Procurement In The Age Of AI: The Legal Architecture Of AI Procurement

Traditional procurement contracts assume technology behaves in a predictable manner and clear lines of accountability but artificial intelligence (AI) systems, particularly those using machine learning, introduce elements of unpredictability. Challenges arise where legal frameworks are not designed with AI systems in mind, yet they are now being applied to govern the development, deployment, and use of AI. As organisations adopt AI tools, lawyers advising on AI procurement must navigate a complex intersection of contractual clauses related to intellectual property (IP), data governance and privacy, liability, and regulatory compliance. Users of AI systems require clarity on ownership of IP, including both inputs into the AI system and outputs generated, and restrictions on the vendor’s use of user-provided data. Existing IP doctrines do not neatly address AI generated content, making it essential to define those rights in the AI contract. Additionally, data protection and privacy add another layer of complexity to the procurement of AI systems. Those systems often rely on large datasets, some of which may include personal or sensitive information. Lawyers must ensure that procurement contracts incorporate robust data handling provisions, compliance with applicable privacy laws, and clear responsibilities for breach notification of AI vendors.

Further, liability remains one of the most contested and negotiated areas when procuring an AI system. Where an AI system has the potential to harm or produce erroneous results, determining fault can be difficult. Does the liability lie with the AI vendor or a user that may have inputted erroneous data precipitating a harmful output? Procurement contracts need to include indemnities, representations/warranties, and limitations of liability that reflect the unique risks posed by the specific AI system.

Finally, emerging regulatory frameworks, such as risk based AI governance regimes in the European Union, are beginning to impose new compliance obligations on both vendors and users of AI systems. Together, these considerations underscore the need for careful, forward looking legal analysis when procuring AI systems in an era where traditional legal principles are being tested by the unprecedented technological change brought forward by AI.

Introduction

Artificial intelligence (AI) is rapidly evolving and is increasingly being integrated into the operational infrastructure of both public and private organizations. Procurement exercises for AI systems do not fit neatly within established procurement practices for traditional software, which were not designed with AI in mind. Unlike conventional software, many AI systems exhibit adaptive or opaque behaviours that challenge assumptions underpinning long‑standing legal procurement practices. Applying legal frameworks to AI systems that learn from data, evolve over time, and may produce unpredictable results requires a more nuanced and anticipatory approach than those used for traditional technology contracting. Lawyers advising on the acquisition of AI systems for businesses must now navigate a contracting environment in which familiar doctrines continue to apply, but often in ways that require careful reinterpretation and application.

The procurement phase of an AI system is a critical point for legal risk allocation. It is the moment at which organisations have the opportunity to secure transparency from vendors, define rights in data and outputs, and ensure that the AI systems being adopted are capable of meeting emerging regulatory standards, whether by including mandatory customer legal requirements or even more preferable, including customer-favorable AI contracts. This article examines the four (4) primary legal factors that lawyers must consider when procuring AI systems: (A) intellectual property; (B) data governance and privacy; (C) liability; and (D) regulatory compliance. Together, these sections illustrate that the procurement of AI systems is not simply a matter of updating standard technology contracts. The procurement of an AI system requires a deliberate and forward‑looking legal strategy, one that recognises the distinctive characteristics of AI and equips organisations to adopt these systems responsibly within a rapidly evolving legal environment.

A. Intellectual Property

Traditional IP law is built on human creation, static works, and clear lines of authorship. The core challenge of procuring an AI system is that AI disrupts the traditional legal IP framework in several ways: outputs from an AI system may be generated autonomously without human creative input; AI models evolve over time, making it difficult to identify a single moment of creation; and multiple parties may contribute to training, fine-tuning and deploying an AI system. 

Assessing IP ownership during the procurement of an AI system is often the point at which foundational issues related to inputs to, and outputs of, the AI system emerge. IP considerations sit at the centre of procuring an AI system because they ultimately determine who controls the most valuable assets associated with the AI system, including the data inputs that may train the system, the AI model itself, and the outputs generated. Due to the fact that traditional intellectual property doctrines offer limited clarity on these issues, procurement is therefore the primary mechanism for allocating rights and managing associated risks with the use of an AI system. It is within this contractual space that the practical implications of AI’s technical architecture begin to materialize, making IP an essential starting point when procuring an AI system.

