AI Chatbot Compliance in Canada: What Applies to Your Business in 2026
Key takeaways
- Canada has no AI-specific law in force; Bill C-27 and its AI and Data Act died when Parliament was prorogued on January 6, 2025.
- Your chatbot is covered by privacy law today: PIPEDA federally, and PIPA in Alberta and British Columbia for activity within those provinces.
- Canadian data residency is not required by PIPEDA, but you must tell users if their data may be processed outside Canada.
- In Moffatt v. Air Canada, a BC tribunal held the company liable for its chatbot's wrong answer, so accuracy is a legal issue, not just a UX one.
- Bill C-36 and Bill C-34, tabled in June 2026, would add automated-decision and chatbot-safety duties if passed.
Adding an AI assistant to your website is easy. Knowing what Canadian law expects of it is harder, partly because the headlines about AI regulation keep changing. Here is what applies today and what to prepare for. This is a practical overview, not legal advice.
The short version: no AI act, but plenty of law
Canada's proposed Artificial Intelligence and Data Act was part of Bill C-27, which died on the order paper when Parliament was prorogued on January 6, 2025. As of September 2026 there is no federal AI-specific statute in force.
That does not mean chatbots are unregulated. A bot that collects names, emails or order details is processing personal information, and a bot that answers customer questions is making representations on your behalf. Both are covered by existing law.
PIPEDA compliance for website chatbots
For most private-sector businesses, PIPEDA is the baseline. Applied to a chatbot, PIPEDA compliance comes down to a few habits:
- Purpose and consent: tell users what the chat collects and why, in plain language, before or at the point of collection.
- Limit collection: don't ask for more than the conversation needs. A booking bot needs a name and time, not a date of birth.
- Safeguards: encrypt transcripts, restrict who can read them and set a retention period.
- Accountability for vendors: your AI provider is a service provider, and you remain responsible for what it does with your customers' data.
- Openness: update your privacy policy to cover the chatbot and any third-party AI services it uses.
Alberta and BC privacy laws
Alberta and British Columbia each have their own Personal Information Protection Act (PIPA). They are considered substantially similar to PIPEDA and generally govern organizations' activities within those provinces, while PIPEDA can still apply to cross-border activity.
If you serve customers in Calgary or Vancouver, the practical difference is small: the same consent, purpose and safeguard habits satisfy Alberta and BC privacy laws as well. The bigger point is that "which law applies" is rarely a reason to skip the basics.
Canadian data residency: required or not?
PIPEDA does not require personal information to stay in Canada. The Office of the Privacy Commissioner's guidance on cross-border processing instead expects transparency: tell users their information may be processed in another country and may be accessible to that country's authorities, and make sure the provider protects it to a comparable standard.
Canadian data residency can still be the right call. Some clients, sectors and public-sector contracts require it, and customers increasingly ask. When we build chatbots, we check whether the AI provider offers Canadian hosting, whether it trains on your conversations (it shouldn't), and which subprocessors touch the data.
Chatbot liability: lessons from Moffatt v. Air Canada
In Moffatt v. Air Canada (2024), Air Canada's website chatbot told a customer they could claim a bereavement fare after travelling. The airline's actual policy said otherwise. BC's Civil Resolution Tribunal found Air Canada liable for negligent misrepresentation and rejected the argument that the chatbot was responsible for its own words.
The lesson on chatbot liability is simple: your bot speaks for you. Design for it:
- Ground answers in approved content, such as your policies, pricing and FAQs, rather than the model's general knowledge
- Link to the source page for anything with money or rules attached
- Hand off to a person when the bot is unsure or the stakes are high
- Review transcripts regularly and fix wrong answers at the source
The difference between a scripted bot and an autonomous agent matters here too; see AI agent vs chatbot for how each handles these risks.
What's coming: Bill C-36 and Bill C-34
Two federal bills were tabled in June 2026. Neither is law, and both may change in committee.
Bill C-36: automated decisions and privacy reform
Bill C-36 would enact the Protecting Privacy and Consumer Data Act and replace Part 1 of PIPEDA. It would require notice when an automated decision system is used to make a prediction, recommendation or decision that could have a legal or similarly significant effect on someone, and a plain-language explanation on request.
Bill C-34: duties for chatbot services
Bill C-34, the proposed Digital Safety Act, would place safety duties on operators of public AI chatbot services, particularly those designed to simulate sustained human-like relationships. Whether a typical customer-service bot falls in scope will depend on the final text.
A compliance checklist for your chatbot
- Disclose that users are talking to an automated assistant
- Add a short privacy notice inside the chat window
- Collect only what the task needs
- Confirm your AI provider doesn't train on your data
- Document where data is stored and who processes it
- Set and enforce a transcript retention period
- Ground answers in approved content and test them before launch
- Provide an easy route to a human
- Keep an audit trail of what the bot said
Conclusion: build the habits now
The rules for AI chatbot compliance in Canada will tighten, but the direction is clear: transparency, accountability and accuracy. A bot built on those principles today won't need a rebuild when Bill C-36 or C-34 passes.
Our chatbot development service builds these safeguards in from day one. If you're planning a chatbot or worried about one you already run, book a review with our team and we'll assess it against this checklist.
Frequently asked questions
Is there an AI law in Canada in 2026?
Not a dedicated one. The proposed Artificial Intelligence and Data Act died with Bill C-27 in January 2025. Chatbots are governed by existing privacy, consumer protection and negligence law, and Bills C-36 and C-34, tabled in June 2026, would add new duties if passed.
Does my chatbot's data have to stay in Canada?
PIPEDA does not require it. It does require you to tell users when their information may be processed outside Canada and to ensure comparable protection. Some sectors, contracts and customers do require Canadian hosting, so check before choosing a provider.
Am I liable if my website chatbot gives a customer wrong information?
You can be. In Moffatt v. Air Canada, BC's Civil Resolution Tribunal held Air Canada liable for negligent misrepresentation after its chatbot gave incorrect fare information, and rejected the idea that the bot was responsible for itself.
Do I have to tell users they are talking to an AI?
There is no general federal disclosure rule in force yet, but disclosure is best practice. It also avoids misleading customers and prepares you for the transparency requirements proposed in Bills C-34 and C-36.
Vaibhav Malhotra
Founder, VMR Technologies
Vaibhav Malhotra is the founder of VMR Technologies, where he leads the team building custom websites, e-commerce platforms, and AI solutions for businesses across the Greater Toronto Area and beyond. He writes about practical software and AI strategy for non-technical decision-makers — focused on what actually drives results rather than hype.