Canada Legal Center
§ Employment§ Ai policy§ Workplace privacy§ Ontario§ Alberta

Does My Workplace Need an AI Usage Policy?

4 min read
The short answer No single law in Ontario, Alberta, or federally requires a document titled 'AI policy.' But specific triggers create binding obligations that a policy is the practical way to meet: Ontario's job-posting AI disclosure rule and electronic monitoring policy rule (both at 25+ employees), and Alberta PIPA's requirement for reasonable privacy policies wherever personal information is processed.

The verdict

No law in Ontario, Alberta, or federally requires a document titled “AI usage policy.” But several specific, narrower rules effectively require a written policy depending on your province, your headcount, and how you use AI, and a single policy document is the practical way most employers meet more than one of these at once.

Right now Canada has no AI-specific statute in force at all. The federal government’s proposed Artificial Intelligence and Data Act, part of Bill C-27, died on the order paper when Parliament was prorogued in January 2025 (Office of the Privacy Commissioner of Canada, Annual Report 2024-25). The federal Directive on Automated Decision-Making does exist, but it binds only federal government departments using automated systems for administrative decisions; it creates no obligation for private employers (Treasury Board of Canada Secretariat, s 5-6). So the real triggers, for most workplaces, come from provincial employment standards law and privacy law, not from anything AI-specific at the federal level.

TriggerOntarioAlberta
AI used to screen, assess, or select applicants for a publicly advertised job postingMust disclose the AI use in the posting itself. Applies to employers with 25+ employees, for postings on or after January 1, 2026, and covers AI used by the employer or a third-party recruiter on its behalf (Employment Standards Act, 2000, s 8.4; O Reg 476/24)No equivalent provision was located in Alberta’s employment standards legislation
Electronic monitoring of employees (can include AI-powered monitoring tools, even though the statute doesn’t use the word “AI”)Written policy required for employers with 25+ employees on January 1 of any year, in place by March 1 of that year (Employment Standards Act, 2000, Part XI.1, s 41.1.1)No equivalent provision was located in Alberta’s employment standards legislation
An AI tool collects, uses, or discloses personal information (including employee data)Ontario has no general private-sector privacy statute of its own outside health information, so federal PIPEDA fills the gap for Ontario employersAlberta’s Personal Information Protection Act (PIPA) applies directly: organizations must develop and follow reasonable policies (PIPA overview), take reasonable security measures (s 34), and give reasonable notice when collecting personal employee information without consent for recruiting, managing, or terminating staff (s 15)

Two things follow from this table. First, the Ontario rules are headcount-triggered: an employer below 25 employees is not caught by either the job-posting disclosure rule or the electronic monitoring policy rule, even if it uses AI tools daily. Second, privacy law applies regardless of headcount. Federally, PIPEDA covers federally regulated businesses and any provincially regulated business in a province without a “substantially similar” private-sector law, but it does not apply to employee information where a province has its own substantially similar law in place. Alberta’s PIPA is one such law, so Alberta employers look to PIPA rather than PIPEDA for their AI-related personal information obligations; Ontario, having no general private-sector law of its own, relies on PIPEDA for that gap.

Why a policy still matters even without a specific trigger

Even where no statute names “AI” directly, unmanaged AI use has already produced real legal consequences. In Zhang v Chen, 2024 BCSC 285, a British Columbia court addressed the cost consequences of a lawyer inserting fabricated case citations generated by AI into a court filing. That decision is not binding in Ontario or Alberta and involves a courtroom filing rather than a typical workplace document, but it is cited nationally as a cautionary example of what happens when AI output is used without verification. The underlying risk, unverified or fabricated AI output being relied on as fact, is not confined to law firms and does not depend on which province an employer is in.