Uncertainty surrounding the ownership and control of IP generated by AI systems makes it essential for organisations to address these issues expressly at the procurement stage. Traditional IP doctrines offer limited guidance when applied to AI systems that learn from data and generate outputs autonomously. As a result, procurement contracts increasingly serve as the primary mechanism for defining rights in inputs, outputs, and the AI system itself. Clear ownership and licensing terms are necessary not only to establish who may use, reproduce, or commercialize the AI system and its outputs, but also to determine whether improvements or derivative works created during the contract term belong to the vendor, the end user, or both.

Data use provisions also require particular attention, given the central role of data in training and operating an AI system. Vendors often seek broad rights to use customer data for model improvement, development, or other commercial purposes, while users may expect strict limitations on customer data to protect confidentiality, competitive interests, and regulatory compliance. The AI contract must therefore articulate, with precision, the scope of permissible data use, including any restrictions on a vendor’s use of user data or system outputs. These provisions should also address whether the customer retains rights to access or retrieve data after contract termination, a point that becomes critical when AI systems rely on proprietary datasets.

Beyond data use, organisations must further consider the extent to which they require rights to retrain, fine tune, or adapt the AI system. Many AI systems are delivered as closed, vendor controlled models, limiting the user’s ability to modify or audit the system. Where operational needs or regulatory obligations demand greater control, procurement contracts must secure rights to access relevant model components, documentation, and technical information. It is also prudent to negotiate appropriate vendor obligations with respect to transparency of the AI system as transparency has become increasingly necessary to support internal risk assessments, compliance with emerging AI governance regimes, and internal accountability frameworks.

Finally, IP indemnities are a critical issue in AI procurement. Given the complex layering of proprietary and third party components typical within AI systems, the risk of infringement claims is non trivial. Vendors should be required to indemnify users against third party claims arising from the use of the AI system, including claims related to training data, embedded software, and outputs generated. Drafting robust vendor indemnification provisions will help ensure that organisations are not exposed to unforeseen legal liabilities arising from components of an AI system over which they have no control.

Taken together, these considerations demonstrate that IP is the structural foundation on which the contractual relationship between a user and an AI vendor rest. The value of, and risk associated with an AI system depends on whether rights in data, models, outputs, and improvements have been allocated with clarity and precision. In a landscape where existing IP doctrines offer limited certainty, the AI contract must operate as the primary source of an organization’s legal rights to define ownership, constrain vendor conduct, and safeguard an organisation’s ability to use and rely on an AI system over time. By addressing these issues expressly at the procurement stage, organisations can mitigate legal risk and ensure that the adoption of an AI system aligns with both operational business needs and evolving regulatory expectations. In an era of rapid technological change, such deliberate contractual structuring is not optional; it is essential to responsible AI deployment.

B. Data Governance and Privacy

We now turn to data governance and privacy, areas that often determine whether an AI system can be lawfully deployed. As many AI tools depend on robust datasets, including those containing personal or sensitive information, the AI contract increasingly serves as the primary vehicle for allocating risk and responsibilities around data handling, security, and compliance with privacy laws. The legal questions here are not merely operational - they go to the heart of regulatory risk and organisational accountability, making data governance an essential component of any procurement strategy for an AI system.

A primary concern in AI procurement arises from the handling of input data information supplied by the user to the AI system during deployment. This data often includes personal information (otherwise called personal data or personally identifiable information, depending on the jurisdiction), commercially sensitive material, or other proprietary information, making compliance with privacy laws and internal governance policies essential. Jurisdiction-specific privacy statues, including the United Kingdom’s General Data Protection Regulation ¹and Data Protection Act 2018 ²and Canada’s Personal Information Protection and Electronic Documents Act ³, will shape how legal practitioners approach the procurement of AI systems. Both domestic and international legal privacy laws will impose varying obligations on organisations to ensure that any processing of personal information through an AI system complies with express legal obligations including those governing consent, data minimization principles, and cross-border transfers. The AI contract must therefore establish that the procuring organisation retains unequivocal control of input data, and that the vendor’s processing activities are strictly limited to the specific purposes for which the data is provided. Principles of data minimisation should be embedded contractually, restricting vendors from collecting or accessing information beyond what is necessary for system functionality. Cross border data transfer provisions must also be addressed, particularly where data localisation requirements or international transfer restrictions apply. Organisations should also work to ensure during the procurement process that vendors are expressly prohibited from using input data for model training, product development, or any other secondary commercial purpose unless the organisation has provided informed and express consent.

