Do I have to tell people when AI makes decisions about them in Canada?

If your product approves, rejects, ranks, prices or flags people using a model or rules engine, Canadian privacy law may require you to tell them and to explain the result. There’s no general AI law in Canada, so the duties come from privacy and employment statutes. Quebec’s are the most specific. For the wider picture, see our AI law tracker.

What does Quebec require?

Section 12.1 of Quebec’s private sector privacy act, added by Law 25 and in force since September 22, 2023, applies to any business that uses personal information to make a decision based exclusively on automated processing of that information. The business must:

• Tell the person that the decision was based exclusively on automated processing, no later than when it tells them about the decision.
• On request, tell them the personal information used to make the decision, the reasons and the principal factors and parameters that led to it, and their right to have the personal information corrected.
• Give them an opportunity to submit observations to a member of staff who is in a position to review the decision.

The rule isn’t limited to AI. A rules-based scoring system can trigger it as much as a machine learning model. It also applies to Quebec residents’ information even if your company is in Ontario. See does Law 25 apply outside Quebec.

What counts as “exclusively” automated?

The statute doesn’t define it. A decision where a person meaningfully reviews the output and can change it is less likely to be exclusively automated. A person who clicks approve on every recommendation without looking is a weaker argument. If you rely on human involvement to stay outside s. 12.1, make it real and record it.

Example	Likely exclusively automated?
An app auto-declines a credit or rental application based on a score	Yes
An AI tool rejects job applicants below a threshold with no human look	Yes
A model flags transactions, and an analyst decides each one	Probably not
A recommender chooses which articles to show	Possibly not a “decision about” the person, but consider the effect

What about the rest of Canada?

PIPEDA has no specific automated decision rule today, but its principles still apply to AI decisions:

• Openness (Principle 4.8). Your policies and practices on personal information must be readily available, which includes explaining that you use personal information in automated decisions.
• Accuracy (Principle 4.6). Personal information used to make decisions about people must be as accurate, complete and up to date as the purposes require.
• Access (Principle 4.9). People can ask what personal information you hold about them and how it has been used. See how to handle privacy access requests.

The Privacy Commissioner’s generative AI principles also call for explainability and openness. See what does PIPEDA require.

What about AI in hiring in Ontario?

Since January 1, 2026, under the Employment Standards Act changes made by the Working for Workers Four Act, 2024, Ontario employers with 25 or more employees must state in publicly advertised job postings whether AI is used to screen, assess or select applicants. A short statement is enough, and it applies even when a recruiter does the screening. Internal postings, general “we’re hiring” ads and jobs performed outside Ontario are excluded, and employers must keep copies of postings for three years. See Ontario’s job posting rules. If you sell HR tech, your customers will ask you how your tool works so they can disclose it accurately.

Will a federal rule be added?

Possibly. Bill C-36, introduced on June 15, 2026, would enact the Protecting Privacy and Consumer Data Act. As introduced, it would require organizations to explain, on request, predictions, recommendations or decisions made by an automated decision system that could significantly affect a person. As of late October 2026 it’s at second reading in the House of Commons, so it isn’t law and could change. See where Canadian privacy law stands.

How should we build this into the product?

• Inventory decisions. List each place the product makes or recommends a decision about a person, what data it uses and whether a human reviews it.
• Notice at the point of decision. For exclusively automated decisions about Quebec residents, say so in the decision message, not only in the privacy policy.
• Explanation on request. Be able to produce the personal information used and the main factors behind a specific decision. That usually means logging inputs, model version and key outputs.
• Review path. Give people a clear way to submit observations to a trained person who can change the outcome.
• Correction. Let people correct inaccurate information and rerun the decision.
• Records. Keep a short description of each system, its purpose, testing for accuracy and bias, and who reviews challenges.
• Contracts. If your customers make the decisions using your product, your SaaS agreement and AI product terms should say who gives notices and who handles review requests, and you should give customers enough information to explain results.

What to do next

We prepare privacy policies and AI product terms that describe automated decisions accurately, at fixed fees on our fees page. See also do I have to tell people my product uses AI and Quebec’s Law 25 for SaaS.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To check what your product should tell people about automated decisions, book a free 15-minute consult.