Bill C-36 in Canada: What the Privacy Bill Means for Small Businesses Using AI

The short answer

Bill C-36, the proposed Protecting Privacy and Consumer Data Act, would replace the privacy part of PIPEDA and require businesses that use automated decision systems, including AI, to publish a general account of that use and to explain significant decisions on request. As of October 2026 it is still a bill: it was introduced at first reading on 15 June 2026 and has not passed, so nothing in it is law yet. This is general information, not legal advice.

What Bill C-36 is, and why it is the third try

Canada's federal private-sector privacy law, PIPEDA, dates from 2000. Ottawa has tried to replace it twice before, with Bill C-11 and then Bill C-27, which also contained a separate AI statute. Neither became law. Bill C-36 is the third attempt, and the government calls it the most significant change to private-sector privacy law in over 25 years in its backgrounder of 15 June 2026.

The big structural change is what is not in it. Unlike C-27, Bill C-36 does not include a standalone AI act. Instead, AI shows up inside the privacy law as rules on automated decision systems. Law firm Blakes describes the approach as less comprehensive than C-27 and limited to disclosure and transparency.

The AI parts of Bill C-36, in plain English

According to analyses by Gowling WLG and Blakes, the bill as tabled would do three things for AI users:

• Define automated decision systems broadly. Any technology that assists or replaces human judgment, from rules engines and regression models to machine learning and neural networks. A lead-scoring rule in your CRM could count, not just a large language model.
• Require a public "general account". If you use such systems to make predictions, recommendations or decisions that could have a legal or similarly significant effect on people, you would need to describe that use publicly, typically in your privacy materials.
• Give individuals a right to an explanation. On request, you would explain the decision: the personal information used, where it came from, and the principal factors. Gowling notes the person could also make representations to an employee able to review the decision.

Notice the threshold. Gowling reports the bill moves from C-27's "significant impact" wording to a "legal or similarly significant effect" test. A chatbot answering store hours is unlikely to meet it. An AI tool that declines a credit application, ranks job applicants or sets an individual's price may well.

The rest of the bill that will touch your AI tools

Most small businesses will feel C-36 through its general privacy rules more than its AI clauses. Several are directly relevant when you plug customer data into AI products:

Bill C-36 proposal	Why it matters for AI use
Mandatory privacy management program	You would need written policies covering how personal data flows into AI tools and vendors
Codified service-provider rules	AI vendors that process your customer data are service providers; contracts and safeguards matter
Privacy risk assessment before sending data outside Canada	Many AI tools process data in the US; you would assess and mitigate that first
Children's information treated as sensitive (under 18)	Higher care if your chatbot or app is used by minors
Rules for de-identified and anonymized data	Clearer conditions for using customer data to train or test models
Legitimate-interest exception, with a documented assessment	Some processing without consent, but not to influence a person's behaviour or decisions

The government also says the new regulator must consider the needs of small and medium-sized businesses and support proportionate compliance, including through codes of practice and certification.

Current status of Bill C-36

As of mid-October 2026, LEGISinfo records first reading in the House of Commons on 15 June 2026 and no completed stage after that. Parliament rose for the summer days later and resumed regular sittings on 21 September 2026. The bill still needs second reading, committee study, third reading and the full Senate process, and it can be amended along the way. No coming-into-force date has been announced; the government has said it will consult on the transition to the new regulator.

Enforcement is the reason to watch it. The bill would create a Digital Safety and Data Protection Commission with a Privacy and Consumer Data Commissioner who can issue binding orders. Proposed penalties reach the greater of $10 million or 3% of global revenue for administrative penalties, and $25 million or 5% for the most serious offences. Gowling also notes a private right of action, so individuals could sue for damages once a breach is established.

What a small business can sensibly do now

You do not need to comply with a bill. But most of what C-36 asks for is already good practice under PIPEDA, and Quebec businesses already face a similar rule on automated decisions (see our guide to Quebec Law 25 and automated decisions). Low-regret steps:

1. List every tool that makes or shapes decisions about people. Credit, hiring, pricing, eligibility, fraud flags, lead scoring.
2. Write a two-paragraph plain-language description of how you use those tools. That is roughly what a "general account" would look like.
3. Make sure you could explain one decision. Which data went in, where it came from, and the main factors. If your vendor cannot tell you, that is worth knowing now.
4. Review where your AI vendors process data, and whether contracts cover safeguards. Our guide to connecting AI to business data safely walks through the questions to ask.
5. Put it in an internal policy. A short AI acceptable-use policy covers most of this in one document.

Key takeaways

• Bill C-36 is a proposal. As of October 2026 it has passed first reading only.
• It drops C-27's separate AI act and instead adds transparency rules for automated decision systems.
• Decisions with a legal or similarly significant effect would need a public account and an explanation on request.
• Penalties and a private right of action make early preparation cheaper than late scrambling.

Frequently asked questions

Is Bill C-36 law in Canada?

No. As of October 2026 it has completed first reading in the House of Commons and still has to pass the rest of the House and Senate process and receive royal assent. PIPEDA continues to apply in the meantime.

Does Bill C-36 regulate AI like the EU AI Act?

Not in the same way. It has no risk tiers or product-safety style rules. It treats AI as one kind of automated decision system and focuses on transparency: a public account of use and explanations on request for significant decisions.

Would a small business chatbot be covered?

The general privacy rules would apply to any personal data the chatbot collects. The automated-decision rules would matter only if the bot makes or recommends decisions with a legal or similarly significant effect on someone, such as approving or refusing a service.

Sources

1. Backgrounder: Government of Canada introduces legislation to Protect Canadians' Privacy in the Digital Age — Innovation, Science and Economic Development Canada, 15 June 2026
2. C-36: An Act to enact the Protecting Privacy and Consumer Data Act — LEGISinfo, Parliament of Canada
3. PPCDA Explained: Canada's Bill C-36 Privacy Reform — Gowling WLG, 24 June 2026
4. Third Time's the Charm? Canada's Latest Approach to Reform the Federal Private-Sector Privacy Framework — Blakes, 24 June 2026
5. The Protecting Privacy and Consumer Data Act (Bill C-36): key obligations and enforcement overview — Osler, 29 June 2026

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our AI Agents & AI Solutions, crm development & integration, business process automation services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.