Putting the pieces together

An employer deciding whether to write something down should work through the triggers rather than assume a single answer applies:

  1. Count employees as of the relevant date. Ontario’s two employee-count triggers (job posting disclosure, electronic monitoring policy) sit at 25 employees, measured on specific dates set out in the Employment Standards Act, 2000.
  2. Identify if AI is used in hiring for publicly advertised postings. If so, and the employer is in Ontario with 25+ employees, disclosure in the posting itself is mandatory starting with postings on or after January 1, 2026.
  3. Identify if AI tools monitor employees in any way. In Ontario, if the employer has 25+ employees, a written electronic monitoring policy is required regardless of whether the monitoring tool is described as “AI” in its marketing.
  4. Identify if AI tools process personal information (customer or employee). In Alberta, PIPA’s reasonable-policy and reasonable-security obligations apply directly. In Ontario, PIPEDA fills that role where no Ontario-specific law covers the situation.
  5. Consider AI-generated content risk independent of any registration threshold. The Zhang v Chen example shows that fabricated or unverified AI output can create liability regardless of employee count or province.

None of these steps requires a single omnibus “AI policy,” but for most employers who clear the 25-employee threshold in Ontario, or who process personal information through AI tools in either province, a written policy addressing these specific points is the practical way to satisfy the actual legal requirements that do exist.

Frequently asked questions

Does a small business with fewer than 25 employees need an AI policy?

In Ontario, the two specific statutory triggers (job-posting AI disclosure and the written electronic monitoring policy) only apply to employers with 25 or more employees, so a smaller employer is not caught by those rules. In Alberta, PIPA's requirement to have reasonable policies for personal information applies regardless of employee count if the organization is subject to PIPA.

Is there a federal law that requires an AI policy?

No. The proposed Artificial Intelligence and Data Act died when Parliament was prorogued in January 2025 and never came into force. The federal Directive on Automated Decision-Making only binds federal government departments, not private employers, so there is no federal AI-policy requirement for private-sector workplaces in any province.

Does Alberta have a rule like Ontario's AI hiring disclosure requirement?

No equivalent provision was found in Alberta's employment standards legislation as of this writing. Alberta's PIPA does require organizations to have reasonable policies wherever personal information (including information run through AI hiring tools) is collected, used or disclosed, which serves a related but not identical purpose.

What happens if my business has no AI policy and an AI tool causes a problem?

There is no specific statutory penalty tied to lacking an 'AI policy' as such outside Ontario's two named triggers. But courts have already sanctioned professionals for submitting AI-generated content with fabricated citations (Zhang v Chen, 2024 BCSC 285, a B.C. decision, illustrative but not binding in Ontario or Alberta), showing that unmanaged AI use can create real legal and cost consequences regardless of jurisdiction.

Sources

  1. Office of the Privacy Commissioner of Canada, Annual Report 2024-25 , Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act, 1st Sess, 44th Parl, 2022 (died on prorogation, January 2025) (retrieved July 17, 2026)
  2. Treasury Board of Canada Secretariat, Guide on the Scope of the Directive on Automated Decision-Making , Directive on Automated Decision-Making, Treasury Board of Canada Secretariat, s 5-6 (retrieved July 17, 2026)
  3. Government of Ontario, Your guide to the Employment Standards Act - Requirements related to publicly advertised job postings , Employment Standards Act, 2000, SO 2000, c 41, s 8.4; O Reg 476/24 (retrieved July 17, 2026)
  4. Government of Ontario, ESA Policy and Interpretation Manual, Part XI.1 , Employment Standards Act, 2000, SO 2000, c 41, Part XI.1, s 41.1.1 (retrieved July 17, 2026)
  5. Office of the Privacy Commissioner of Canada, Q&A on PIPEDA, Alberta and BC PIPA application , Personal Information Protection and Electronic Documents Act, SC 2000, c 5, s 4 (retrieved July 17, 2026)
  6. Government of Alberta, Personal Information Protection Act overview , Personal Information Protection Act, SA 2003, c P-6.5 (retrieved July 17, 2026)
  7. Government of Alberta, Personal employee information , Personal Information Protection Act, SA 2003, c P-6.5, s 15 (retrieved July 17, 2026)
  8. Government of Alberta, Organization responsibilities for protecting personal information , Personal Information Protection Act, SA 2003, c P-6.5, s 34 (retrieved July 17, 2026)
  9. CanLII commentary, Case comment referencing Zhang v Chen , Zhang v Chen, 2024 BCSC 285 (retrieved July 17, 2026)