A second critical concern related to the procurement of an AI system is the composition of data, including both the training data used to develop the AI system and the legal status of the outputs the system generates. Because training data forms the foundation of an AI system, procurement documentation should expressly require prospective vendors to disclose the origin of data used to train the AI system, specifically whether the training data is licensed, publicly available, user generated, or otherwise proprietary to the vendor. This type of disclosure is essential to allow an organisation to assess the AI system’s privacy compliance and for allocating risk appropriately. Organisations must also understand any limitations on downstream use of training data to the extent that it is embedded in or influences system outputs, as well as the ownership and permitted uses of those outputs. Without such clarity, an organisation procuring an AI system may inadvertently assume liability for the vendor’s use of unlawfully obtained training data, potentially exposing an organisation to regulatory penalties, litigation, and reputational harm.

Privacy laws also generally require the implementation of appropriate technical, physical, and organisational safeguards when processing personal information. To the extent that the procuring organisation will be inputting personal information into the AI system, procurement documentation must ensure that vendors maintain security measures commensurate with the sensitivity of the data involved, including encryption of data both at rest and in transit, robust access controls, and ongoing monitoring for vulnerabilities. Equally important are the vendor’s data retention and deletion policies, which must align with jurisdiction specific legal requirements, sector specific retention obligations, and the procuring organisation’s internal policies. Clear contractual commitments regarding retention periods, deletion timelines, and post termination data handling are essential to ensuring compliance and maintaining control over personal and sensitive information throughout the lifecycle of the AI system.

These considerations illustrate that data governance and privacy are not ancillary issues in AI procurement but core determinants of legal compliance, operational integrity, and risk exposure. The origin of training data, the handling of user provided inputs, and the safeguards governing processing, storage, and deletion, each carry distinct regulatory and contractual implications that cannot be left to assumption or vendor defined practices. By addressing these matters expressly at the procurement stage through detailed disclosures, precise limitations on data use, and robust security obligations, organisations can ensure that an AI system operates within applicable laws and aligns with internal governance expectations. In an environment where regulatory scrutiny of AI is intensifying, such proactive contractual negotiation during procurement is essential for an organisation to maintain control over its data and to mitigate the legal and reputational risks inherent in the use of data driven AI technology.

C. Liability

Liability has emerged as one of the most complex and heavily negotiated aspects of AI procurement. Historically, liability frameworks applicable to software have assumed reasonably predictable software behaviour while accounting for certain inaccuracies and errors. This assumption is further strained when dealing with AI systems that are capable of producing unexpected, biased, or outright ‘hallucinated’ results. Unlike traditional software, AI systems introduce unpredictability that can complicate the allocation of responsibility when things go wrong. When an AI system produces erroneous outputs, causes bias or operational disruption, or contributes to harm, determining fault is rarely straightforward. Because the law has not yet fully adapted to these realities, contracts remain the primary mechanism for allocating risk. Lawyers advising clients must therefore craft liability provisions that reflect the unique risks posed by AI technologies. Four areas are particularly critical: contractual risk allocation, liability caps, indemnification, and vendor representations/warranties.

Contractual risk allocation remains the cornerstone of any AI agreement, but the assumptions that underpin traditional software contracting do not hold when dealing with technology that learns and is unpredictable. Conventional contracts presume stable performance of technology, which enables parties to assign responsibility with relative confidence. AI systems disrupt these assumptions by introducing model performance risk, where outputs may be inaccurate, biased, or inconsistent, and data related risk, where the quality of user provided inputs directly affects the behaviour of the AI system. AI procurements should outline, with precision, which party bears responsibility for harms arising from model limitations, training data deficiencies, or user generated data errors. Without explicit allocation, customers may find themselves exposed to liability for outcomes they neither intended nor could reasonably foresee.

Liability caps present a second critical area of negotiation. Many AI vendors initially propose contractual frameworks that significantly limit or even exclude vendor liability for harms arising from performance and customers’ use of the AI system, as well as for any outputs derived from such systems, despite the potential for AI driven errors to have significant consequences. Procuring organisations must push back against vendor-favourable terms and negotiate liability caps that reflect the actual risk associated with using an AI system. It is standard practice to seek higher ‘super-caps’ for breaches involving IP infringement, confidentiality/security/data breaches, compliance with applicable law (including privacy law), and instances of gross negligence or wilful misconduct. These carve outs are particularly important in the AI context, where misuse of data or infringement of training materials embedded in user-owned outputs have the potential to generate high impact harm that far exceeds the baseline limits typically proposed by vendors.

