Dr. Freddie Seba

AI Governance Keynote Speaker  ·  Author  ·  Scholar Operator

EdD · USF  ·  MBA · Yale  ·  MA · Stanford  · Teaching · UIC  ·  20+ years · Silicon Valley Founder & Global Executive · Digital Health · Fintech · Higher Ed.

Ungoverned | Canada AI Governance: The Failed Act and the Vacuum It Left

What happens when legislation fails — and the nation has to keep operating anyway?

By Dr. Freddie Seba

© 2026 Freddie Seba. All rights reserved.

A note on vantage point and expertise wanted

I write from Silicon Valley, not Parliament Hill. Canadian legal scholars, regulatory experts, policymakers, and those inside the governance institutions shaping how AI is regulated in Canada — this reading is for you first. Where the law or regulatory landscape has moved beyond what is reflected here, please flag it. Where institutional practice diverges from what is written, I want to know. The governance gap is real. Your expertise can pinpoint where it lies.

This series examines Canada not because Canada has solved AI governance, but because Canada’s governance vacuum reveals something every leader needs to understand — regardless of jurisdiction. AI is a global challenge. The models deployed in Toronto are trained on data from everywhere. The compute infrastructure is distributed. The vendors are multinational. When one jurisdiction fails to write binding rules, the consequence is not merely local.

That is why we study them all.

Question One: What was the framework designed to govern?

The Legislation That Died

On June 22, 2022, Canada introduced Bill C-27 with three components: a replacement for PIPEDA (the Consumer Privacy Protection Act), a data protection tribunal, and — in Part 3 — the Artificial Intelligence and Data Act (AIDA), which would have created the first comprehensive federal AI governance framework in North America.

On January 6, 2025, Parliament was prorogued, and Bill C-27 died on the Order Paper. It has not been reintroduced as of August 2026.

The new government has indicated AIDA will not return in its current form. The stated direction is toward a framework that is “light, tight, right.”

What Actually Governs AI in Canada Today

PIPEDA (Federally)

Canada’s existing private-sector privacy law applies to any organization that collects, uses, or discloses personal information in commercial activity in Canada. It governs personal data in AI systems, with particular relevance to model training data and purpose-limitation principles.

Québec Law 25 (Provincial)

Québec’s Law 25 is the most demanding AI-relevant framework currently in force in Canada. Fully implemented by September 2024, it carries penalties up to $25 million CAD and is actively enforced by the Commission d’accès à l’information du Québec (CAI). It requires disclosure of automated decision-making, privacy impact assessments before AI deployment, and explicit consent for biometric and sensitive personal data.

Bill C-8 (Critical Cyber Systems Protection Act)

In force June 15, 2026, this law imposes cybersecurity requirements on critical infrastructure operators and their suppliers. Vendors supplying AI systems to critical operators are now within scope.

ISED Voluntary Code of Conduct for Advanced Generative AI Systems

Increasingly cited in procurement and contracts, though not binding. Covers transparency, safety, human oversight, data governance, and bias mitigation.

Sector-Specific Guidance

OSFI (financial services), Health Canada (medical devices), Treasury Board (federal government). Provincial equivalents in Alberta and BC mirror PIPEDA but do not include Québec Law 25’s AI-specific requirements.

Question Two: The Governance Gap — What Falls Outside the Frame, and Where Leadership Begins

What the Frameworks Do Not Answer

When a comprehensive Canadian AI law eventually arrives, it will need to answer what current law does not:

  • Frontier model safety evaluation standards
  • Supply-chain liability allocation
  • High-risk AI classification criteria
  • Governance requirements for model developers
  • Cross-jurisdictional coordination with EU, China, and other regimes

What Organizations Are Subject To Now — But Often Don’t Know

PIPEDA Purpose Limitation: If personal data was collected for one purpose and is now used for AI model training, you need a documented legal basis for that repurposing. Most organizations have not addressed this question explicitly.

Québec Law 25 Automated Decisions: If you make decisions about individuals in Québec using AI primarily, you must disclose this, explain the logic, and provide a human-review mechanism. Organizations in Québec often underestimate which decisions trigger this obligation.

Supply Chain Liability Under C-8: Vendors to critical infrastructure operators are now in scope, even if they do not operate critical systems themselves.

Frontier Model Dependencies: Most organizations deploying frontier models have not documented what vendor policy changes, regulatory restrictions, or model updates would trigger internal governance review.

Where Leadership Begins

Only the institution can map exposure and build governance before writing rules. The federal government cannot — legislation is pending. The provinces cannot — coordination does not exist. The regulators cannot — they have no authority until legislation passes.

That is where leadership begins.

Question Three: What Does AI Governance as Leadership Look Like?

AI Is Already Inside Your Organization

The 12 Ps are not a gate you pass before adoption. Staff, clinicians, teachers, and analysts already use AI—often before any organizational policy exists. The 12 Ps are the architecture leaders use to govern what is already running.

The AI Minimum Viable Governance (AI-MVG) Framework for Canada

1. Institutional AI System Inventory

Document every AI system currently running: frontier models deployed directly, vendor-supplied AI embedded in existing software, features activated inside tools, datasets used for training, API integrations. For each, document what it does, what data it processes, who approved it, and when.

2. PIPEDA Data Repurposing Analysis

Identify personal data used for model training. Document whether the repurposing decision was explicitly addressed and whether you have documented legal basis for it.

3. Québec Law 25 Automated Decision Mapping (If Operating in Québec)

Identify every AI-driven decision about individuals. Document whether you disclosed the automated processing, can explain the logic, have a human-review mechanism, and retain documentation of all three.

