AI tools are becoming increasingly important in the hiring process. AI is reducing the time it takes for candidates to apply for positions, and employers are receiving a mounting number of applications. The time and expense of hiring qualified candidates is also increasing, with nearly 9 in 10 HR managers reporting heavier workloads.[1]
In 2025, over 25% of Canadian hiring managers surveyed reported they have used AI in recruitment.[2] While using AI to screen and assess candidates can be a helpful time-saver for employers, it comes with potential legal obligations and liabilities as well.
As of this past January, employers hiring in Ontario must now disclose on job postings if they are using AI to screen, assess, or select applicants.[3] There are limited exceptions to this rule– for example, if an employer is hiring internally or employs less than 25 people.
Although Ontario is the only province with an AI-specific law so far, employers in other provinces are not necessarily free of disclosure requirements. For example, private sector organizations in BC and Alberta have certain notice (and possibly consent) requirements under their respective Personal Information Protection Acts (PIPA).
In both BC and Alberta, employers may collect, use and disclose a candidate’s personal information if it is reasonable for the purposes of establishing, managing or terminating an employment relationship. Consent is not necessarily required but advance notice is. The notice must describe to candidates the purpose for which their personal information is being used, such as for the purposes of screening, assessing, and/or selecting candidates for a position.[4]
PIPA is not expressly clear whether BC and Alberta employers must specifically mention AI in the description of purposes in the notice to candidates, and it has not yet been settled by the courts or provincial regulatory bodies. Depending on the circumstances, employers may need to notify candidates about the use of AI to ensure they meet their obligations to fully inform candidates of how their information is being used in the hiring process.
In some cases, consent may be required. Many AI tools and platforms store or learn from the data that users input into them. Accordingly, when employers upload candidates’ resumes, cover letters, or transcripts to an AI platform, they may be providing a candidate’s personal information to a third-party AI provider for purposes other than establishing the employment relationship. Thus, the notice exception to consent may not apply. Further compliance and liability risks may arise where employers do not have sufficient privacy and confidentiality agreements with their AI provider, or recruiter that uses AI tools. In those cases, employers are more likely to have an obligation to obtain consent from the candidates.
In any event, Alberta PIPA service provider provisions will effectively require employers to notify candidates that they use AI. The law expressly requires employers to inform candidates that they use a service provider based outside of Canada and the countries where their information will be collected, used, or disclosed.[5] Further, the employer must inform the candidate for what purpose the employer has authorized the AI provider to collect, use, or disclose the information – for example, to screen candidates for the position.[6]
Many organizations address these notice requirements in recruiting forms, candidate notices, and updates to applicable privacy policies.
If your organization has questions about notice, consent and privacy protection obligations in the hiring process or data privacy generally, we would be pleased to help you. Please contact a member of our Privacy & Data Management Group.
This article is for informational purposes only and does not constitute legal advice.
[3] Employment Standards Act, 2000, S.O. 2000, c. 41, s. 8.4.
[4] Personal Information Protection Act, S.B.C. 2003, c. 63, ss. 13, 16 and 19; Personal Information Protection Act, S.A. 2003, c. P-6.5, ss. 15, 18 and 21.
[5] Personal Information Protection Act, S.A. 2003, c. P-6.5, s. 6
[6] Personal Information Protection Act, S.A. 2003, c. P-6.5, s. 13.