Skip to main content

Built by a dual Canadian–American citizen. EEA data routed through Canada. Solo founder, replies may run slow.

Canadian AI and automated-decision posture

PIPEDA · Quebec Law 25 · Accessible Canada Act · Published July 26, 2026

Status: our own good-faith assessment, published for transparency. Not legal advice, not a certification, and not reviewed by independent Canadian counsel. Open questions are marked pending counsel rather than answered.

1. Canada has no in-force federal AI statute

We start here because it is the fact most often got wrong. The Artificial Intelligence and Data Act (AIDA), introduced as part of Bill C-27, died on the order paper when Parliament was prorogued in January 2025, and has not been reintroduced. There is currently no comprehensive federal AI law in force in Canada.

We will not claim compliance with a statute that does not exist. If federal AI legislation is introduced and passed, we will assess against the text as enacted and update this page.

2. What does apply

  • PIPEDA governs our handling of personal information in the course of commercial activity. Our practices are described in the Privacy Policy.
  • Quebec Law 25 carries the most demanding automated-decision requirements in Canada: a right to be informed when a decision is based exclusively on automated processing of personal information, and a right to request human review.
  • Ontario Bill 194 and sectoral guidance apply to particular contexts and are monitored rather than assumed away.
  • Treasury Board Directive on Automated Decision-Making applies to federal government systems. It does not bind us today, and we note it because it would become directly relevant if a Canadian public body were ever to deploy this product.
  • Accessible Canada Act, with SOR/2025-255 adopting CAN/ASC-EN 301 549, registered December 5, 2025, with obligations phasing in through December 2027 and December 2028. This is the accessibility standard our own product is built to help organisations meet.

3. Why Law 25’s automated-decision right is largely not engaged by our findings

Law 25’s automated-decision provisions attach to decisions based on personal information. Our assessments are run against publicly reachable business web pages: a checkout flow, a policy page, a product page. The subject of an assessment is a website, not a person, and the output is advisory rather than a decision that determines anyone’s rights or access to a service.

On our reading, the automated-decision provisions are therefore not engaged by the scan output itself. They remain fully relevant to the personal information we hold as a business, such as account and contact data, and we honour access, correction, and deletion rights for that data regardless of which province you are in. Pending counsel.

4. Canadian data routing

API traffic originating in the EEA is routed through Canadian infrastructure. Canada holds an adequacy recognition from the European Commission under GDPR Article 45, which is why this route exists. Requests handled this way carry an X-GDPR-Route: CA response header. Where the origin of a request cannot be determined, it is routed to the Canadian path rather than away from it, so an unknown case fails toward the more protective option.

5. Standing commitments

  • Scanning reads publicly reachable pages only, non-invasively, and honours robot exclusion signals.
  • Findings report observable status. They do not offer an opinion on the operator of a page.
  • Where the system cannot see something, it says so rather than inferring a result.
  • AI-assisted output is labelled as such. See our EU AI Act transparency disclosure for the full description of where AI is used.

6. Contact

Questions, including from the Office of the Privacy Commissioner of Canada or the Commission d’accès à l’information du Québec, go to chris@smartertariff.com. Renew EcoMe LLC, Cape Elizabeth, Maine, USA. Sole member: Christopher M. Edwards, a dual Canadian and United States citizen.