Enterprise voice AI in Canada: PIPEDA, Quebec Law 25, OSFI B-13, and the bilingual reality
Canadian enterprise voice AI is shaped by four constraints: a federal-plus-provincial privacy patchwork led by PIPEDA and Quebec Law 25, OSFI B-13 for federally regulated financial institutions, CRTC rules on automated outbound, and the Official Languages Act obligation to deliver service parity in English and Canadian French. AIDA is not yet law in 2026 but procurement criteria already treat it as if it were.
Regulatory regimes that shape the deployment
- PIPEDA at the federal level, with Alberta PIPA and BC PIPA as substantially similar provincial regimes governing private-sector commercial activity
- Quebec Law 25 — GDPR-equivalent consent, privacy impact assessments, cross-border transfer notice, and explicit obligations on automated decision systems
- OSFI Guideline B-13 (technology and cyber risk) and B-10 (third-party risk) — federally regulated financial institutions must produce evidence of third-party risk assessment, resilience testing, and exit planning for voice AI vendors
- CRTC Unsolicited Telecommunications Rules and the National Do Not Call List — automated outbound dialling, caller ID, and callback number requirements; CASL for any SMS or email follow-up
- Official Languages Act — federally regulated industries (banking, telecom, transport, federal agencies) must offer service of equal quality in English and Canadian French
- Bill C-27 / AIDA — proposed Artificial Intelligence and Data Act establishing risk-tiered obligations for 'high-impact' AI; procurement is already pricing AIDA readiness in
- Provincial health privacy — Ontario PHIPA, Alberta HIA, and equivalents; Canada has no federal HIPAA-equivalent, so health-sector deployments are province-by-province
Market dynamics
- The big-five banks, the big-three carriers, and a small cluster of national insurers concentrate enterprise spend; federal and provincial government modernisation is the second wave
- Canada is a major bilingual nearshore CX delivery hub for the US — voice AI quality in Canadian French is a hard procurement criterion, not a stretch goal
- Quebec-resident data routinely triggers a dedicated deployment architecture (in-province processing, separated logging, French-first journey design)
- Per-minute pricing dominates inbound; per-resolution is gaining ground in financial services where success is well defined
Procurement notes
- Federal procurement runs through Public Services and Procurement Canada (PSPC) Standing Offers and Supply Arrangements (ProServices, TBIPS); Reliability or Secret security clearance is commonly required for personnel
- Quebec Law 25 obliges a privacy impact assessment before any cross-border transfer; the simpler path for many enterprises is in-country (often in-province) processing for the speech, model, and recording layers
- Bilingual evaluation must use Canadian French (not European French) and test code-switching — vendors trained on metropolitan French routinely underperform on québécois prosody and vocabulary
Frequently asked
Does Quebec Law 25 require in-province data residency?
Law 25 does not strictly require in-province residency, but it does require a documented privacy impact assessment before any cross-border transfer and explicit notice to the data subject. In practice, many enterprises default to in-Canada (and often in-province) processing because the assessment burden is lower than the cross-border one.
What does OSFI B-13 mean for voice AI procurement?
Federally regulated financial institutions treat voice AI as a high-risk third-party technology service. B-13 evidence — risk assessment, control mapping, resilience and recovery testing, sub-processor inventory, and a tested exit plan — is an RFP gate criterion, not a post-signature deliverable.
How strict is the bilingual service obligation?
Under the Official Languages Act, federally regulated entities must provide service of equal quality in English and French at all designated points of service. For voice AI that means the French journey is not a translation of the English one — it needs equivalent intent coverage, equivalent containment, and Canadian French voice and ASR quality.
Is AIDA in force in 2026?
As of mid-2026, AIDA is not yet in force — it remains part of Bill C-27. Procurement teams are nonetheless asking vendors to demonstrate risk-tiering, transparency, and human-oversight controls aligned with the proposed framework, because the political direction is settled even if the statutory text is not.
What are the CRTC rules for AI-driven outbound calls?
Automated outbound calls must comply with the Unsolicited Telecommunications Rules: caller identification, a working callback number, hours-of-day restrictions, and honouring the National Do Not Call List. Any SMS or email follow-up triggered by the voice interaction additionally falls under CASL consent rules.