Indemnification provisions (which should be subject to the higher liability super-caps) are also essential, serving as a key mechanism for protecting the procuring organisation from third party claims arising from the vendor’s conduct (or misconduct) or the AI system’s underlying IP. AI systems introduce new categories of potential claims, including those related to data misuse, algorithmic bias, discriminatory outcomes, IP infringement, and regulatory non compliance. AI contracts should therefore include robust indemnities covering data/cyber related claims, infringement arising from training data or model components, violations of applicable AI or privacy regulations, and harms linked to biased or discriminatory outputs. It is also critical that indemnification provisions go beyond what is currently required from a legal perspective and anticipate the emerging AI regulatory environment in the applicable jurisdictions. These provisions ensure that an organisation procuring an AI system is not left bearing the consequences of risks that originate from the vendor’s development practices or the nature of the AI system itself.

Finally, robust representations and warranties play a critical role in establishing baseline assurances regarding the quality, functionality, and compliance of the AI system. While it appears that many AI vendors are now shying away from including these provisions in their standard contracts, procuring organizations can require these in their procurement documents to ensure they are included in their implementations. While traditional software warranties focus on uptime, performance, and conformity with documentation (which still remain important considerations), AI systems require more nuanced and specific commitments from a vendor. AI vendors are expected to provide accuracy and performance warranties that reflect the system’s intended use, as well as warranties regarding the legality and source of training data and having the ongoing necessary rights and underlying licenses to provide the system as intended for use by the customer. Non infringement warranties are also particularly important given the uncertainty surrounding the use of copyrighted or proprietary data in model training. Together, negotiating robust warranties at the procurement stage will help ensure that the procuring organisation receives an AI system that performs as represented, complies with applicable laws, and does not expose the organisation to avoidable legal or operational risks.

Liability in the context of AI procurement cannot be managed through traditional contracting assumptions or boilerplate provisions. The unpredictability of model behaviour, the complexity of training data, and the heightened regulatory scrutiny surrounding AI systems all require a more deliberate and granular approach to allocating risk which ideally should be dealt with in advance of awarding the deal to the particular AI vendor. Robust contractual risk allocation mechanisms, commercially reasonable liability caps, comprehensive indemnities, and tailored warranties operate collectively to ensure that organisations are not left bearing disproportionate exposure for harms originating in the vendor’s technology or development practices. By addressing these issues expressly at the procurement stage, organisations can better safeguard themselves against financial, operational, and regulatory consequences while ensuring that the adoption of AI systems remains both legally defensible and commercially viable.

D. Regulatory Compliance

The allocation of liability cannot be considered in isolation from the broader regulatory environment in which AI systems now operate. Evolving legal frameworks are reshaping expectations around transparency, monitoring, and risk-allocation mechanisms of AI systems to manage regulatory uncertainty. At the forefront of AI regulation is the European Union’s Artificial Intelligence Act ⁴ (EU AI Act) and the accompanying model contractual clauses, which are reshaping how organisations approach the procurement of AI technologies worldwide. This final section discusses procurement of AI systems within the evolving regulatory landscape and considers how organisations can ensure that the systems they acquire remain compliant as legal standards continue to develop.

When negotiating a contract for an AI system, organisations must ensure the solution adheres to all applicable laws and regulations across jurisdictions in which they operate. In response to this increasingly complex regulatory environment, and the lack of express legal regulation in many jurisdictions, procurement teams must rely more heavily on contract negotiation to embed compliance expectations directly into AI vendor relationships. Contractual language can help organizations manage cross border legal uncertainty by addressing issues such as data governance, algorithmic transparency, auditability, and incident reporting obligations. As regulatory requirements diverge across jurisdictions, contractual mechanisms are becoming indispensable tools for harmonizing obligations and ensuring that procured AI systems can be deployed lawfully and consistently across multiple legal environments.

At present, the EU AI Act is the most comprehensive AI framework, which imposes strict obligations, particularly related to high-risk AI systems, on both vendors and users. The EU AI Act is influencing procurement practices globally; where other jurisdictions lack express regulation of AI systems, pro-customer lawyers may look to the EU AI Act for guidance as EU-aligned AI standards may become the de facto global benchmark, similar to how the EU’s data protection legislation has become the international ‘gold standard’. Key compliance considerations and requirements of the EU AI Act and its regulations include: (i) risk management; (ii) data and data governance; (iii) technical documentation and instructions for use; (iv) record keeping; (v) transparency; (vi) human oversight; (vii) accuracy, robustness and cyber security; (viii) quality management; (ix) confidentiality; (x) corrective actions; (xi) an obligation to explain the functioning of the AI system on an individual level; (xii) rights to both a vendor’s and a user’s data set; (xiii) handover of data sets; (xiv) indemnification; and (xv) audit rights and an optional development of an AI register.

