EU AI Act for Canadian Companies: How Article 2 Reaches You After AIDA

A Toronto SaaS company whose AI underwriting model is used by an insurer in Dublin is bound by the EU AI Act — even though Canada has, as of mid-2026, no comprehensive AI law of its own. This is the trap for Canadian companies. The EU AI Act is not Canadian law and never becomes Canadian law; there is no Canadian application date. But Article 2 of Regulation (EU) 2024/1689 gives the Act deliberate extraterritorial reach, and it catches Canadian providers and deployers the moment they place an AI system on the EU market or their system's output is used in the Union. Canada's own AI bill collapsed in 2025 — and that absence makes the EU file the live obligation, not a reason to wait.

---

Canada is a third country: the Act never becomes Canadian law

Canada is not an EU Member State and not part of the European Economic Area (EEA). There is no transposition route, no EEA incorporation, by which the EU AI Act enters Canadian federal or provincial law. So for a Canadian company the only question that matters is the extraterritorial one: does your activity bring you within Article 2?

AIDA died — there is no Canadian AI Act to wait for

Canada's first attempt at a federal AI statute, the Artificial Intelligence and Data Act (AIDA), was part of Bill C-27. That bill died on the Order Paper when Parliament was prorogued in January 2025, and as of mid-2026 it has not been reintroduced and is widely seen as unlikely to return in its original form. The practical effect for compliance teams: there is no Canadian AI-specific statute in force, no Canadian "high-impact AI" regime, and therefore nothing domestic that mirrors — or discharges — the EU obligations.

Canada's actual AI landscape is a patchwork

In the absence of AIDA, Canadian AI governance runs through general privacy law (PIPEDA federally, plus provincial regimes such as Quebec's Law 25), sector-specific guidance, and the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems. None of that is a substitute for the EU AI Act, and the EU AI Act is not a substitute for any of it. A Canadian company selling AI into the EU faces both pictures in parallel — treat the Canadian side as fast-moving and a matter for separate Canadian counsel.

---

Article 2: the two limbs that catch Canadian companies

Article 2 sets the Regulation's scope, and it is written to reach beyond EU borders so that non-EU providers cannot undercut EU ones by staying offshore.

Placing AI on the EU market (Article 2(1)(a))

Under Article 2(1)(a), any provider that places an AI system on the EU market or puts it into service in the Union is in scope, regardless of where it is established. A Canadian company that sells, licenses, or otherwise makes its AI product available to customers in Germany, France, or Ireland is caught — incorporation in Ontario and servers in Montreal change nothing.

Output used in the Union (Article 2(1)(c))

Under Article 2(1)(c), a provider or deployer established in a third country is in scope where the output of the AI system is used in the Union. The test is where the effect lands, not where the company or server sits. A Canadian company whose model scores, ranks, or generates content about people in the EU is caught on this limb even with no EU customer contract.

The authorised-representative obligation (Article 22)

A Canadian provider of a high-risk system must, before placing it on the EU market, appoint an authorised representative established in the Union under Article 22. This is a designated in-Union point of contact and accountability — structurally similar to the EU-representative requirement Canadian firms may already meet under the GDPR, but a separate appointment under a separate statute.

---

Timeline: the EU dates apply to in-scope Canadian companies

There is no separate Canadian date. A Canadian company in scope through Article 2 plans against the EU statutory calendar.

The Digital Omnibus high-risk deferral

The Digital Omnibus is law: Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. Stand-alone Annex III high-risk obligations apply from 2 December 2027, and product-embedded Annex I high-risk obligations from 2 August 2028. Those are now the only legal dates.

What did not move

The co-legislators adopted fixed dates instead of the Commission's November 2025 "stop the clock" proposal. Article 5 prohibitions and Article 4 literacy have applied since 2 February 2025; GPAI obligations under Articles 51–55 since 2 August 2025. For Canadian foundation-model and GPAI providers placing models on the EU market, the GPAI duties are live now — and models on the EU market before 2 August 2025 have until 2 August 2027 to comply under the transitional provision.

---

What in-scope Canadian companies actually have to do

The obligations are the EU obligations

Because the Act binds through Article 2 rather than any Canadian transposition, an in-scope Canadian provider or deployer faces the same role-based duties as an EU company. There is no Canada-lite version. The roles map identically: provider, deployer, importer, distributor — with importer duties at Article 23 and distributor duties at Article 24.

The Article 25 role-shift

A deployer, distributor, or importer becomes a provider under Article 25 the moment it puts its own name or trademark on a high-risk system, substantially modifies it, or changes its intended purpose. A Canadian company that fine-tunes a base model into a new high-risk purpose, or rebrands a high-risk EU tool, can inherit the full provider stack without realising it.

