Skip to content
AI Compliance Tool
Check my AI risk
PlatformSolutionsPricingRegulationsFree toolsGuides Partners Sign in

AI Compliance for HR Teams: Recruitment, Screening and Employee Monitoring

What HR teams in Canada, the US and the EU must do when AI touches hiring, screening or monitoring: the rules, the dates, and the practical controls that produce evidence.

By AI Compliance Tool editorial team · Published 2026-10-14 · Reviewed 2026-10-14 · Reviewer: Pending independent review · 11 min read

Key takeaways

  • Recruitment and worker-management AI is high-risk under EU AI Act Annex III point 4, with obligations from 2 December 2027; emotion recognition in the workplace has been prohibited since 2 February 2025.
  • Ontario ESA s. 8.4 (employers with 25 or more employees, in force 1 January 2026) requires an AI-use statement in public job postings; Quebec Law 25 s. 12.1 requires notice and a human-review route for decisions based exclusively on automated processing.
  • Illinois HB 3773 (effective 1 January 2026), NYC Local Law 144, Colorado SB 26-189 (from 1 January 2027) and California's CPPA ADMT rules (by 1 January 2027) each add notice, audit or record duties.
  • The EEOC's AI technical-assistance documents are no longer on eeoc.gov, but Title VII's disparate-impact rule (s. 703(k)) is unchanged and employers remain liable for vendor tools.

HR is where AI compliance becomes concrete fastest. Screening, scoring and monitoring tools make or shape decisions about identifiable people, and legislators in Canada, the US and the EU have responded with specific rules. This guide sets out what applies, when, and the controls that generate the evidence you will need.

Where AI shows up in HR

Resume ranking in applicant-tracking systems, chatbot pre-screening and scheduling, video or voice interview scoring, skills and “fit” assessments, promotion recommendations, productivity and attendance analytics, and sentiment analysis of messages, calls and meetings. Each is an AI system that belongs in your inventory with a named owner, a vendor, the data it uses and the decision it influences.

The rules by jurisdiction

JurisdictionInstrumentWhat it requiresApplies
EUAI Act Annex III pt 4; Arts. 9-15, 26Recruitment and worker-management systems are high-risk: provider documentation, logging, oversight design; deployer oversight, monitoring, six-month log retention, worker and affected-person notification2 December 2027
EUAI Act Art. 5Emotion recognition in workplaces prohibited (safety/medical exceptions)Since 2 February 2025
EUAI Act Art. 4AI-literacy measures for staff using AISince 2 February 2025
EUGDPR Arts. 22, 35, 13-14Right not to be subject to solely automated significant decisions; DPIA for systematic automated evaluation; notice of ADM logicIn force
OntarioESA 2000 s. 8.4; O. Reg. 476/24AI-use statement in publicly advertised job postings; employers with 25+ employees1 January 2026
QuebecP-39.1 ss. 12.1, 8.1, 3.3Notice of decisions based exclusively on automated processing, explanation on request, observations to a human reviewer; prior notice of profiling technology; PIA for information-system projectsIn force
Canada (federal)PIPEDAAppropriate purposes, meaningful consent, safeguards, openness, access; no AI-specific provisionsIn force
US (federal)Title VII s. 703(k)No unjustified disparate impact from selection tools; employers with 15+ employeesIn force
IllinoisHB 3773 (775 ILCS 5/2-102(L))No AI with discriminatory effect in employment decisions; no zip-code proxies; notice to employees1 January 2026
New York CityLocal Law 144Independent bias audit within past year, public summary, 10-business-day candidate noticeEnforced since 5 July 2023
ColoradoSB 26-189Point-of-interaction notice, plain-language explanation within 30 days of adverse decision, human-review request, 3-year records1 January 2027
CaliforniaCPPA ADMT regulationsPre-use notice, opt-out and access rights for ADMT in significant decisions including employment1 January 2027
TexasTRAIGANo AI deployed with intent to unlawfully discriminate (disparate impact alone insufficient)1 January 2026

There is no federal Canadian AI statute: Bill C-27’s AIDA died on 6 January 2025, and Bill C-36 (introduced 15 June 2026) is a privacy bill not in force.

The EU in more detail

If your recruiting tool is placed on the EU market or its output is used in the EU, the high-risk regime applies from 2 December 2027. As a deployer you will need to use the system per the provider’s instructions, assign oversight to competent, trained and authorised people, monitor operation, keep logs for at least six months, inform workers’ representatives and affected workers before go-live, and inform candidates that they are subject to a high-risk system. Providers face the full Art. 9-15 set.

Two things apply already. Emotion recognition in the workplace is prohibited under Art. 5, so any “sentiment” feature that infers emotional state from faces, voices or text must be switched off for EU workers or confirmed to fall within an exception. And Art. 4 requires measures to support AI literacy for staff who operate AI; a recorded training session for recruiters is the minimum.

Canada in more detail

Ontario. Since 1 January 2026, an employer with 25 or more employees on the posting day must include a statement in any publicly advertised job posting if it uses AI to screen, assess or select applicants. O. Reg. 476/24 defines AI broadly (a machine-based system that infers from inputs to generate predictions, recommendations or decisions) and excludes internal-only postings, general campaigns and work outside Ontario. Keep every posting and a record of headcount on the posting date.

Quebec. Section 12.1 applies when a decision is based exclusively on automated processing: you must tell the person no later than when you tell them the decision, give on request the personal information used and the principal factors and parameters, allow correction, and give the person a chance to submit observations to a staff member who can review the decision. Section 8.1 requires notice before collecting information with technology that can profile a person (which includes assessing work performance). Section 3.3 requires a privacy impact assessment for any project to acquire or overhaul an information system involving personal information, which captures most HR AI procurement.