It is also worth noting that on May 7, 2026, the European Parliament and the Council of the EU (the ‘EU Council’) reached an agreement regarding amendments to the EU AI Act. The proposed amendments to the EU AI Act include a delay in the implementation of deadlines governing AI systems that are classified as ‘high risk’, a new ban on AI practices generating non-consensual sexual or intimate content, a reorganization of the regulators overseeing the implementation of the EU AI Act, and a shortened grace period requiring transparency for AI generated content from six (6) months to three (3) months, with a new deadline of December 2, 2026. While at the time of publication of this article, the amendments agreed by the EU Council have not been formally adopted, the proposed changes extend certain implementation and enforcement deadlines mandated by the EU AI Act, which is indicative of the practical complexity associated with regulating AI technology.

The United States, while lacking a unified federal AI statute, has begun shaping procurement expectations through executive branch directives and agency specific guidance. The White House Office of Management and Budget released two memoranda in 2025, specifically documents titled “Accelerating Use of AI through Innovation, Governance and Public Trust” and “Driving Efficient Artificial Intelligence in Government”. These instruments emphasize risk mitigation, transparency, and safeguards against discriminatory outcomes when using AI systems.

In contrast, Canada’s regulatory landscape remains comparatively underdeveloped: there is currently no binding national AI specific legislation governing the procurement or deployment of AI systems. Disappointingly, draft legislation introduced at the Canadian federal level, through Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act, stalled and died due to the prorogation of the Canadian Parliament at the request of the then-Prime Minister, Justin Trudeau, on January 6, 2025 pending a looming federal election.⁵ In the absence of formal federal legislation, Canadians have been forced to make do with a variety of federal directives and voluntary codes of conduct as well as guidance from various regulators.

In light of the lack of legislative reform in Canada, the federal and provincial authorities have attempted to fill the gap through a patchwork of non‑binding instruments, including government‑issued directives that now shape much of Canada’s practical approach to AI oversight. For example, the Canadian Federal Government has published a Federal Directive on Automated Decision-Making effective on April 1, 2019. The Directive, provided by the Treasury Board, ensures that AI systems are used by the federal government in a manner that reduces risk and leads to more efficient, accurate, consistent, and interpretable decisions made pursuant to Canadian law. In 2020, the Office of the Privacy Commissioner of Canada provided guidance on the use of automated decision-making and AI when involving personal information of data subjects, focusing on compliance under federal privacy legislation. Further, on July 3, 2025, the Autorité des marchés financiers, the security regulator in the Province of Quebec, published draft Guidelines for the Use of Artificial Intelligence, which outlines the expectations applicable to financial institutions regarding the responsible use of AI systems. ⁶ This new framework complements the federal Office of the Superintendent of Financial Institutions’ (OSFI) Guideline B-13, which has been in effect since January 2024, and governs technology and cyber risk management for federally regulated financial institutions.⁷

Additionally, on September 11, 2025, OSFI published Guideline E-23 - Model Risk Management. Guideline E-23 takes a principles-based approach to set out OSFI’s expectations for federally regulated financial institutions’ enterprise-wide model risk management. The Guideline defines a ‘model’ as an application of theoretical, empirical, judgmental assumptions or statistical techniques, including AI or machine learning methods, which process input data to generate results. The Guideline will come into effect on May 1, 2027. Finally, on January 21, 2026, the Information and Privacy Commissioner of Ontario and the Ontario Human Rights Commission jointly released six principles to guide organizations in the responsible use of AI technology. The principles are intended to steer organizations in implementing AI technologies in a manner that promotes innovation while upholding privacy protections and human rights obligations under provincial law. ⁸

In the absence of comprehensive AI-specific legislation, governmental bodies have begun to play an increasingly influential role in shaping procurement norms and governance expectations related to the procurement of AI systems. As a result, this creates both flexibility and uncertainty, requiring organizations operating in Canada, the US, or other jurisdictions that have yet to regulate the use of AI systems, to rely more heavily on governmental guidance, rely on negotiated contractual protections, and look to international frameworks to manage risk. The result is a procurement environment marked by regulatory fragmentation and the need for adaptable structures capable of reconciling conflicting or evolving legal obligations. While this avoids the prescriptive obligations found in the EU regime, it nonetheless shapes procurement practices by requiring organizations to navigate a patchwork of guidance and anticipate future statutory developments. The EU AI Act continues to set global expectations for responsible AI development and use despite being in flux as a result of proposed amendments, which ultimately reflects the practical difficulties associated with regulating novel AI technology and tensions between those who favour heightened regulation versus a more business-centric approach. Procurement processes will increasingly serve as a critical point of control for ensuring that AI technologies meet the legal, ethical, and operational standards required across diverse jurisdictions.

