Alberta business owners and municipal staff have started asking us the same question in a few different ways: is there an actual law about AI in this province yet? The honest answer is no, not yet, but the pieces have been moving since 2024, and waiting for a bill to land before you write anything down is going to leave you scrambling.
Alberta's Personal Information Protection Act, known as PIPA, has been in force since 2004 and was due for a mandatory legislative review. In June 2024, Alberta's Information and Privacy Commissioner, Diane McLeod, submitted formal recommendations to the province's Standing Committee on Resource Stewardship as part of that review. Among them: rules specifically for automated decision-making, including a right for people to contest a decision an algorithm made about them, and stronger safeguards for the kind of sensitive data AI tools tend to collect along the way.
The Standing Committee finished its review and delivered 12 recommendations to the Legislative Assembly in February 2025. Then, in August 2025, the OIPC went further and published a report arguing Alberta should consider a standalone AI law alongside its modernized privacy legislation, one that would require plain-language explanations of how AI systems work, give the Commissioner authority to audit and even suspend harmful systems, and define categories like anonymized, synthetic and pseudonymized data so organizations can't dodge the rules by relabeling what they collect.
As of this summer, none of that is law. The provincial government ran a public engagement survey on PIPA reform in February 2026 and has been consulting with the OIPC through the spring, but no amendment bill has actually been introduced and no firm timeline has been announced. Realistically, reform lands sometime in 2026 or 2027. That gap between "the regulator has been asking for this since 2024" and "the legislature actually passes something" is exactly where most organizations stop paying attention, and it's exactly where we'd tell you to start.
Other provinces aren't waiting
While Alberta works through its review, other jurisdictions have already moved. Quebec's Law 25 has, for some time now, required organizations to disclose automated decision-making that has significant effects on a person and to give that person a way to request a human review. Ontario's rules under the Working for Workers Four Act took effect January 1 of this year: employers with 25 or more employees now have to state directly in public job postings if they're using AI to screen, assess or select applicants, using specific wording set out in the legislation itself. Neither law stops at a provincial border. A Quebec resident applying to a role posted by an Alberta business, or an Alberta employer posting a job nationally, can pull those obligations into play regardless of where head office sits. Federally, the picture is simpler for now: the Artificial Intelligence and Data Act died on the order paper when Parliament was prorogued in January 2025, and Ottawa's February 2026 national AI strategy consultations pointed toward regulating AI through existing privacy law rather than a dedicated AI statute, at least for the moment.
What to build before the law tells you to
Here's the thing that's easy to miss in all the legislative back-and-forth: every version of these rules, whether it's Quebec's law already on the books, Ontario's hiring disclosure, or what Alberta's Commissioner keeps asking for, is really asking the same three questions. Where does an AI tool touch a decision about a real person, can that person find out it happened, and can someone review it if they push back. If you can already answer those questions for every AI tool your organization uses, whether that's a chatbot triaging client intake, software scoring resumes, or an assistant helping review permit applications, you're most of the way to compliant no matter which version eventually becomes law.
For municipalities specifically, this maps onto work you're probably doing in some form already. If AI is touching access-to-information request processing, permit reviews or bylaw complaint triage, the plain-language explanation and human review path the OIPC keeps recommending is close to what a defensible administrative process should look like anyway. The gap is usually that nobody wrote it down. Keeping a short inventory of which AI tools are in use and what they touch, a plain-language description of what each one does and doesn't do, and a documented path for a person to request human review, turns your existing process into evidence of due diligence instead of a liability you discover during an access request or a complaint.
None of this is glamorous work. It's mostly documentation, and it's the kind of thing that's cheap to build now and expensive to reconstruct after a complaint, an access request or an incident forces the question. Alberta's rules aren't final yet, but the direction has been consistent since 2024, and the organizations that start the paper trail now won't be the ones scrambling when the bill finally drops.