4. Frontier Model Dependency Mapping

For each frontier model in your stack, document the vendor, hosting location, data processed, what vendor policy changes would trigger review, and whether regulatory changes in the vendor’s jurisdiction could constrain your use.

5. Supply Chain Liability Assessment (If Supplying Critical Infrastructure)

If you supply AI systems to finance, telecoms, energy, water, or transportation operators, document C-8 obligations and assign accountability for maintaining compliance.

6. Sector-Specific Requirements Audit

If regulated by OSFI, Health Canada, or Treasury Board, audit your AI systems against their respective guidance.

7. ISED Voluntary Code Alignment

Evaluate your AI governance against the ISED Code—document where you align and where you do not.

8. Named Executive Accountability

Assign a named leader accountable for AI governance outcomes — not adoption metrics. This person owns the inventory, PIPEDA assessments, Québec compliance (if applicable), frontier model monitoring, supply-chain obligations, and regulatory transition preparation.

9. Regulatory Monitoring and Change Management

Set up a process to track federal AI strategy announcements, ISED updates, Québec Law 25 enforcement, sector guidance changes, and regulatory actions.

10. Documentation and Evidence Building

Build the record now. Document deployment dates, governance in place at deployment, testing conducted, data used, human oversight mechanisms, and risk decisions made.

The 12 Ps Lens: Policy — the Tenth P

Your institution’s AI policy is the only governance that currently stands between innovation and consequences in Canada.

Write it to principles, not prescriptions, so it adapts as regulation evolves. Make it board-visible. Make it enforceable.

Across the 12 Ps:

Purpose, Problems, Profits — Document why you deploy each system, what failure modes you anticipated, and who gains and who bears risk.

People — Assign accountability now. Every Canadian mechanism resolves to a named human.

Planet, Process, Policy — Document energy assumptions, governance process, and internal policy. Make all three board-visible.

Protections, Privacy — Define protections beyond legal requirements. PIPEDA and Québec Law 25 are active, enforceable obligations — map them.

Provenance, Preparedness, Product Ownership — Document model provenance, readiness for vendor updates and regulatory changes, and assign a named leader answering for the whole.

What to Do This Month

  1. Inventory. Document every AI system currently running.
  2. PIPEDA audit. Identify personal data used for training. Document the repurposing decision.
  3. Québec audit (if applicable). Identify AI-driven decisions about individuals. Document disclosure, explanation, human review.
  4. Frontier model dependencies. What vendor changes trigger governance review?
  5. Name an owner. Assign a named leader accountable for AI governance.
  6. Track the transition. Set up monitoring for federal AI announcements, sector guidance, enforcement actions.

The federal framework will land eventually. When it does, it will judge systems already operating. A leader governs before that reckoning comes.

For Executive Briefings, Board Workshops, and Keynote Presentations

Contact Dr. Freddie Seba through freddieseba.com

About the Author

Dr. Freddie Seba helps boards, trustees, and executive leadership teams build practical AI governance before AI failures make governance unavoidable. Scholar-operator, Silicon Valley founder, and global executive — EdD, USF · MBA, Yale · MA, Stanford.

This analysis is part of Ungoverned: Applied Frameworks Under the Lens, a recurring miniseries applying the AI Minimum Viable Governance (AI-MVG) framework and the Seba 12 Ps of Responsible AI Oversight to organizations shaping AI governance globally.

Drafted with AI-assisted tools. Final editorial judgment and responsibility remain with the author.

This analysis is for informational and educational purposes only. It does not constitute legal, regulatory, or compliance advice. Institutions should consult qualified legal counsel regarding their specific obligations under applicable frameworks.

© 2026 Freddie Seba. All rights reserved.

References

Government & Legislative Sources

  • Parliament of Canada. (June 22, 2022). Bill C-27: Digital Charter Implementation Act, 2022. https://www.parl.ca/legisinfo/en/bill/44-1/c-27
  • Parliament of Canada. (2025). Bill C-8: Critical Cyber Systems Protection Act. In force June 15, 2026. https://www.parl.ca/legisinfo/en/bill/45-1/c-8
  • Government of Canada. (February 2026). National AI Strategy Consultation Summary. canada.ca
  • Innovation, Science and Economic Development Canada (ISED). Voluntary Code of Conduct for Advanced Generative AI Systems. ised-isde.canada.ca

Federal Privacy Law

  • Justice Canada. Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5. justice.gc.ca
  • Office of the Privacy Commissioner of Canada. Guidance on AI and Automated Decision-Making. opc.gc.ca

Québec Law 25

  • National Assembly of Québec. An Act to modernize legislative provisions as regards the protection of personal information (Law 25 / Loi 25 / Bill 64). legis.quebec.ca
  • Commission d’accès à l’information du Québec (CAI). cai.gouv.qc.ca

Sector-Specific Guidance

  • Office of the Superintendent of Financial Institutions (OSFI). Guideline E-23: Model Risk Management. osfi-bsif.gc.ca
  • Health Canada. Guidance on Artificial Intelligence for Medical Devices. canada.ca/health
  • Treasury Board Secretariat. Directive on Automated Decision-Making for Federal Government Systems. canada.ca/treasury-board

Analysis & Commentary

#AIGovernance #CanadaAI #AIMVG #AILeadership #Ungoverned #BoardGovernance #AIPolicy #CIO #PIPEDA #QuebecLaw25

Leave a Reply

Your email address will not be published. Required fields are marked *