Does Canada's New Chatbot Bill Apply to Your Website Assistant?

The short answer: Not under Bill C-34 today. As of 5 October 2026, the Safe Social Media Act completed first reading on 10 June 2026 but has had no second reading activity and is not law. Its proposed chatbot rules could apply through a user threshold or a below-threshold designation based on significant risk of harm. The widely repeated carve-out for businesses that sell goods and services sits in a different definition and does not do the work people think it does. The bill more likely to change how you run a website assistant is C-36, introduced five days later.

What the chatbot duties would actually require

The government's announcement describes a Digital Safety Act, administered by a new Digital Safety Commission of Canada, covering social media services, livestreaming, user-uploaded adult content and certain AI chatbot services.

For regulated chatbots the central obligation is a duty to act responsibly: mitigate harmful content and behaviour, and implement crisis intervention measures. Under section 51, a user expressing suicidal thoughts, an intention to self-harm, or an intention to commit an act that could cause death or serious bodily harm would trigger measures requiring an immediate interruption of the interaction to direct the user to appropriate, currently available crisis services offering human help. The proposed rules would also require public guidelines explaining how the chatbot handles harmful content, harmful behaviour and crisis situations. The bill text names the behaviours it has in mind, including encouraging self-harm, impersonating a licensed professional while giving advice a user could reasonably rely on, and using manipulative engagement techniques to foster emotional attachment that may encourage social withdrawal or disconnection from reality. A separate duty to protect children would apply to every regulated service.

Most of these are things you would want anyway. An assistant that implies it is a licensed electrician is a problem whether or not a statute says so.

The definition is wider than you would guess

Section 2(1) defines a chatbot service as an AI system that communicates over the internet, is publicly accessible in Canada through a website or application, uses a natural language interface to give adaptive, human-like responses in a conversational format, can simulate sustained relationships across multiple interactions, and generates content that is not fully predetermined.

An ordinary website assistant meets most of that. The clause about simulating sustained relationships is the one a narrow FAQ bot might fall outside, and its application to narrow FAQ assistants remains uncertain.

The exclusion you have been told about is in the wrong place

Summaries often say the bill exempts services whose primary purpose is the sale, listing or advertisement of goods or services, or providing directories, search results, maps or navigation tools. That wording is real, at section 2(8). What matters is the term it limits, which is online service. Chatbot service is defined separately in the same section.

So the reasoning "we sell a service, therefore our assistant is out of scope" does not follow from the text. Your assistant may well end up outside the Act. It will not be because of section 2(8).

The threshold is not the only route into scope

Section 7(1)(a) would cover chatbot services at or above a user threshold set by regulations. Sections 7(1)(b) and 7(3) would also allow a smaller chatbot service to be designated by regulation if it poses a significant risk of harm to individuals in Canada. Section 2(7) lets regulations exclude systems that exclusively serve specified purposes. Those regulations have not been made.

For a small service business, the honest position is this. Conversation volume alone cannot settle whether your assistant would be covered. The threshold is unwritten, and the bill creates no obligations while it waits at second reading. Check the status page rather than a summary written in June.

The bill that probably does reach you

Bill C-36 was introduced on 15 June 2026 and is also waiting for second reading. It would enact the Protecting Privacy and Consumer Data Act and replace the privacy provisions of PIPEDA. It is aimed at private sector organizations generally, with an approach the government describes as proportionate for small and medium businesses.

Two proposals could touch assistants directly. Where an automated system makes predictions, recommendations or decisions about individuals that could have legal or similarly significant effects, sections 62(2)(c) and 63(4) of the proposed privacy Act would require a public account of the organization's use of those systems and an explanation to the affected individual on request. A basic FAQ assistant would not automatically meet that test. Section 57 would require a privacy impact assessment and measures to mitigate identified risks before sending personal information outside Canada.

The second deserves attention this quarter. If your assistant sends visitor messages containing personal information to a model hosted in the United States, that information leaves Canada. An enquiry may carry a name, an email address and a description of somebody's problem. Under section 114, C-36's proposed administrative maximum is the greater of C$10 million and 3 percent of the organization's gross global revenue for the financial year before the penalty is imposed, across contraventions arising from one investigation. For specified offences prosecuted by indictment under section 145, the maximum fine is the greater of C$25 million and 5 percent of the organization's gross global revenue for the financial year before sentencing.

None of this displaces what already applies. PIPEDA, Alberta's PIPA or other privacy laws may govern the enquiry data you collect today, depending on your organization, province and data flows. The federal privacy commissioner's jurisdiction guide explains why provincial law may govern local activity while PIPEDA governs commercial cross-border transfers. Existing rules also require more than policy wording: the commissioner's cross-border guidance addresses safeguards, contractual or other protections and clear notice of foreign processing and possible access by foreign authorities. Alberta's PIPA guidance likewise calls for reasonable security measures.

A checklist for this week

Take a property manager running an assistant that answers questions about available suites and takes enquiries after hours. None of the following waits on Parliament.

1. Write down where each conversation goes: which model provider, in which country, and who in your organization can read transcripts.
2. List the categories of personal information the assistant collects, including whatever a visitor types into a free text box.
3. Check that your privacy notice explains the assistant's data handling, including any foreign processing and possible access by foreign authorities. Review provider contracts and safeguards too. Start that review today if you find gaps; this is a practical recommendation, not a statutory same-day deadline, and changing the wording alone is not enough.
4. Confirm the assistant cannot claim a licence, credential or professional opinion it does not hold. Test it with three direct questions.
5. Test a crisis route that interrupts ordinary answers when a visitor expresses suicidal thoughts or an intention to self-harm or commit an act that could cause death or serious bodily harm, and directs them to appropriate crisis services with human help available at that time.
6. Put a review date on the approved answers, with a named owner. Answers drift as prices and services change.
7. Note both bill numbers and check their status quarterly instead of reacting to headlines.

This is not legal advice and we are not a law firm. If your assistant touches health, financial or children's information, talk to counsel.

Where Lumin fits

• We build chatbots and voice assistants around approved answers, visitor-led enquiry capture and scoped connections, with services, FAQs, limits and escalation rules maintained by the staff you designate.
• We keep the states separate and visible. A saved enquiry, a delivered notification and a staff response are three different things, and only the last means a person replied.
• We do not promise regulatory compliance, and a new question does not become a business fact until somebody reviews it.

To find out where your current assistant sends data and what it is permitted to say, book a discovery call.