Here's where there's a little bit of a struggle, and it's part of the reason for going back to the recommendation that actually it would be preferable to revisit this act altogether. I will point to that first, and then I will speak to the practicalities.
I think part of the challenge here is that it seems that one of the federal heads of power used to develop this act was the criminal law head of power. There's a tension between a criminal law penalty, which should only arise at a high threshold, and the need to acknowledge and mitigate as many harms from AI as possible, especially if we want to see this industry actually flourish and bring benefits to Canada. I would acknowledge that the tension exists and that this is something more complex to resolve, but in the structure we have right now, the way we would see that play out in practice would be through greater refinement and instruction from the regulations and from the minister going forward.
Again, that's acknowledging the critique of that structure. Along the lines of how the Privacy Commissioner provides guidance to businesses on how to meet certain criteria, I think this would be an area where education norm-setting would be absolutely crucial. I do think that, bottom line, it is imperative that this act not overlook collective and group-level harm if it's going to actually mitigate the harms we'll see as the AI industry grows and becomes more widespread.