AI in hiring: Ontario says disclose it, the EU calls it high-risk

AI in hiring: Ontario says disclose it, the EU calls it high-risk

Hiring is where most businesses first use AI on other people's lives: a screening tool decides whose résumé a human ever sees, a ranking tool decides the order, sometimes a tool decides who is out. Two legal systems have now answered that in writing, from opposite directions. Ontario requires employers to tell applicants, in the job posting itself, when AI is used to screen, assess or select. The European Union classifies the same tools as high-risk AI, with the heaviest obligations the EU AI Act imposes. If your business hires — in Ontario, in Europe, or both — at least one of these already applies to you.

Quick answer

• Ontario, in force now: since 1 January 2026, employers with 25 or more employees must state in every publicly advertised job posting whether artificial intelligence is used to screen, assess or select applicants (Employment Standards Act, s. 8.4; O. Reg. 476/24).
• The statement is simple: no prescribed wording, no need to name the tool — but if AI does any of the screening, assessing or selecting, the posting has to say so.
• The EU, from 2 December 2027: Annex III, point 4 of the EU AI Act classifies AI used for recruitment and selection — targeted job ads, filtering applications, evaluating candidates — as high-risk, extending to promotion, termination, task allocation and performance monitoring tools.
• Both rules are about the candidate's position, not the software: Ontario gives applicants notice; the EU imposes documented oversight on the employer and information rights for workers. Neither bans AI in hiring.
• The working overlap is a short list: know which tools touch hiring, disclose the use, keep a person responsible for the decision, keep records you can show.

Ontario's rule: the AI statement in the job posting

Ontario's requirement arrived through the Working for Workers Four Act, 2024 (Bill 149), which received Royal Assent on 21 March 2024 and amended the Employment Standards Act, 2000. The detail is in O. Reg. 476/24, and the job-posting requirements came into force on 1 January 2026. They are live law today, not a proposal.

Who has to comply

The requirements apply to an employer with 25 or more employees on the day the posting is publicly advertised. A "publicly advertised job posting" is an external job posting for a specific position, advertised to the general public in any manner — your careers page, a job board, a posting placed through a recruiter. Not covered: a general recruitment campaign or help-wanted sign that does not advertise a specific position; a posting restricted to existing employees; and a posting for work to be performed outside Ontario. Below 25 employees, the posting rules do not apply — though the threshold exempts no one from the human rights and privacy law that also governs AI screening.

What counts as AI

The regulation's definition is deliberately broad: a machine-based system that, for explicit or implicit objectives, infers from the input it receives to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. Read against hiring, that reaches well past a generative-AI résumé reviewer: a scoring or ranking feature inside an applicant tracking system, a keyword filter, a tool that auto-rejects below a threshold. If software changes the set or the order of candidates a person reviews, assume it counts.

What the posting has to say

Section 8.4 of the ESA requires a statement disclosing the use of the AI. That is the whole of it: no prescribed form of words, no requirement to name the vendor or describe the model, and the regulation sets out no exceptions. A plain sentence — that artificial intelligence is used to screen, assess or select applicants for the position — meets the requirement as written. The failure mode the rule targets is not a badly worded statement; it is silence, while a tool quietly does the first pass.

The statement does not travel alone

The AI disclosure sits in a transparency package that took effect the same day, and a compliant posting carries all of it:

Requirement	What it means in the posting
Compensation	Expected compensation or a range; a range may not span more than $50,000; not required where expected compensation (or the top of the range) exceeds $200,000/year
AI use	A statement disclosing whether AI is used to screen, assess or select applicants
Canadian experience	No requirement for Canadian experience — in the posting or in any associated application form
Vacancy	A statement whether the posting is for an existing vacancy
After the interview	Interviewed applicants must be told whether a hiring decision has been made, within 45 days of the (last) interview — in person, in writing or using technology
Records	The posting, application forms and the interview information must be retained for three years after public access to the posting is removed

The records point is the one most likely to be missed, and it turns a one-off fix into a standing practice: three years of postings and forms means "what did we tell applicants in 2026?" has a documentary answer, one way or the other.

The EU: the same tools, classified high-risk

The EU AI Act (Regulation (EU) 2024/1689) takes the opposite route to the same destination: instead of a disclosure line, it classifies by use case. Annex III, point 4 — "Employment, workers management and access to self-employment" — lists as high-risk:

• 4(a) AI systems intended to be used for the recruitment or selection of natural persons — in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates; and
• 4(b) AI systems intended to be used to make decisions affecting the terms of work-related relationships, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate performance and behaviour.

The Act's stated reason (Recital 57) is the asymmetry: systems in this area "may have an appreciable impact on future career prospects, livelihoods of those persons and workers' rights," and may perpetuate historical patterns of discrimination. Note the breadth both ways. Point 4(a) reaches back into advertising — a system that decides who sees the job ad is in scope before any application exists. Point 4(b) reaches forward past the hire, into scheduling, evaluation and dismissal tooling. And classification turns on intended use, not sophistication: shortlisting from a general-purpose chatbot's scores is a high-risk deployment, however informal it felt.

