Skip to content
AI Compliance Tool
Check my AI risk
PlatformSolutionsPricingRegulationsFree toolsGuides Partners Sign in

The EU AI Act for Canadian Companies

When a Canadian business falls under the EU AI Act, the difference between provider and deployer, the risk tiers, the post-Omnibus timeline, and practical next steps.

By AI Compliance Tool editorial team · Published 2026-10-14 · Reviewed 2026-10-14 · Reviewer: Pending independent review · 10 min read

Key takeaways

  • A Canadian company is in scope if it places an AI system or general-purpose model on the EU market, has a deployer entity established in the EU, or uses an AI system whose output is used in the EU.
  • Since 2 August 2026 the general obligations apply, including the Art. 50 transparency duties. Prohibitions and AI-literacy duties have applied since 2 February 2025 and GPAI model duties since 2 August 2025.
  • The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) moved Annex III high-risk obligations to 2 December 2027 and Annex I product-embedded obligations to 2 August 2028.
  • Canada has no federal AI statute. Bill C-27 (AIDA) died on 6 January 2025 and Bill C-36 (introduced 15 June 2026) is a privacy bill that is not in force, so EU obligations do not map onto any equivalent Canadian AI law.

Canadian businesses tend to assume the EU AI Act is a European problem. For many it is not. The Act reaches outside the EU in three specific ways, and since 2 August 2026 its general obligations have been in force. This guide explains when a Canadian company is caught, what role it plays, which obligations apply and when, and what remains genuinely uncertain.

When a Canadian company is in scope

Regulation (EU) 2024/1689 applies to:

  1. Providers placing AI systems or general-purpose AI models on the EU market, wherever they are established. A Toronto company selling an AI-powered recruiting tool to a Dutch customer is a provider placing a system on the EU market.
  2. Deployers established in the EU. If your Canadian group has an Irish subsidiary or a German branch that uses AI in its operations, that entity is an EU deployer.
  3. Providers and deployers outside the EU where the output of the AI system is used in the EU. A Vancouver firm that runs a credit-scoring model in Canada and sends the scores to an EU lender is caught even though the processing happens in Canada.

What does not put you in scope: having EU website visitors who never interact with an AI system, using an EU-hosted cloud provider, or using a general-purpose model developed by an EU company for purely Canadian purposes.

Example. Harbourview Hiring Inc., a fictional Halifax SaaS company, sells a resume-ranking tool. It has customers in Canada, the US and Ireland. Because it places the tool on the EU market, Harbourview is a provider under the Act. Employment and recruitment uses are high-risk under Annex III point 4, so Harbourview’s high-risk provider obligations will apply from 2 December 2027. Its support chatbot, which Irish users talk to, is already subject to the Art. 50(1) disclosure duty.

Provider or deployer: why the label matters

RoleYou are this if you…Main obligations
ProviderDevelop an AI system or GPAI model (or have one developed) and place it on the market or put it into service under your own name or trademarkRisk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), logging capability (Art. 12), instructions for use (Art. 13), human-oversight design (Art. 14), accuracy and robustness (Art. 15) for high-risk systems; Art. 50(1)-(2) transparency design; Art. 53 for GPAI models
DeployerUse an AI system under your own authority in the course of businessUse per instructions and assign trained human oversight (Art. 26(1)-(2), (4)); monitor, report serious incidents and keep logs at least six months (Art. 26(5)-(6)); inform workers (Art. 26(7)) and affected persons (Art. 26(11)); FRIA for certain deployers (Art. 27); Art. 50(3)-(4) disclosures
BothBuild one system and use anotherSeparate obligations per system

Most Canadian SMBs are deployers of vendor tools. Companies that build or heavily customize models, or that white-label a vendor’s model under their own brand, should assume they may be providers and get advice.

The risk tiers

  • Prohibited practices (Art. 5), applying since 2 February 2025: manipulative or deceptive techniques causing significant harm, exploiting vulnerabilities, social scoring, certain predictive policing, untargeted facial-image scraping, emotion recognition in workplaces and schools (with safety and medical exceptions), and certain biometric uses. From 2 December 2026 the Omnibus adds prohibitions on nudification apps and synthetic child sexual abuse material.
  • High-risk systems: Annex III use cases (including employment, recruitment and worker management, credit, education, biometrics, critical infrastructure and law enforcement) and Annex I product-embedded systems. Obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
  • Transparency-risk systems (Art. 50), applying since 2 August 2026: chatbots must disclose that the user is interacting with AI; generative systems must mark synthetic output in a machine-readable way; deepfakes and AI-generated public-interest text must be disclosed; emotion-recognition and biometric-categorisation deployers must notify exposed people.
  • General-purpose AI models (Art. 53, Art. 55 for systemic-risk models), applying since 2 August 2025: documentation, downstream information, copyright policy and a training-content summary.
  • Everything else: no specific obligations beyond the AI-literacy duty (Art. 4), which applies to all providers and deployers since 2 February 2025.

