Our editorial team reviewed Statistics Canada’s July 2026 release of workplace AI data for March 2026, the federal backgrounder for Bill C-36, OSFI’s final Guideline E-23 and CanLII’s summary of Moffatt v. Air Canada.
Rather than an industry-wide or arbitrary AI use threshold, liability concerns focus on an organization’s specific use cases and the real-world consequences of those uses.
When can a business be held responsible when its AI gives bad advice to a customer, mismanages sensitive information, or produces negative real-world consequences?
In this article, we:
- summarize potential liability risks and implications of AI in several common sectors;
- outline a way of thinking about AI-related liability that can be tailored to your organization;
- review developments in AI-related law to watch in 2026, including Bill C-36, Moffatt v. Air Canada, and OSFI’s Guideline E-23; and
- list some of the information that insurers may request during the course of your application or renewal.
Which Canadian Industries Face Greater Potential AI Liability Risk?
AI use can create greater potential liability risk where it intersects with client-facing or customer-facing interactions, decisions about identifiable persons, confidential information, and professional advice.
Statistics Canada published workplace generative AI adoption data by industry for March 2026. The data does not provide a basis for a reliable national ranking of AI liability risk, and it reflects self-reported worker generative AI use, not legal claims or AI liability risk. However, it provides a sense of industries with significant workplace generative AI exposure, which can be weighed against risk factors like those above. This points to professional, scientific and technical services; financial and insurance activities; information and culture industries; education; public administration; and health care and social assistance as industries with potential areas of heightened concern.
How We Assessed AI Liability Risk
A useful AI risk screening should consider the specific artificial intelligence system, decision, data, and harm at issue.
| Risk signal | Question to test | Evidence to keep |
|---|---|---|
| Reach | How many people or transactions can the system affect? | Keep user counts, transaction logs and records of deployment scope. |
| Consequence | Can an output affect money, health, employment, housing, insurance or access to a service? | Use-case approval and impact assessment |
| Autonomy | Does a person review the output before action is taken? | Approval rules, overrides and escalation records |
| Data | Does the system process personal, confidential or copyrighted material? | Data map, basis for consent, data-retention schedule and vendor-contract language. |
| Detectability | How quickly would an error, bias or leak be found? | Testing results, monitoring thresholds and incident logs |
| Legal setting | Which privacy, consumer, professional or sector rules apply? | Legal review tied to each province and activity |
Where AI Liability Risk Is Concentrated
| Industry group | 2026 exposure signal | Liability focus and useful control |
|---|---|---|
| Professional, scientific and technical services | 65.6% of workers reported workplace generative-AI use | Liability issues are concentrated around advice, confidentiality, and IP. Seek professional sign-off and verify sources. |
| Finance, insurance, real estate and leasing | 59.2% | Maintain human oversight of AI decisions, keep a list of models in use, and test results relating to pricing, eligibility and financial choices. |
| Education | 53.0% | As this involves the data of minors, it is particularly important that data collection is kept to a minimum. Leave room for assessment by an accountable educator. |
| Public administration | 44.9% | Keep records of administrative decisions and the reasons and authority behind them. Decisions about access to services should include an avenue for human review. |
| Information, culture and recreation | 44.0% | Liability risk is concentrated in AI-generated content relating to defamation, IP rights and factual accuracy. Effective controls include editorial review and provenance tracking. |
| Health care and social assistance | 27.7% | Potential liability includes patient harm and mishandling or exposure of sensitive health data. Use of approved tools should be highly controlled, with appropriate clinical oversight. |
Percent of workers aged 15 to 69, excluding some populations per Statistics Canada, who used generative AI in the last 12 months
Caution: Surveys on AI adoption in businesses ask different populations different questions; do not compare worker generative AI usage with adoption in businesses.
What The Air Canada Chatbot Decision Actually Shows
Moffatt v. Air Canada concerned incorrect chatbot information about bereavement fares. The tribunal held the airline responsible for the information it provided.
The decision is a useful reminder to review customer-facing AI content, but it does not establish a general rule for every AI-related claim.
Read More: Review the Broader Cyber-Security Threats Facing Canadians
The 2026 Federal And Financial-Regulatory Picture
Bill C-27, including the Artificial Intelligence and Data Act (AIDA), did not become law. Parliament is currently considering a new bill on consumer data and privacy, Bill C-36. As introduced, the new bill would require more transparency around the use of automated decision systems. Until further developments, businesses should continue to ensure their AI use cases align with applicable legislation.
Canada’s federal financial regulator, the Office of the Superintendent of Financial Institutions (OSFI), has published its final Guideline E-23 on enterprise-wide management of financial models. It requires federally regulated financial institutions to identify models and manage model risk using a risk-based approach, including validation, monitoring and governance.
Although it does not legally apply to provincially regulated financial institutions and non-financial businesses, other organizations may still find it useful to benchmark their model governance and related controls against Guideline E-23. The guideline’s compliance date is May 1, 2027.
Which Provincial Laws May Also Apply?
Keep in mind, however, that privacy and consumer protection laws and regulations vary by province. For example, some provinces, including Quebec, Alberta, and British Columbia, have their own private-sector privacy laws. If your system will be used in more than one province, you may need to develop different approaches in relation to providing notice, obtaining consent, explaining decisions and dealing with complaints. As a result, this overview of Canadian law cannot substitute for legal advice. Always seek legal advice on your specific situation.
AI Risk Controls Canadian Businesses Should Document
Canadian businesses that use AI should document controls directly related to the system. For example, it is helpful to prepare a brief AI use register that identifies each material AI system, its owner, its business purpose, who uses it, inputs, vendors, affected individuals, documented limitations, oversight arrangements and circumstances under which the system will be switched off.
Canadian businesses should also consider mapping reasonably foreseeable claims to their insurance policies before renewals, noting that a single AI use case may attract different types of loss. For example, a privacy breach may release confidential information, an erroneous professional deliverable may raise professional-liability concerns, false advertising may create advertising-liability issues, and hiring decisions may raise employment and labour issues.
| Question for your broker or insurer | Why it matters |
|---|---|
| Which policies could respond to each named AI use case? | A single use case could trigger more than one type of coverage. |
| Do technology, professional-services, media or data exclusions apply? | Identifies possible coverage gaps. |
| Does vendor-caused loss or contractual indemnity change the response? | Third-party tools can complicate responsibility. |
| What notice is required after an error or suspected incident? | Late notice can complicate a claim. |
| What controls or records will underwriting ask to see? | Helps prepare renewal information. |
Read More: Use the Small-Business Data-Breach Prevention Guide