This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
An AI hiring tool that works the same way for every applicant can still land your business in three different sets of legal obligations, depending on where each candidate lives. Quebec, federal privacy law, and Ontario's employment law each treat AI in hiring differently, and none of them defer to the others just because your head office is somewhere else.
In short: if any part of your hiring process uses AI to screen, score, or shortlist candidates, check three things: whether Quebec's Law 25 applies (it does if any candidate is in Quebec), whether PIPEDA's federal baseline applies (it does everywhere else, and underneath Quebec too), and whether you're a 25+ employee Ontario employer publicly advertising the role (Ontario now requires AI disclosure in the posting itself).
Why one AI tool can trigger three different rulebooks
Canada has no single, national AI-in-hiring law. What exists instead is a patchwork: Quebec has the strictest, most specific rules; the federal Personal Information Protection and Electronic Documents Act (PIPEDA) sets a baseline that applies almost everywhere else; and individual provinces are starting to layer employment-specific disclosure rules on top, with Ontario the first to actually legislate one for AI specifically.
An HR manager at a 60-employee Ontario-headquartered logistics company found this out rolling out a single AI resume-screening tool company-wide. Before checking, she assumed PIPEDA was the only thing that mattered, since the company itself is based in Ontario. After checking, she found that applicants for a Quebec-based warehouse role triggered Law 25's automated-decision rights on top of PIPEDA, and that publicly advertising any role at all now means disclosing the AI screening tool in the posting under Ontario's own new rule. Same software, three different obligations, depending entirely on where the candidate applying happened to live.
Quebec's Law 25: the strictest rules, and they follow the candidate
Quebec's Law 25 has been fully in force since September 2024, and its automated-decision provision (section 12.1) applies in full to hiring. It covers any decision made exclusively by automated processing, which the Quebec privacy regulator (the Commission d'acces a l'information, or CAI) has confirmed includes resume-screening tools that auto-reject candidates and AI systems that score interviews or rank applicants without a human reviewing the outcome.
Where section 12.1 applies, the CAI's guidance says an employer needs to: tell the candidate, at or before the decision, that it was made by automated means; give the candidate, on request, the main personal information used and the main reasons and factors behind the decision; and offer the candidate a real chance to have a human reviewer look at it again. A privacy impact assessment before rolling out a new AI hiring tool is also expected practice under the law. See our guide to when an AI tool triggers a PIA in Canada for how that assessment actually works.
Crucially, this isn't about where your company is registered. Law 25 applies to any organisation collecting or using the personal information of a person in Quebec, including a Quebec-based job candidate applying to a company headquartered anywhere else in Canada. For the full detail on Law 25's automated-decision rules, see our dedicated Quebec Law 25 guide.
PIPEDA: the federal floor everywhere else
Outside Quebec, PIPEDA is the federal baseline that applies to private-sector employers collecting personal information from job candidates, though provincial private-sector laws in British Columbia and Alberta can also apply to organisations operating mainly within those provinces. The Office of the Privacy Commissioner of Canada (OPC) has been explicit that PIPEDA's existing fairness and accountability principles apply to AI-driven decisions, even without AI-specific legislation naming automated hiring tools directly. See our PIPEDA and AI guide for what those principles mean in practice, and our navigator piece for working out which specific law governs a given candidate.
Ontario's new AI job-posting disclosure rule
Since 1 January 2026, Ontario employers with 25 or more employees must disclose in any publicly advertised job posting whether AI is used to screen, assess, or select applicants, under amendments made through the Working for Workers legislation to the Employment Standards Act. The Act defines AI broadly, as a machine-based system that infers from input to generate outputs like predictions, recommendations, or decisions that can influence outcomes for the applicant.
The same amendments require Ontario employers to tell candidates they've interviewed, within 45 days of the last interview, whether a hiring decision has been made for that posting, and to keep a record of that notice for three years. This is a disclosure and record-keeping rule, not an automated-decision-rights rule like Quebec's, but it applies regardless of where the candidate lives, since it's triggered by the employer's own headcount and posting activity in Ontario.
What this looks like in practice
For a business hiring across more than one province, the practical approach is to check obligations per candidate location rather than assume one national policy covers everyone. A Quebec-based applicant gets the full section 12.1 disclosure-and-human-review treatment regardless of where the posting originated. Any publicly advertised posting from a 25+ employee Ontario employer needs the AI disclosure line, regardless of where the applicant ends up living. Everyone else falls under PIPEDA's baseline fairness principles at minimum, plus whatever provincial private-sector law applies where the business itself operates.
Methodology (Real-World, Verified)
We test AI tools against real SMB workflows: the tasks a 20-person business actually uses AI for, not enterprise demos. Pricing is verified at the vendor's published rates, with local-currency conversions noted where relevant. Compliance notes reference the legislation and regulatory guidance relevant to each article's region. Every tool is judged on one question: could a business with no dedicated IT department actually pick this up and use it on Monday morning.
Related reading: our AI governance by region.
Does Quebec's Law 25 apply if my company isn't based in Quebec?
Yes. Law 25 applies based on where the candidate is, not where the employer is registered. A Quebec-based applicant triggers the law's automated-decision provisions regardless of the company's head office location.
Do I need to disclose AI use for every job posting in Canada?
Only Ontario currently has a specific legislated AI-disclosure requirement for job postings, and it applies to employers with 25 or more employees advertising publicly. Outside Ontario, PIPEDA's fairness principles apply, but there's no equivalent posting-level disclosure rule as of this guide's last verification date.
What counts as an automated decision under Quebec's Law 25?
The CAI's guidance points to any hiring decision made exclusively by automated processing, with no meaningful human involvement, as falling within section 12.1. Resume-screening tools that auto-reject candidates, and AI interview scoring used without a human reviewing the outcome, are both examples the guidance covers.
Does using an AI hiring tool require a privacy impact assessment in Canada?
Under Quebec's Law 25, a privacy impact assessment is expected practice before rolling out a new AI system that processes personal information, including hiring tools. See our dedicated guide on when an AI tool triggers a PIA for the specific triggers and what the assessment covers.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
Rolling out a new AI hiring tool? Check whether it triggers a privacy impact assessment before you launch it.
Read the PIA Guide