High-risk classification brings the Act's heavy machinery — risk management, data governance, technical documentation, logging, human oversight — most of which falls on the provider of the system. The employer's share, as deployer, is narrower but real: use the system as instructed, keep human oversight over it, monitor its operation, keep the logs, and — under Article 26(7) — before putting a high-risk system into service at the workplace, inform workers' representatives and the affected workers that they will be subject to its use. One narrowing route exists on paper: Article 6(3) lets a provider argue an Annex III system is not high-risk. For candidate evaluation it is generally a dead end — evaluating candidates is profiling, and profiling takes the system out of the derogation altogether.

Timing matters, and it recently moved. The Annex III high-risk obligations were originally to apply from August 2026; the EU's Digital Omnibus postponed them to 2 December 2027. That is preparation time, not an exemption — and the Act reaches beyond the EU: a Canadian company recruiting for roles in the EU, or whose hiring output is used there, can be a deployer under the Act wherever its head office sits.

The two regimes side by side

	Ontario (ESA / O. Reg. 476/24)	EU AI Act (Annex III, point 4)
Status	In force since 1 Jan 2026	High-risk duties apply 2 Dec 2027
Who it binds	Ontario employers with 25+ employees posting publicly	Providers of hiring AI, and employers deploying it where the Act applies
What triggers it	Using AI to screen, assess or select applicants	Intended use in recruitment/selection (4(a)) or worker management (4(b))
Core demand	Disclose the AI use in the posting itself	Documented governance: oversight, records, worker information (Art. 26(7))

Neither regime is satisfied by a policy PDF nobody follows. Ontario's is checkable by any applicant who reads the posting; the EU's by any worker representative who asks for the oversight record. Both assume the employer can answer three questions on demand: which tools, doing what, with who responsible.

What to do with this

The practical overlap between a one-line Ontario duty and the EU's high-risk regime is shorter than either text suggests:

1. Inventory the hiring stack. Every tool that touches sourcing, screening, assessment, scheduling or evaluation — including AI features inside your applicant tracking system that arrived in an update. (The method is in the AI inventory post.)
2. Put the statement in the posting. If any tool in the stack screens, assesses or selects, the statement goes in every public posting — and kept voluntarily, the same sentence is good practice anywhere. Our AI disclosure guide covers the wording questions in depth; a disclosure statement sits with the templates.
3. Name the human. Both regimes assume a person is responsible for the decision the tool informs. Record who that is, and what they can override.
4. Keep the records. Ontario wants three years of postings and forms; the EU wants logs and oversight evidence. One filing habit serves both.

Those four moves — inventory, disclosure, a responsible human, records — are also the centre of the Ethicality AI Use Standard (EAUS): 15 plain-language requirements on disclosing meaningful AI use, keeping a human responsible for important decisions, and protecting confidential information. Certification does not discharge an ESA or EU AI Act duty, and nothing here is legal advice. What an independent assessment evidences is that the practices behind the posting statement are real — the difference between a compliant sentence and a defensible one.

Frequently asked questions

We have 18 employees. Does the Ontario rule apply to us?

Not yet. The posting requirements apply to employers with 25 or more employees on the day the posting is publicly advertised. Cross that threshold and every public posting from that day on carries the full package, AI statement included. Human rights and privacy obligations apply at any size.

Our ATS ranks applicants but a person makes every decision. Do we still have to disclose?

Yes, on the regulation's wording. The duty is triggered by using AI to screen, assess or select — ranking is assessing, and it determines what the person sees. Human decision-making at the end is good oversight; it does not switch off the disclosure.

Do we have to name the tool or explain how it works?

No. Ontario requires a statement disclosing the use — not the vendor, the model, or a technical explanation. A candidate may still ask, and privacy law may shape what you should answer; the posting duty itself is the statement.

We are a Canadian company hiring only in Canada. Does the EU classification matter to us?

Not as law — the Act's employment provisions bite where the hiring is for the EU or the output is used there. As a forecast, yes: Ontario's disclosure rule and New York City's audit-and-notice rule for hiring tools both moved in the EU's direction. Building the inventory, disclosure and oversight habits now is cheaper than retrofitting them per jurisdiction.

Does certification satisfy the Ontario or EU requirements?

No. The ESA statement is a sentence in your posting; the EU duties are yours as a deployer. What certification evidences is the underlying practice — AI use that is inventoried, disclosed and humanly overseen, assessed independently against the EAUS. Regulators and candidates ultimately ask whether the practice is real; that is the part an assessment speaks to.

Hiring is the first place your AI use becomes someone else's problem

Every other AI use in your business affects customers who can walk away. Hiring AI affects people deciding whether they can work for you — why it drew Ontario's first disclosure rule and a high-risk classification in Europe. The fixes are small: a statement, an inventory, a named human, kept records. Start with the free self-assessment, or get certified and have those practices checked across your whole AI use, hiring included. The assessment is free; you pay only if certification is issued.