Conclusion

The procurement of AI systems now sits at the intersection of rapidly evolving regulatory regimes, increasing legal complexity, and heightened organizational accountability. In this environment, procurement processes become a central mechanism for managing legal risk, embedding compliance obligations, and ensuring that AI systems remain adaptable as standards continue to mature.

The EU AI Act, in particular, is influencing global procurement practices, setting detailed requirements that are likely to influence contractual norms and operational expectations far beyond Europe’s borders. Where other jurisdictions lack comprehensive statutory frameworks, organizations increasingly look to the EU model, including the challenges associated with its implementation, as a guide for responsible AI governance, supplementing it with governmental guidance, sector specific directives, and negotiated contractual protections. This patchwork of obligations underscores the need for procurement strategies that are both rigorous and flexible, capable of accommodating cross border requirements while anticipating future regulatory developments of AI systems.

At the same time, AI procurement challenges extend well beyond compliance with emerging regulatory frameworks. IP norms have struggled to accommodate AI systems that generate outputs autonomously and evolve over time, which complicates traditional ownership, making IP rights a central point of negotiation in the AI contract. As organizations increasingly depend on AI generated outputs, the need to clarify rights to training data, AI generated outputs, and system inputs becomes essential to ensuring operational certainty and protecting long term value.

Data governance and privacy/protection considerations further reinforce the centrality of procurement as a risk management tool. Because many AI systems rely on large, complex datasets, AI agreements now serve as the primary vehicle for allocating responsibilities related to data handling, security, and compliance with applicable privacy laws. Ensuring lawful deployment of an AI system requires clear contractual commitments around data governance, permissible uses, retention, access rights, and cross border transfers, particularly in jurisdictions where privacy laws impose strict conditions on the processing of personal information.

Liability has also emerged as one of the most complex and heavily negotiated aspects of AI procurement. Traditional software liability frameworks rely on predictable system behaviour, which is challenged when dealing with AI systems capable of producing novel outputs. Because the law has not yet fully adapted to this reality, procurement contracts remain the primary mechanism for allocating risk. Lawyers advising clients must therefore craft liability provisions that reflect the unique risks posed by the specific AI technology being procured, with particular attention to contractual risk allocation, liability caps, indemnification, and vendor representations/warranties.

As legal standards continue to shift, businesses looking to leverage AI technology should, as a best practice, ensure that any procurement of an AI system includes mandatory customer-protective AI contract terms that clearly allocate risk and impose enforceable contractual obligations on AI vendors. Organizations that invest in robust, forward looking procurement practices that are grounded in transparency, accountability, and proactive risk management, will be best positioned to deploy AI technologies responsibly and compliantly across jurisdictions

Footnotes

1 United Kingdom’s Data Protection Regulation, (EU) 2016/679 (2016).

2 United Kingdom’s Data Protection Act 2018, 2018 c. 12 (2018).

3 Canada’s Personal Information Protection and Electronic Documents Act, (S.C. 2000, c. 5).

4 European Union’s Artificial Intelligence Act, Regulation (EU) 2024/1689 (2024).

5 Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, 1st Sess, 44th Parl, 2022 (Can).

6 Autorité des marchés financiers, Guideline for the Use of Artificial Intelligence, (June 2025), https://lautorite.qc.ca/fileadmin/lautorite/consultations/lignes-directrices/2025-11-07-fin/2025juillet03-ld-IA-an.pdf. 

7 The Office of the Superintendent of Financial Institutions, Guideline B-13 - Technology and Cyber Risk Management, (January 2024), https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-risk-management. 

8 The Information and Privacy Commissioner of Ontario and the Ontario Human Rights Commission (OHRC), Principles for the Responsible Use of Artificial Intelligence, (January 2026) available at: https://www.ipc.on.ca/en/resources/principles-responsible-use-artificial-intelligence.

Originally published by Oxford University Press.