Legislative Roundup Special Series: Issue 1°

Key Points:

1. The jurisdictions examined are currently at different stages of legislative development when it comes to AI regulation

   
   

2. EU’s AI Act was the first of its kind and has become the golden standard; on the contrary, Canada is left only with PIPEDA for privacy regulation and no legislation for AI regulation
   

3. It is unlikely that the United States will create a comprehensive federal AI statute, but some States have created their own AI statutes, namely California, Colorado, and Utah
   

So many AI developments have transpired in such a short period of time, and it is important to keep on top of them. Here is the latest on the jurisdictions at issue:

Canada

Bill C-27 involved proposing a privacy and AI bill in one long document. It was proposed during the first session of the 44th Parliament. On January 6, 2025, Parliament was prorogued with a proclamation of the Governor General on the advice of the Prime Minister, putting an end to the parliamentary session.

This means that Bill C-27 died at the time of prorogation, along with all other legislation on the Order Paper. Similarly, the study of Bill C-27 by the Standing Committee on Industry and Technology (INDU) that began in September, 2023 ceased upon prorogation.

To that end, Canada is still left with PIPEDA for privacy and no statute governing AI. Given the current political situation where the Liberals are in the process of selecting a new leader who will undoubtedly be welcomed with an election, it is not clear whether or to what extent the government will introduce either privacy or AI legislation.

United States

On his first day back in the White House, President Trump rescinded Biden’s Executive Order on AI safety—on January 23, 2025, he signed an Executive Order removing barriers to American AI Innovation. The document from the White House stated that the Biden AI Executive Order established unnecessarily burdensome requirements for companies developing and deploying AI that would stifle private sector innovation and threaten American technological leadership. Therefore, President Trump revoked Biden’s Executive Order and called for departments and agencies to revise or rescind all policies, directives, regulations, orders, and other actions taken under the Biden AI Executive Order that are inconsistent with enhancing America’s leadership in AI.

From this, we can deduce that there will likely not be a national AI bill coming any time soon.

If we turn to the States, we see from the IAPP AI Governance Tracker 2025 and a helpful map of the State jurisdictions’ requirements that there are three States that have gone through the legislative process that ended with an AI bill being signed into law:

1.    California: Introduced on January 31, 2024, AB 2013, requires, on or before January 1, 2026, a developer of an artificial intelligence system or service made available to Californians for use, regardless of whether the terms of that use include compensation, to post on the developer’s internet website documentation regarding the data used to train the artificial intelligence system or service. It takes effect on January 1, 2026. In addition, SB 942 sets out rules for businesses that provide a generative AI system with over 1 million monthly visitors during a 12-month period that is publicly accessible within the State’s geographic boundaries. It takes effect on January 1, 2026.

2.    Utah: On March 13, 2024, Utah enacted SB 149, which imposes certain disclosure requirements on entities using generative AI tools with their customers, and limits an entity’s ability to blame generative AI for statements or acts that constitute consumer protection violations. Interestingly, the bill defines generative artificial intelligence as an artificial system that: (i) is trained on data; (ii) interacts with a person using text, audio, or visual communication; and (iii) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight. SB 149 took effect on May 1, 2024.

3.    Colorado: SB 205 involves providing consumer protections in interactions with AI systems. It was approved by the Governor and became effective on May17, 2024. That said, the detailed requirements start to apply to developers and deployers on February 1, 2026

It is worth noting that Virginia just saw its HB 2094 pass, but it is not yet signed into law. It creates requirements for the development, deployment, and use of high-risk AI systems, defined in the bill, and civil penalties for noncompliance, to be enforced by the Attorney General. The bill takes effect on July 1, 2026.

Additionally, there are several bills that have been introduced but are still in the early stages. The potential is there for more bills to progress; in this way, there can be critical AI guardrails established, at least at the State level.

The European Union

The Artificial Intelligence Act (AI Act) introduces a uniform framework across all EU countries, based on a forward-looking definition of AI and a risk-based approach (minimal, specific transparency, high, and unacceptable risk). The goal is to foster responsible AI development and deployment in the EU.

Ahead of its time, the European Commission first proposed the AI Act in April, 2021. It entered into force on August 1, 2024; however, no provisions began to apply since they would start to apply gradually over time.

On February 2, 2025, prohibitions on certain AI systems and requirements on AI literacy began to apply (Chapter I and Chapter II). Chapter 1 deals with general provisions such as scope, definitions, and AI literacy. Chapter 2 deals with a number of prohibitions like placing on the market or into service an AI system that exploits any of the vulnerabilities of a person or group of persons due to their age, disability, or economic situation. More provisions will come into effect on August 2, 2025 that involve notified bodies (Chapter III, section 4), GPAI models (Chapter V), governance (Chapter VII), confidentiality (Article 78), and penalties (Articles 99 and 100). Ultimately, the rest of the AI provisions begin to apply on August 2, 2026 except for Article 6(1). As for Article 6(1), it will become effective on August 2, 2027.

What can we take from this status report?

As can be seen from the above discussion, the different jurisdictions are currently at different stages of legislative development when it comes to AI regulation. And even if it gets signed into law, it is worth mentioning that it is common for AI bills to propose a delayed effective date because businesses need some time to prepare for the upcoming changes. 

By far, the EU is ahead of the pack, having already created the provisions that are necessary to limit out-of-control AI activity. On the other hand, Canada is in the worst position, since it is not even known who will govern, what the new AI statute might look like, and when it might be proposed in the format of a comprehensive bill.

Then there is the United States. There does not appear to be any hope of further AI regulation at the federal level; this may be why States have been moving forward on their own and proposing AI bills, including the three States that recently signed AI bills into law.