Governance, risk & compliance
Canadian provincial AI, deepfake and intimate image rules (tiers by province) Read 24 Oct 2026; several items not in force (see description)
One framework, one tier per jurisdiction, so a company picks the places it operates.
Canada has no federal AI act, and no province has a general AI statute for the private sector. What exists is narrower: public sector AI rules, automated decision notices, one hiring rule, and a fast-moving set of deepfake and intimate image laws.
Tier ALL (federal): Criminal Code s. 162.
1 as amended by the Protecting Victims Act (Bill C-16, S. C.
2026, c. 19, Royal Assent 18 June 2026; Justice Canada says most of it takes effect 18 July 2026): an AI-made image that is likely to be mistaken for a recording of an identifiable person now falls within the intimate image offences.
Tier ON: the Employment Standards Act job posting rule (in force 1 January 2026; employers with 25 or more employees must say whether AI screens, assesses or selects applicants). Ontario public sector AI is in ON_AI_PUBSEC.
Tier QC: Act respecting Access to documents held by public bodies s. 65.
2 (automated decisions by public bodies), the ministerial Statement of principles for responsible use of AI by public bodies (Arrete 2025-02, signed 3 December 2025), and the intimate image Act (S. Q.
2024, c. 37).
Private sector s. 12.
1 stays in QC_LAW25. Tier AB: the Artificial Intelligence Usage Policy (effective 1 May 2025) and Protection of Privacy Act s.
5(2)(d); the intimate image Act is reported not to reach deepfakes and reform was announced in March 2026 (no bill verified). Tier BC: the Policy on the use of generative AI and the Intimate Images Protection Act (altered images covered).
Tier MB: The Public Sector Artificial Intelligence and Cybersecurity Governance Act and the Business Practices Amendment Act on personalized algorithmic pricing, both enacted 1 June 2026 and NOT IN FORCE until proclaimed. Tier SK and tier ATL: advisory government guidance, the Newfoundland and Labrador policy (17 April 2025), the Nova Scotia Act (which does not cover altered images in its original text; a bill introduced on 11 September 2026 would broaden it, stage not verified), and unverified statutes.
Rows that are not in force have is_required off and say so. Not read: the Employment Standards Act section numbers, the Alberta statute text, New Brunswick, Prince Edward Island and Saskatchewan intimate image statutes, the Manitoba intimate image Act text, and Yukon, Northwest Territories and Nunavut.
The privacy commissioners’ nine principles for generative AI (7 December 2023) are guidance and are not repeated here. General information, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Canadian provincial AI, deepfake and intimate image rules (tiers by province) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Canada-wide (federal law) | Applies everywhere in Canada. Criminal Code intimate image offences as amended by the Protecting Victims Act, the privacy commissioners’ February 2026 joint statement on AI-generated imagery, and the federal bills that are not law. | — |
| Ontario | Employers with 25 or more employees that publicly advertise jobs in Ontario (Employment Standards Act, from 1 January 2026). Ontario public sector AI is in ON_AI_PUBSEC. No dedicated Ontario intimate image statute was identified. | — |
| Quebec | Public bodies (automated decision notice, ministerial AI principles) and anyone sharing intimate images, including altered ones. Private sector automated decisions are in QC_LAW25. | — |
| Alberta | Government of Alberta departments and agencies (AI Usage Policy), public bodies under the Protection of Privacy Act, and the intimate image Act and its announced reform. | — |
| British Columbia | BC Public Service staff (generative AI policy) and anyone who distributes or hosts intimate images, including altered images (Intimate Images Protection Act). | — |
| Manitoba | Prescribed public sector entities (Bill 51, not in force), online retailers using personalized algorithmic pricing (Bill 49, not in force) and intimate image law. Rows for the two 2026 Acts are not in force. | — |
| Saskatchewan | Government of Saskatchewan employees (generative AI guidelines, advisory) and the Saskatchewan intimate image provision as reported by secondary sources. | — |
| Atlantic provinces | Newfoundland and Labrador government departments (AI policy v1.0), the Nova Scotia Intimate Images and Cyber-protection Act, and notes on New Brunswick and Prince Edward Island, which were not verified. | — |
How Lavawall® helps you get to Canadian provincial AI, deepfake and intimate image rules (tiers by province) compliance
Most of Canadian provincial AI, deepfake and intimate image rules (tiers by province) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Canadian provincial AI, deepfake and intimate image rules (tiers by province), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Canadian provincial AI, deepfake and intimate image rules (tiers by province) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Canadian provincial AI, deepfake and intimate image rules (tiers by province) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Canadian provincial AI, deepfake and intimate image rules (tiers by province) Read 24 Oct 2026; several items not in force (see description)
- Category
- Regional
- Region
- Canada
- Levels
- 8 assessment tiers
All Canada frameworks and training →
Map this framework freeTalk to our team