Source: IAPP

Businesses are deploying AI across multiple HR functions, including resume ranking, candidate-job matching, initial interviews, interview question generation, interview summarization and scoring, and red-flag reporting for HR teams. New regulatory developments have prompted questions about permissibility, disclosure duties, anti‑discrimination measures, privacy obligations for personal data collection/use/disclosure, and governance policies to mitigate HR risks tied to AI tools. In Canada, whether federal or provincial law applies depends on the employer’s jurisdictional status; federally regulated employers may face instruments such as the Canadian Human Rights Act, the Employment Equity Act, the Pay Equity Act and the Accessible Canada Act, plus federal privacy regimes like PIPEDA or the Privacy Act. Provincial employers must consider provincial employment standards, human rights and accessibility laws, with Ontario’s Working for Workers Four Act, 2024 (effective 1 Jan. 2026) introducing a specific requirement that Ontario employers with 25 or more employees who publicly advertise a job and use AI to screen/assess/select applicants must disclose that AI use in the posting.

In the U.S., there is no comprehensive federal AI statute for employment at present; on 20 March 2026 the White House published a National AI Legislative Framework that offers legislative recommendations but creates no immediate employer obligations. Until Congress acts, state and local laws — including jurisdictions such as California, Illinois, New York City and Texas — continue to regulate AI in hiring, promotion, performance management and other employment decisions, sometimes requiring notice, access rights or bias audits. California’s CCPA ADMT regulations impose pre‑use notice and access requirements for regulated automated decision‑making technology and require employers to assess whether uses qualify as regulated ADMT or are sufficiently human‑in‑the‑loop. Best practices recommended include inventorying AI use cases across the employment lifecycle, conducting pre‑deployment risk assessments and bias testing, preserving meaningful human oversight, maintaining documented governance and record‑keeping, and robust vendor management; the EU AI Act’s high‑risk designation for many employment systems is cited as an influential comparator for obligations such as risk assessments, transparency, human oversight and post‑deployment monitoring.