United Kingdom vs Canada

Dimension

United Kingdom

Canada

Status

In Effect (no dedicated AI Act)

No federal AI Act (AIDA lapsed)

Max penalty

Up to GBP £17.5M or 4% of global turnover (ICO, under UK GDPR/DPA 2018)

No federal AI-specific penalty; Quebec Law 25 up to CAD $25M or 4% of global turnover

Key deadline

Rolling implementation

Federal AI bill lapsed; Treasury Board Directive legacy-system compliance by June 24, 2026

# of instruments

4

4

Headline rule

Pro-innovation AI regulation framework (2023 White Paper)

PIPEDA — Personal Information Protection and Electronic Documents Act

What it requires

The UK has deliberately not enacted an EU-style AI Act. Instead, five non-statutory principles are applied by existing sector regulators — the ICO for data protection, the FCA for financial services, Ofcom for online safety. The AI Security Institute (renamed from the AI Safety Institute in February 2025) oversees frontier-model risk, and the Data (Use and Access) Act 2025 reformed the rules on automated decision-making. A comprehensive government AI Bill has been signalled for 2026 but is not yet before Parliament.

Contrary to common reporting, Canada has no enacted federal AI statute — Bill C-27, which contained the Artificial Intelligence and Data Act (AIDA), died when Parliament was prorogued in January 2025 and has no successor as of 2026. AI is governed indirectly through PIPEDA (federal privacy law), the Treasury Board Directive on Automated Decision-Making (which requires federal agencies to run algorithmic impact assessments), and provincial laws such as Quebec's Law 25, which requires disclosure of automated decisions, an explanation of the logic, and a right to human review.