Instrument-to-control map

A working reference: which instrument applies to you, what it requires in substance, and the control organizations commonly put in place against it. The summaries below are ours, not quotations — verbatim provision text and links to the official consolidations are still being added, and the rows awaiting them say so. Check anything here against the source before relying on it.

Why this table exists. The single most commonly misstated point in this market is whether British Columbia's private-sector privacy law requires you to report a breach. It is worth getting right before you buy anything against it. See the breach-reporting explainer.

Each Canadian row quotes its operative provision from the official consolidation; the EU AI Act row summarizes the consolidated Regulation. Check the official text before relying on a row.
Instrument and provision	What the provision says	Control commonly used	Evidence a reader accepts
PIPEDA — breach of security safeguards reporting (federal, private sector)	Requires reporting to the Privacy Commissioner and notification to affected individuals where a breach creates a real risk of significant harm, and requires records of breaches to be kept. PIPEDA s. 10.1(1): “An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.” (Justice Laws, current to 21 July 2026.)	Breach assessment procedure with a documented risk-of-harm test; a breach register; named decision-maker; retention of records.	The register itself, with dated entries — including entries assessed and closed as non-reportable.
EU AI Act — Regulation (EU) 2024/1689 (reaches you if an AI system you provide or use has output relied on in the EU)	Obligations phase in rather than landing at once. In force 1 August 2024; prohibited practices and the AI-literacy duty applied from 2 February 2025; general-purpose AI model obligations from 2 August 2025. The high-risk dates have already been amended once and now run later than most summaries state — check the current text before you rely on a date, and treat any timeline written in 2024 as superseded. Source: the consolidated Regulation. This row is the one most likely to move again.	An inventory of where models are used and what leaves your estate; provider terms and retention; human oversight where output affects a person; logging that shows what was sent and returned.	The system-level record: which provider, which data, which retention, who reviews the output. Not a policy stating that AI is used responsibly.
BC PIPA — security of personal information (BC, private sector and non-profits)	Requires reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks. It does not impose a mandatory breach-notification duty. Reporting to the OIPC is voluntary, and the OIPC has recommended that mandatory notification be introduced. BC PIPA s. 34: “An organization must protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.” (BC Laws, current to 8 September 2026.) The absence of a notification duty is an absence in the Act itself — there is no provision to cite, which is why the OIPC has recommended one be added.	Documented safeguards proportionate to sensitivity: access control, encryption at rest and in transit, logging, retention and disposal.	Configuration exports and access reviews, dated. Not a policy asserting the safeguard exists.
BC FIPPA — public bodies (and their service providers, directly and by contract)	Public bodies must notify affected individuals and the commissioner, without unreasonable delay, of a privacy breach that could reasonably be expected to result in significant harm, and are subject to privacy impact assessment requirements. Service-provider staff also carry duties directly, including immediately telling the head of the public body about an unauthorized disclosure (s. 30.5(2)). Much of the rest arrives through the contract schedule. FIPPA s. 36.3(2): if a privacy breach occurs, the head of the public body “must, without unreasonable delay, (a) notify an affected individual if the privacy breach could reasonably be expected to result in significant harm to the individual… and (b) notify the commissioner if the privacy breach could reasonably be expected to result in significant harm referred to in paragraph (a).” The Act lists examples of significant harm including identity theft, bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, a negative impact on a credit record, and damage to or loss of property; the duty is subject to the exceptions in subsections (3) and (5). FIPPA s. 30.5(2): “An employee, officer or director of a public body, or an employee or associate of a service provider, who knows that there has been an unauthorized disclosure of personal information that is in the custody or under the control of the public body must immediately notify the head of the public body.” (BC Laws, current to 8 September 2026.)	Contractual breach-notification clock to the public body; PIA support; controls matching the security schedule.	The executed schedule plus your evidence against each of its clauses.