US-Canada AI Compliance 2025: What UK Professional Services Firms Need to Know

If your firm uses AI tools — and at this point, most do — the regulatory developments unfolding in the United States and Canada are not someone else's problem. Whether you are a UK-based accountancy practice with North American clients, a law firm advising on cross-border transactions, or an HR consultancy deploying AI-assisted recruitment tools, the compliance obligations emerging across the Atlantic have direct and practical consequences for how you operate.

This briefing cuts through the complexity and sets out what matters, why it matters now, and what you should be doing about it.

The US Federal Picture: Deregulation Does Not Mean No Regulation

The shift from the Biden administration's Executive Order 14110 — which prioritised AI safety, civil rights protections, and worker safeguards — to the Trump administration's Executive Order 14365 might suggest that the US federal government is stepping back from AI oversight. That reading would be a mistake.

The deregulatory posture at federal level is primarily aimed at removing friction for domestic AI developers. For professional services firms using AI systems built by those developers, the compliance burden has not disappeared; it has shifted. EO 14365's attempt to pre-empt conflicting state laws signals a push towards a unified national framework, but that framework does not yet exist. In the interim, firms operating across multiple US states must contend with a genuine patchwork of obligations.

California's Transparency in Frontier AI Act (TFAIA) and AB 2013, both effective January 2026, impose transparency requirements on frontier and generative AI models. New York's RAISE Act, enacted in December 2025, targets large developers of advanced AI models with similar disclosure obligations. Colorado has revised its initial AI Act through SB 189. Many state-level laws also address specific applications — companion chatbots, AI-generated media used in elections, and others — with disclosure requirements that professional services firms deploying client-facing AI tools will need to review carefully.

The practical implication for international firms: if you are providing services to US clients, or deploying AI tools developed or hosted in the US, you are operating within this legislative environment whether or not you have a physical presence there.

FTC Enforcement: The Risk Is Real and Active

The Federal Trade Commission remains one of the most consequential regulators in this space, and its activity in 2025 and 2026 makes clear that enforcement is not theoretical.

The FTC's mandate to prevent unfair and deceptive practices applies directly to how AI systems are marketed and used. A policy statement issued in July 2026 specifically addresses AI accuracy, questioning whether AI companies are adequately disclosing biases that cause their systems to produce misleading outputs. The Commission's position is that undisclosed ideological distortions in AI-generated content may constitute deception — even where those distortions were introduced to achieve compliance with state-level content regulations. That is a genuinely complex position, and one that firms relying on AI-generated client communications, reports, or advice should take seriously.

Separately, the FTC's January 2025 report on AI partnerships and investments flagged antitrust concerns around cloud-for-equity arrangements and structural relationships between major technology providers and AI developers. For professional services firms that have entered into preferred-supplier agreements or integrated specific AI platforms deeply into their workflows, this is worth monitoring. Regulatory scrutiny of the AI supply chain is increasing, and firms caught downstream of a problematic partnership arrangement could face uncomfortable questions.

Canada: Legislative Uncertainty Is Itself a Compliance Risk

Canada's Artificial Intelligence and Data Act (AIDA), which formed part of Bill C-27, died in January 2025 without coming into force. The government has indicated that new AI governance legislation is forthcoming, but the details — including how it will define high-impact AI systems, what enforcement mechanisms it will include, and how it will interact with provincial laws — remain undefined.

For firms advising Canadian clients or operating in Canada, this uncertainty is not an invitation to pause compliance activity. It is a reason to act on what is already in force.

PIPEDA, Canada's federal private-sector privacy law, applies directly to AI systems that process personal data. The requirements are substantive: meaningful consent must be obtained for the collection, use, and disclosure of personal information by AI systems, with particular scrutiny applied to sensitive data categories such as health information. AI scribes used in medical or legal contexts — an increasingly common tool — sit squarely within this framework.

The Office of the Privacy Commissioner has called for reforms that would introduce explicit individual rights in relation to automated decision-making, including a right to explanation. Those reforms have not yet been legislated, but the OPC's advocacy signals the direction of travel, and firms with mature compliance programmes would be prudent to build in that capability now.

Quebec's Law 25 adds a further layer. It imposes stricter privacy requirements than PIPEDA in several respects and applies to organisations operating in Quebec regardless of where they are headquartered. For UK firms with Canadian operations or client relationships spanning Quebec, dual compliance is the practical reality.

Why This Matters for UK and International Professional Services Firms

UK firms may be tempted to focus exclusively on the EU AI Act and domestic ICO guidance. That would be an error of scope.

AI compliance is inherently cross-border. The tools you use are built and governed under foreign legal frameworks. The clients you serve may be subject to US state laws, Canadian federal and provincial requirements, and sector-specific regulations that carry their own AI-related obligations. The data flowing through your AI systems does not stop at national borders, and neither does regulatory exposure.

There are three immediate areas of focus for firms operating internationally. First, review your AI tool inventory against the transparency and disclosure requirements emerging across US state legislations, particularly if you are deploying client-facing generative AI. Second, assess your data processing practices under PIPEDA if you hold or process personal data relating to Canadian individuals — and account for Quebec's Law 25 where relevant. Third, map your AI supply chain: understand where your tools originate, what representations their developers have made about accuracy and bias, and what your own disclosure obligations are to clients.

The FTC's focus on deceptive AI outputs is particularly relevant for accountants, solicitors, and HR consultancies whose AI-assisted outputs carry professional weight. Getting this wrong is not merely a regulatory risk — it is a professional indemnity risk.

The Compliance Window Is Narrowing

The pace of AI regulatory development in North America is accelerating. California and New York's 2026 provisions are already in force. Canada's next legislative attempt will arrive with fewer opportunities to prepare. The FTC is actively seeking public input and actively bringing enforcement actions.

Firms that treat AI compliance as a future consideration are already behind.

How Ops Intel Can Help

Ops Intel works with professional services businesses across the UK, US, Canada, the EU, and Asia-Pacific to build AI compliance programmes that are practical, proportionate, and fit for the regulatory environments in which they actually operate.

Whether you need a cross-border AI compliance audit, a tailored policy framework, or ongoing regulatory monitoring as the landscape continues to shift, our team is ready to support you.

Get in touch with Ops Intel today to discuss your AI compliance requirements — before the regulatory window narrows further.