No New AI Law Yet, but Canada’s Regulators Just Mapped Where Scrutiny Will Land

If you run a business in Canada and you use AI tools, you probably have a familiar worry. One regulator asks about privacy. Another asks about competition. A third asks about copyright. Each question sounds reasonable on its own, but together they can feel like four different rulebooks for the same product.

A new report does not solve that problem, but it does make it easier to see. On October 26, 2026, the Canadian Digital Regulators Forum published a stakeholder synthesis from a workshop it held in May 2026. Its message is plain: this is not a new law, not a set of enforcement plans, and not a consensus view. It is a map of the questions businesses kept hearing from different directions.

Who wrote the report, and why four regulators matter

The Canadian Digital Regulators Forum brings together four bodies with very different jobs: the Canadian Radio-television and Telecommunications Commission, Competition Bureau Canada, the Office of the Privacy Commissioner of Canada, and the Copyright Board of Canada. One oversees communications and broadcasting. One watches competition. One watches privacy. One deals with copyright.

That mix is the point. AI tools rarely sit neatly inside one mandate. A chatbot used for customer service can touch privacy, because it handles personal information. It can touch competition, because of how a market for AI services is structured. It can touch copyright, because of what it was trained on and what it produces. And if it runs inside a telecom network or a broadcast service, communications rules can come into play too.

The Forum says the May 2026 workshop was virtual, drew about 200 participants, and was organised into nine breakout sessions. Discussions were not recorded, and the published views are aggregated rather than presented as agreement. In plain terms, the report collects themes that came up, not votes that were taken. On October 29, the Forum also published a review of its third term and a preview of its fourth term, saying the workshop was one of its public priorities and that the group plans deeper working-level collaboration in its next term.

The pattern: the same questions, from different angles

In communications-focused discussions, participants raised cross-border data storage and access. They also said AI used in network operations and accessibility services still needs human oversight. If an automated system changes how a network runs, or how a person with a disability accesses a service, someone should be able to explain what happened, check it, and step in when needed.

In competition and privacy discussions, participants asked for clearer sector guidance on high-risk AI models. They also raised consent, privacy by design, vendor management, and cross-border data flows. A business that buys an AI tool cannot simply assume the vendor has handled privacy or risk. It needs to know what data the vendor sees, where that data goes, how long it is kept, and what happens when the contract ends.

For news, media, and creative work, the discussion was more specific. Participants raised AI training on copyrighted material, along with consent and compensation. They also raised the risk that AI-generated summaries or substitutes could weaken the ability of original publishers to earn money from their work. The report does not settle those copyright questions, and it does not propose a licensing model. It records that creators and publishers raised them, and that they remain open.

What the report does not do

It helps to be blunt about the limits here, because the limits are part of the story. The report does not establish regulator decisions. It does not show that most participants agreed on a position. It does not set enforcement plans. It does not create a new national AI law.

The report also sits alongside Canada's wider AI strategy. The Prime Minister's National Council on Artificial Intelligence, launched on October 2, 2026, gives advice on AI for All goals. It does not pass regulations, and a separate October 29 privacy regulators call on health AI is not a new law either.

A practical checklist, drawn from the report itself

If you want to turn the report into action, start with records you can reuse across several possible reviews. First, map where your data is stored and who can access it, including across borders. If you use a vendor, write down what that vendor can see and what controls you have in your contract. Second, name the human oversight points for any AI system that affects customers, staff, or public services. Who checks the output, how often, and what happens when the output looks wrong?

Third, keep consent and privacy by design notes in one place, so you can show how a product was built, not just how it works today. Fourth, for publishers and creative firms, keep clear terms on training, summaries, and compensation, so you can explain what you agreed to and what you did not. It is also worth asking a vendor direct questions before you sign: where is data processed, is it used to train models, can you turn that off, and what happens to data when you leave? If a vendor cannot answer, that is information too.

Frequently Asked Questions

Does the October 26 report create new AI rules in Canada?

No. The Canadian Digital Regulators Forum describes it as a stakeholder synthesis from a May 2026 workshop. It summarises themes from nine breakout sessions, it does not set regulator decisions, sector majorities, or enforcement plans.

Which regulators are part of the Canadian Digital Regulators Forum?

The Forum spans the Canadian Radio-television and Telecommunications Commission, Competition Bureau Canada, the Office of the Privacy Commissioner of Canada, and the Copyright Board of Canada. That mix is why the report covers communications, competition, privacy, and copyright in one document.

What should a small Canadian business do first after reading the report?

Start with reusable records: a data location and access map, named human oversight points, vendor management notes, and consent and privacy by design documentation. Those records would help across several possible reviews, without requiring you to guess which rule will arrive first.