PIPEDA and provincial PIPAs. No AI-specific text, but appropriate purposes (s. 5(3)), meaningful consent and safeguards apply to candidate and employee data fed into AI tools.

The US in more detail

Title VII. A selection practice that causes a disparate impact on a protected class is unlawful unless job-related and consistent with business necessity (s. 703(k)). The EEOC’s May 2023 Title VII AI technical assistance, its May 2022 ADA AI document and the eeoc.gov/ai landing page are no longer available on eeoc.gov. The statute has not changed, employers remain liable for vendor-supplied tools, and private litigation does not depend on federal enforcement priorities. The reported removal date (27 January 2025) comes from law-firm commentary and is unverified.

Illinois. Since 1 January 2026, using AI with a discriminatory effect in recruitment, hiring, promotion, discipline, discharge or terms of employment is a civil-rights violation, as is using zip codes as a proxy for protected classes. Employers must notify employees that AI is used; the Department of Human Rights is to adopt rules on notice.

New York City. An automated employment decision tool may be used to screen NYC candidates or employees only if it has had an independent bias audit within the past year, a summary is publicly posted, and candidates get at least 10 business days’ notice including the qualifications assessed, how to request an alternative process or accommodation, and the retention policy.

Colorado. SB 26-189 (signed 14 May 2026) repealed and reenacted the earlier Colorado AI Act as a narrower ADMT transparency law. From 1 January 2027, deployers using covered ADMT in employment decisions must give clear notice at the point of interaction, a plain-language explanation within 30 days of an adverse decision, data access, correction and human-review rights, and three years of compliance records. The Attorney General enforces with a 60-day cure period until 1 January 2030.

California. CCPA-covered businesses using ADMT for significant decisions, including employment, must provide pre-use notices, opt-out and access rights by 1 January 2027.

Texas. TRAIGA prohibits deploying AI with intent to unlawfully discriminate; disparate impact alone does not establish intent. It does not remove Title VII exposure.

Practical controls

  1. Inventory every HR AI tool with owner, vendor, decision influenced, data used, jurisdictions of candidates and employees, and whether a human makes the final call.
  2. Candidate and employee notice. Keep one notice template with jurisdiction variants. Ontario: posting statement. NYC: 10-business-day notice with qualifications assessed and accommodation route. Illinois: employee notice. Quebec: decision-time notice for exclusively automated decisions. Colorado and California: notices ready for 1 January 2027. EU: worker and affected-person notices ready for 2 December 2027.
  3. Meaningful human review. Define where a person reviews AI output before a decision, who that person is, what they see, and how to escalate. A rubber-stamp is not review; record the reviewer and any overrides.
  4. Bias documentation requests to vendors. Ask for the most recent independent bias audit or adverse-impact study and its date; the metrics (for example impact ratios by sex and race/ethnicity); the features used and confirmation that zip codes and other proxies are excluded; intended use and known limitations; instructions for human review; and a commitment to notify you of material model changes (Colorado requires developer documentation of this kind from 2027).
  5. Run your own adverse-impact check. Compare selection rates across protected groups on your own applicant flow at least annually and before go-live.
  6. Monitoring tools get a purpose test. Before deploying productivity or sentiment analytics, write down the purpose, why a reasonable person would find it appropriate (PIPEDA s. 5(3)), the Quebec s. 8.1 notice, and whether any EU worker could be subject to emotion recognition.
  7. Records. Keep postings, notices and send logs, vendor documents, audit reports, test results, human-review records, accommodation and explanation requests. Retain at least three years to cover Colorado and a defensible period elsewhere.

Example. Prairie Logistics, a fictional 180-employee carrier in Calgary, Toronto and Chicago, uses a vendor’s resume-ranking tool. Its compliance file contains an inventory entry, the Ontario posting statement in its job-ad template, the Illinois employee notice, the vendor’s bias-audit report dated within 12 months, a quarterly selection-rate comparison, a procedure requiring a recruiter to review every candidate the tool scored in the bottom quartile, and a record of two candidates who asked for human review. When a Chicago candidate complains, the file answers the questions before counsel has to.

Sources

Frequently asked

Do we have to tell candidates we use AI screening?
In Ontario, employers with 25 or more employees must say so in publicly advertised job postings. NYC requires 10 business days' notice before an automated employment decision tool is used. Illinois requires notice to employees. Colorado and California add point-of-interaction or pre-use notices from 2027. The EU requires deployers to inform workers and affected persons for high-risk systems from December 2027.
Our vendor says its tool is bias-tested. Is that enough?
No. Ask for the actual audit or testing documentation, the date, who did it, the metrics used and the populations tested. Under Title VII and Illinois law the employer remains responsible for the outcome, and NYC requires an independent audit within the past year with a public summary.
Can we use AI to analyse employee sentiment or emotion?
In the EU, emotion recognition in the workplace is a prohibited practice under Art. 5 (with safety and medical exceptions) and has been since 2 February 2025. In Quebec, technology that profiles a person requires prior notice under s. 8.1. Elsewhere, treat it as a high-risk use needing a documented purpose assessment.
What records should HR keep?
Copies of postings and notices, the inventory entry for each tool, vendor documentation and audit reports, adverse-impact test results, human-review decisions and candidate requests for review or accommodation. Colorado will require three-year retention from 2027.

This guide is general information, not legal advice. Laws and dates are drawn from our verified regulatory dataset and link to official sources; check them for changes after the review date.