The post-Omnibus timeline

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and rewrote the application dates in Art. 113. The current timeline is:

DateWhat appliesStatus on 14 October 2026
1 August 2024Act entered into forcePast
2 February 2025Art. 4 AI literacy; Art. 5 prohibitionsIn force
2 August 2025GPAI model obligations (Chapter V); governance; penalties frameworkIn force
27 July 2026Omnibus in force; new Arts. 102-110 applyIn force
2 August 2026General date of application, including Art. 50 transparency and Art. 99/101 penalty enforcementIn force
2 December 2026New Art. 5 prohibitions (nudification, synthetic CSAM); end of grace period for Art. 50(2) marking on generative systems already on the market before 2 August 2026Upcoming
2 December 2027High-risk obligations for Annex III systemsUpcoming
2 August 2028High-risk obligations for Annex I product-embedded systemsUpcoming

The Omnibus also replaced Art. 4 with softer wording: providers and deployers must “take measures to support the development of AI literacy” of staff and others operating AI on their behalf, and the text states this does not require guaranteeing any specific literacy level for any individual. You still need a training plan and records; you do not need to certify every employee.

Practical steps for a Canadian business

  1. Inventory every AI system and note the EU touchpoint. For each system record whether it is sold into the EU, used by an EU entity, or produces output used in the EU. Systems with no EU touchpoint are out of scope for the Act (but not for Canadian law).
  2. Assign a role per system. Provider, deployer or both. Write down why.
  3. Screen against Art. 5 now. Prohibitions have applied since February 2025. Emotion recognition in the workplace is the one SMBs most often stumble into through “sentiment” features in meeting or call tools.
  4. Fix Art. 50 transparency now. If you provide a chatbot used in the EU, make sure users are told they are talking to AI, or document why it is obvious in context. If you provide a generative system, confirm machine-readable marking; legacy systems have until 2 December 2026.
  5. Deliver AI literacy and keep records. A short role-based session and an attendance log satisfy the evidence need.
  6. Classify high-risk candidates and start a readiness plan. For Annex III systems you have until 2 December 2027. Providers should begin the Art. 9-15 documentation; deployers should plan oversight assignments, log retention of at least six months, worker notification and, where Art. 27 applies, a fundamental rights impact assessment.
  7. If you are a GPAI model provider, act immediately. Art. 53 duties have applied since 2 August 2025.
  8. Check GDPR in parallel. If EU personal data is involved, Art. 22 (solely automated decisions), Art. 35 (DPIA) and Arts. 13-14 (logic transparency) apply regardless of the AI Act’s dates.

How this sits alongside Canadian law

There is no Canadian equivalent to the EU AI Act. Bill C-27, which contained the Artificial Intelligence and Data Act, died on the Order Paper when Parliament was prorogued on 6 January 2025. Bill C-36, introduced on 15 June 2026, would modernize private-sector privacy law and, per the government’s news release, require transparency about automated decision-making for significant decisions; it has not progressed beyond first reading and imposes no obligations.

Your binding Canadian duties come from privacy law: PIPEDA’s appropriate-purposes, consent, safeguards and openness principles; Quebec’s P-39.1 as amended by Law 25 (privacy impact assessments under s. 3.3, profiling notice under s. 8.1, automated-decision notice under s. 12.1); and Alberta and BC PIPA. Ontario’s ESA s. 8.4 requires AI disclosure in public job postings for employers with 25 or more employees. Building your EU program on the same inventory and risk records you use for Canadian privacy compliance avoids duplicated effort.

What remains uncertain

Be honest with your board about open points:

  • Penalty detail. Our verified dataset could not read the Omnibus amendments to Art. 99 in full, and Member-State penalty rules vary. Do not quote fine levels without checking the consolidated text.
  • Art. 26(11) wording. The duty to inform natural persons subject to Annex III decisions was verified in summary but not in full text post-Omnibus.
  • “Obviousness” under Art. 50(1). The exception for interactions where AI use is obvious to a reasonably well-informed person is context-dependent. Document your assessment if you rely on it.
  • Standards and guidance. Harmonized standards and Commission guidance for high-risk systems are still developing. A program aligned with ISO/IEC 42001 or the NIST AI RMF is a sensible organizing structure, but neither is a conformity assessment and neither equals compliance.
  • Future Canadian legislation. Monitor Bill C-36 and any successor AI bill; do not cite AIDA as a current requirement.

Nothing in this guide is legal advice. Use it to structure the questions you take to counsel.

Sources

Frequently asked

We are a Canadian SaaS company with EU customers but no EU office. Are we in scope?
Very likely yes. The Act applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers outside the EU where the system's output is used in the EU. Having no EU office does not take you out of scope.
Are we a provider or a deployer?
If you develop an AI system (or have one developed) and place it on the market or put it into service under your own name, you are a provider. If you use an AI system under your authority in your own business, you are a deployer. Many companies are both for different systems.
Does the EU AI Act apply to our Canadian-only HR screening tool?
Not if the system is not placed on the EU market and its output is not used in the EU. It would still be subject to Canadian rules such as Ontario ESA s. 8.4 and Quebec Law 25 s. 12.1 where those apply.
What is still uncertain?
Our verified dataset could not read the full Omnibus amendments to Art. 99 (penalties) and the full text of Art. 26(11), and Member-State penalty rules vary. Treat those points as open and confirm with EU counsel before relying on them.

This guide is general information, not legal advice. Laws and dates are drawn from our verified regulatory dataset and link to official sources; check them for changes after the review date.