last reviewed. Update it quarterly. This one artifact does more for your defensibility than any policy paragraph.

3. Procurement language

Standard clauses added to every RFP and vendor contract: disclose whether AI/ML is used, describe training data provenance, describe bias testing, commit to notify the municipality of material model changes, and cooperate with any provincial privacy investigation. If your procurement team does not have this today, it is the single highest-leverage change you can make.

4. Public disclosure

Decide — and write down — when the municipality will tell residents that AI was used. A common threshold: any external communication generated "substantially" by AI is disclosed, and any decision that affects a resident's rights, benefits, or permits is disclosed with a human-review path. This is where Quebec's Law 25 pattern is worth copying nationally.

5. Bias and accuracy checks

For any AI system that informs decisions about residents (permitting triage, bylaw enforcement prioritization, hiring screens, benefit eligibility), require a documented accuracy and bias check before go-live and annually thereafter. Small municipalities can lean on vendor attestations plus a lightweight internal review; you do not need a data-science team to do this credibly.

6. Incident response

A named person, a defined 48-hour triage window, and a clear escalation path for AI-related incidents (a hallucinated report reaches council, a vendor's model starts producing biased outputs, a staff member leaks data into a public model). Fold this into your existing cyber incident plan — do not build a parallel process.

7. Training

Ninety minutes, once a year, for every staff member who touches AI tools. Cover: what the policy says, what personal information means in your jurisdiction, how to verify AI output, and how to report an incident. Track completion. This is the difference between "we had a policy" and "our staff knew the policy" when a regulator asks.

International context — because your vendors care

You are not writing your policy in a vacuum. The EU AI Act came into force in 2024 and its high-risk system obligations bite in 2026 — which means any European vendor selling into your municipality is being pushed to document their systems in a way that will spill over into Canadian contracts. US state laws (Colorado's AI Act, New York City's Local Law 144 on hiring tools, California's various AI disclosure rules) are shaping the same vendor practices. The practical effect: if you ask your vendors the right questions in procurement, they can usually already answer — because someone else made them build the answer.

What to do in the next 90 days

A realistic 90-day plan for a municipality starting from zero:

Days 1–14: Inventory and stop the bleeding

• Send a one-question survey to every department: "List every AI tool your team uses, whether officially or informally." Do not judge — you need the truth.
• Publish an interim staff notice: what is provisionally allowed, what is provisionally not, who to ask if unsure.
• Identify your policy owner (usually the CAO's office, the clerk, or IT — pick one).

Days 15–45: Draft the policy

• Adapt an existing template. The federal Directive on Automated Decision-Making, the CivicPlay.ai Responsible AI Governance Toolkit in the Got AI Policy Vault, or a peer municipality's published policy are all valid starting points.
• Circulate to legal, privacy, IT, HR, and one operational department (usually recreation or public works — they see AI use first).
• Add the seven checklist areas above. Cut anything that does not fit on ten pages.

Days 46–75: Council approval and procurement

• Take the policy to a governance or general committee, then council. Frame it as risk management, not innovation strategy.
• Update your standard procurement templates the same week the policy is approved. Do not let the two decouple.
• Publish the approved policy on your municipal website. This alone puts you ahead of most Canadian municipalities.

Days 76–90: Train and instrument

• Roll out the 90-minute training. Record completion.
• Stand up the AI registry spreadsheet with the inventory you collected in weeks 1–2.
• Schedule the first quarterly review — put it in a calendar, with a named owner. Governance that is not on a calendar does not happen.

Resources and further reading

Federal — Canada

Provincial

International reference points

On this site

Where Got AI Policy fits

Got AI Policy exists because there was no single place to see what Canadian governments — federal, provincial, and municipal — have actually published on AI. The tracker at gotaipolicy.ca shows the current posture of every jurisdiction we monitor, sourced and dated. It is free to browse. The Starter tier adds policy review, comparison, and export tools for people who need to move faster than "read every provincial guidance document yourself."

If you take one thing from this post, take this: mid-2026 is the moment municipal AI policy stops being optional. The regulators will not wait for you to be ready. Start with the seven-item checklist, the 90-day plan, and one honest inventory. Everything else follows.

Frequently asked questions

Is AIDA law yet?

As of mid-2026, the Artificial Intelligence and Data Act (AIDA) — introduced as part of Bill C-27 — is not in force. The bill did not receive Royal Assent before the last Parliament dissolved. Federal AI policy still leans on the Directive on Automated Decision-Making for federal institutions, and on sector regulators using existing statutes. Watch the tracker for updates when a successor bill is tabled.

Does my organization need an AI policy right now?

If staff are using AI tools — including free consumer chatbots — you already have de facto AI use. Even a short acceptable-use note is better than silence. Peer organizations in your sector have almost certainly published something you can adapt; start at /tracker and /grade before drafting from scratch.

How does Quebec's Law 25 change things for AI?

Law 25 doesn't regulate AI specifically, but its rules on automated decision-making, transparency, and privacy impact assessments apply to any AI system that processes personal information about Quebec residents. If you deploy AI that affects Quebecers, Law 25 obligations run in parallel with whatever AI-specific policy you write.

How often is the regulation tracker updated?

The tracker is refreshed whenever a bill status changes or a regulator publishes new guidance — typically several times a month. Provincial legislation events are logged separately so you can see when Ontario's Bill 194, Quebec's follow-on regulations, or federal committee activity moved.

Where should a small municipality or nonprofit start?

Skip the 30-page framework. Read the /tracker entries for two peer organizations, run a Trust Drill with staff, and publish a one-page acceptable-use note that says what tools are approved, what data cannot be pasted into them, and who to ask when unsure. That's a defensible starting position; iterate from there.