High-risk duties and penalties

For a stand-alone Annex III high-risk system, the provider stack applies in full: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness (Articles 9–15), conformity assessment, the Article 49 registration, and provider obligations under Article 16. Penalties are the Article 99 tiers — identical figures, calculated on worldwide turnover, not EU or Canadian revenue: up to €35 million or 7% for Article 5 breaches (Article 99(3)); up to €15 million or 3% for most other obligations including high-risk provider duties (Article 99(4)); up to €7.5 million or 1% for supplying incorrect or misleading information (Article 99(5)). For SMEs, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. Separately, GPAI model providers are fined by the Commission under Article 101 (up to €15 million or 3%), not under Article 99.

---

Worked example: a Toronto insurtech selling AI underwriting into the EU

NorthRate Inc is a roughly 120-employee Toronto insurtech with around CAD $19 million in annual revenue. It sells an AI model that prices and risk-scores life and health insurance applicants, and two of its customers are insurers in Ireland and Germany.

Why NorthRate is in scope now

As a provider placing the system on the EU market, NorthRate is in scope under Article 2(1)(a) today — no EU office is required, and the absence of a European entity is irrelevant. Its tool is high-risk under Annex III point 5(c) (risk assessment and pricing in life and health insurance), which triggers the full provider stack under Articles 9–15. Even where NorthRate has no direct EU contract, Article 2(1)(c) can catch it where the model's output is used to price applicants in the Union.

NorthRate's pre-market checklist

• Appoint an Article 22 authorised representative established in the Union before placing the system on the EU market.
• Build the Article 11 / Annex IV technical documentation and the Article 47 / Annex V EU declaration of conformity.
• Run the conformity assessment and register the system under Article 49.
• Because this is a life/health-insurance pricing system, NorthRate's EU insurer-deployers owe an Article 27 Fundamental Rights Impact Assessment — build the documentation to support theirs.
• Note the exposure: a high-risk provider breach sits in the Article 99(4) tier; as an SME, NorthRate benefits from the Article 99(6) cap at the lower of the fixed amount or the percentage, so 3% of revenue is the operative ceiling, not the €15 million figure.
• Keep Canadian obligations — PIPEDA, provincial privacy law, the voluntary code — running in parallel; the EU file does not discharge them, and vice versa.

---

What Canadian companies should do now

Map your EU exposure, not your Canadian status

Do not start from "is there a Canadian AI law?" — there is no comprehensive one in force, and that does not reduce your EU exposure by a single obligation. Start from "do we touch the EU market?" If you place AI on the EU market or your output is used in the Union, the EU timeline binds you through Article 2.

A five-step starting checklist

1. Map your AI systems against Article 2 to confirm where you place systems on the EU market or your output reaches the Union.
2. Classify each system: clear the Article 5 prohibited-practice gate first, then assess Article 6 / Annex III for high-risk status.
3. Assign roles — provider, deployer, importer, distributor — and run the Article 25 conversion check on anything you rebrand, fine-tune, or repurpose.
4. For high-risk systems, appoint an Article 22 authorised representative in the Union before market placement.
5. Build the compliance file: risk management, Annex IV documentation, conformity assessment, and the Annex V declaration of conformity — and keep your Canadian obligations running in parallel.

Two developments to monitor

Track two moving pieces for legal review: the Commission's high-risk classification guidelines, published in draft in May 2026, which will shape how Annex III is read, and whether Canada reintroduces a federal AI bill to replace AIDA — which may add Canadian obligations but will not displace the EU AI Act's extraterritorial reach.

---

How Confir helps Canadian companies

Confir derives your provider, deployer, importer, or distributor role and classifies your systems under Articles 5 and 6 with Annex III logic from plain-language intake. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake always yields the same audit-defensible finding with a human-readable explanation of which rule fired.

Confir generates the Article 11 / Annex IV technical documentation pack and the Article 47 / Annex V declaration of conformity, and supports the Article 27 Fundamental Rights Impact Assessment where it applies. The aim is to give a Canadian company an EU-market compliance file that stands on its own, separate from whatever Canadian federal and provincial obligations apply. The GPAI workflow (Articles 51–55) is partial and on the roadmap, not presented as complete. Confir is EU-hosted, at confir.eu.

Related guides

• EU AI Act extraterritorial reach for non-EU companies
• EU AI Act for US companies: Article 2 reach
• EU AI Act scope explained (Article 2)
• EU AI Act high-risk classification (Article 6)
• EU AI Act deadlines and application dates