AI Rules for Manitoba's private sector: What businesses need to know

Manitoba’s new Bill 51, Public Sector Artificial Intelligence and Cybersecurity Governance Act (the Act) has been widely discussed, but it only applies to government departments, agencies, municipalities and similar public bodies. It doesn’t directly regulate private businesses.

That doesn’t mean private organizations using AI in Manitoba are unregulated. Several other rules already apply, a broader framework is being considered, and the Act itself can still reach a private business indirectly.

How the Act can still reach your business

The Act captures AI built by a third party on behalf of a public-sector entity. If your business supplies AI tools, software or cybersecurity services to a government department, agency or municipality, expect procurement requirements and contractual compliance commitments to evolve as regulations under the Act take shape, even though your business itself isn’t a “public sector entity.”

Consultation

The Manitoba government launched a consultation in March 2026 on potential new rules for responsible AI use and privacy, including in the private sector, covering issues such as consent, age limits and AI systems that make, recommend or influence decisions affecting people’s rights, opportunities, benefits or access to essential services. Nothing has been enacted yet, but businesses using AI in consumer-facing decisions, including financial institutions and insurers, should keep an eye on where this goes. This is a separate track from the Act and moves on its own timeline.

Bill 49: Algorithmic pricing is already regulated

Manitoba has already moved on one private-sector AI issue, separate from the Act and separate from the consultation described above. Amendments to The Business Practices Act made by Bill 49, in effect since July 1, 2026, now treat certain uses of personalized algorithmic pricing as an unfair business practice. If your business uses personalized algorithmic pricing to increase the price demanded from an individual consumer, the new rules may apply.

Rules that already apply to any business using AI

Independent of the Act, Bill 49 and the pending consultation, a private business using AI in Manitoba is already subject to:

• Human rights law: biased AI outcomes affecting employment, housing or services can already be challenged under The Human Rights Code (Manitoba). The Code applies to both public and private organizations in the areas it covers, so AI-assisted decisions by a private employer, landlord or service provider can raise human rights issues;
• Health privacy law: if your organization handles personal health information, check whether The Personal Health Information Act (PHIA) applies to your organization and AI system, and ensure its requirements for collection, use, disclosure and protection are being met; and
• Federal privacy law: because Manitoba has no general private-sector privacy statute of its own, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) generally applies to private businesses engaged in commercial activity when they collect, use or disclose personal information.

What to do now

• Take stock of what AI you’re already using, buying or building, including tools embedded in other software.
• If you use algorithmic or personalized pricing, review it against Bill 49’s unfair business practice rules now, since that one is already in force.
• Flag the higher-risk uses of AI in your business: anything touching employment decisions, credit or insurance decisions, or sensitive personal information.
• Review your privacy practices under PIPEDA where applicable, and under PHIA where your organization is a trustee or information manager handling personal health information.
• Look at your AI vendor contracts, especially around audit rights, data ownership and what happens if new Manitoba rules make a system non-compliant.
• Review your cybersecurity practices, including incident response plans and technical safeguards, since cybersecurity risk doesn’t depend on whether new AI-specific legislation exists yet.
• If you sell AI or cybersecurity services into government, or use AI in consumer-facing decisions, track the Act’s regulations and the private-sector consultation separately, since they’re moving on different tracks.

Manitoba’s approach to private-sector AI is arriving in pieces: a consultation that may lead to broader legislation, a narrow rule already in force on algorithmic pricing, and a set of existing laws that already reach AI use even though none of them were written with AI in mind. Businesses that map out where they already stand under these rules will be in a much better position when the next piece arrives.