What could your business be fined for?

Every rule this check covers

The wizard above narrows these 33 down to the ones that catch your business. This is the full list, so you can read any single one without answering anything. Each links to a page explaining what it requires, who it catches and how to check it, with the legislation linked at source.

1. AODA (Ontario accessibility)

   WCAG 2.0 AA minimum, deadline 31 Dec 2026.

   Any Ontario org with 20+ employees. Real exposure is the Human Rights Tribunal - no damages cap, $25k-$100k+ typical awards.

2. ADA Title III (US web accessibility)

   No size exemption. 5,000+ suits filed in 2025.

   Any business with US customers or a public-facing site. 77% of suits target companies under $25M revenue.

3. Accessible Canada Act (federal)

   Web pages + accessibility statement due 5 Dec 2027.

   Federally regulated employers - banks, airlines, telecoms, and interprovincial carriers.

4. European Accessibility Act

   In force. Follows the customer, not your HQ.

   Any business selling to EU consumers online. Carrefour (Jun 2026): €500/day + €10,000 damages.

5. Competition Act s.74.01 (greenwashing)

   Reverse onus - you must substantiate the claim.

   Anyone with “eco-friendly / sustainable / carbon neutral / 100% recyclable” on their site. Keurig: $3,000,000.

6. Quebec Law 25 (privacy)

   Grace period over. First CAI notice Aug 2025.

   Any org handling one Quebec resident’s personal data. Up to $25M or 4% of revenue; s.93.1 lets individuals sue directly.

7. BC / Alberta PIPA (employee data)

   PIPEDA excludes employee files; provincial PIPA does not.

   Any BC or Alberta employer who assumed federal privacy law covers HR files. It does not.

8. Ontario job posting rules (O. Reg. 476/24)

   Pay range, AI-use disclosure, no Canadian-experience bar.

   Ontario employers with 25+ employees.

9. Multi-jurisdiction posting conflict

   BC + 16 US states + DC each demand pay disclosure, different rules.

   Any employer posting one role visible across provinces/states. One template is compliant in Ontario and offside the moment a BC or Colorado candidate sees it.

10. BC Pay Transparency Act

    Threshold now 50 employees; report due 1 Nov 2026.

    ~8,500 BC employers now in scope (up from ~700).

11. Federal Pay Equity Act

    In force since 2021. 10+ employees, federally regulated.

    Federally regulated employers - the same carrier clients, never sold this.

12. Canada Labour Code - equal pay

    Status-based equal pay, effect 20 Oct 2026.

    Federally regulated employers - same base as rows 3 and 11.

13. Illinois BIPA (biometric clocks)

    $1,000-$5,000 per violation, private right of action.

    Any employer using fingerprint/facial time clocks with Illinois staff. Speedway: $12.1M.

14. NYC Local Law 144 (AI hiring audits)

    Enforced since Jul 2023. Independent bias audit required.

    Any employer using automated tools to screen NYC-connected candidates (including remote NYC residents).

15. CCPA/CPRA + 19 other state privacy laws

    20 US states by 2026. $17.1M in CCPA fines in 2026.

    Any business with US customers. GM fined $12.75M (selling driver data); Disney $2.75M.

16. Manitoba accessibility standards

    WCAG web standard binding since 1 May 2025.

    Manitoba employers - 1+ employee, no size escape. Retroactively non-compliant now, not a countdown.

17. Nova Scotia Built Environment Standard

    Now law; enforcement date to confirm.

    NS businesses with physical premises.

18. New Brunswick Pay Transparency Act

    Royal Assent 12 Jun 2026. Some sections in force on assent, the rest on proclamation.

    NB employers - same posting-disclosure pattern as BC and Ontario. Employers with 50+ staff also owe an annual pay transparency report, posted publicly and filed with the province.

19. S-211 (forced-labour supply chain)

    Annual report due 31 May, board-signed, on your site.

    Businesses meeting 2 of 3: $20M assets / $40M revenue / 250 employees (worldwide).

20. California SB 253 (Scope 3 emissions)

    Large companies doing business in California.

    Large companies in CA - and every supplier their procurement sends an emissions form to.

21. Federal Plastics Registry

    Phase 1 deadline already passed - 29 Sep 2026.

    Manufacturers / importers of plastic packaging or single-use plastics above thresholds. A breach today, not a future risk.

22. Quebec Bill 96 / Law 14 (French language)

    Signage, packaging and francization; in force since 1 Jun 2025.

    Any business selling into Quebec. 25+ employees for 6+ months must register with the OQLF and francize - the same firms Law 25 already catches.

23. FINTRAC AML - dealerships, financing & leasing

    Reporting entity since 1 Apr 2025; full program due 1 Apr 2026.

    Car dealerships that finance or lease vehicles, plus factoring and leasing firms. Penalties to $500,000; FINTRAC can publicly name you.

24. Ontario Blue Box full producer responsibility

    100% producer-funded since 1 Jan 2026; report due 31 May.

    Brand holders, importers and retailers that supply packaging or paper products to Ontario households.

25. EU CBAM (carbon border adjustment)

    Definitive phase since 1 Jan 2026; first declaration 30 Sep 2027.

    Importers of steel, aluminium, cement, fertiliser or hydrogen into the EU above 50 t/yr. Only authorised declarants may import after 31 Mar 2026.

26. EU AI Act - Article 50 transparency

    In force since 2 Aug 2026. AI content must be disclosed.

    Anyone deploying AI that interacts with EU users or outputs synthetic media. Up to €15M or 3% of worldwide turnover. Open-source is not exempt.

27. CBCA register of significant control

    Federal corporations; penalties up to $1,000,000 since 22 Jan 2024.

    Every federally incorporated private company. Corporations Canada can dissolve a non-filer and refuse a certificate of compliance.

28. Ontario OHSA - washroom records + harassment

    Washroom-cleaning records and updated harassment wording, 1 Jan 2026.

    Every Ontario employer with worker washrooms. Inspectors may ask for proof during any workplace visit.

29. Ontario electronic-monitoring + disconnecting policies

    Written policies due 1 March each year.

    Ontario employers with 25+ employees on 1 January - the same trigger as the job-posting rules.

30. CASL (Canada’s Anti-Spam Legislation)

    Opt-in consent before any commercial email or text. Up to $10M per violation.

    Anyone sending commercial email, SMS or social messages to Canadians - there is no B2B exemption and no general org exemption. The CRTC can fine a business up to $10M per violation and name directors personally.

31. PCI DSS v4.0.1 (card-data security)

    All “future-dated” v4 controls mandatory since 31 Mar 2025 - the grace period is over.

    Any business that stores, processes or transmits card data - including e-commerce sites that merely embed a payment page or script. Penalty is higher fees, fines, or losing the ability to take cards.

32. Subscription auto-renewal laws (ROSCA + state ARLs)

    Cancelling must be as easy as signing up - even after the 2024 federal rule was struck down.

    Any business billing on an auto-renewing subscription - SaaS, memberships, retainers. California’s amended ARL (Bus. & Prof. Code §17602, since 1 Jul 2025) is the strictest; the FTC still enforces ROSCA and Section 5 nationwide.

33. Colorado AI Act (SB 24-205, as amended)

    High-risk AI in consequential decisions - notice-based duties start 1 Jan 2027.

    Developers and deployers of AI that makes, or substantially factors into, a consequential decision - hiring, lending, housing, insurance, education - affecting a Colorado resident.