Ontario's AI Hiring Disclosure Rule Is 5 Months Old. Most SMB Employers Aren't Compliant.

Ontario ESA Section 8.4 AI Disclosure Rule

Section 8.4 of Ontario's Employment Standards Act, 2000, added by Bill 149 (the Working for Workers Four Act, 2024), requires every employer with 25 or more employees who advertises a publicly advertised job posting to include a statement disclosing the use of artificial intelligence if AI is used to screen, assess, or select applicants. The rule took effect January 1, 2026. The Act defines "artificial intelligence" through Ontario Regulation 476/24 as a machine-based system that infers from inputs to generate predictions, content, recommendations, or decisions that can influence physical or virtual environments — a definition that captures most modern applicant tracking systems and any generic AI tool used in screening workflows.

Most Ontario SMB employers using Workday, Greenhouse, Lever, iCIMS, or any modern recruiting platform are now subject to a disclosure obligation enforced by fines up to $100,000 per violation under ESA Section 132 (Koskie Minsky LLP). The compliance gap is not a small one. As of June 4, 2026, Human Resources Director Canada reported that most organizations have not yet brought their job postings or application forms into alignment with the rule, even though the law has been in force for five months (Human Resources Director Canada).

What Section 8.4 Actually Requires

The statutory language is direct. Section 8.4(1) of the ESA states that "every employer who advertises a publicly advertised job posting and who uses artificial intelligence to screen, assess or select applicants for the position shall include in the posting a statement disclosing the use of the artificial intelligence" (Legislative Assembly of Ontario, Bill 149).

Three conditions trigger the obligation: the posting is publicly advertised, the employer has 25 or more employees, and AI is used at any point in screening, assessment, or selection (Lexology / Koskie Minsky). The obligation applies to AI use at any stage, not only at the final decision (Human Resources Director Canada). If a candidate ranking engine inside an ATS uses AI to score resumes, the disclosure obligation is triggered even when a human makes the final hire.

The Ministry of Labour issued unofficial guidance on February 4, 2026 stating that "it is not necessary to provide a detailed description of the artificial intelligence system or the employer's use of the system. It is enough for the employer to state that artificial intelligence is used to screen, assess or select applicants" (Lexology). The bar is low. Compliance requires presence and accuracy, not detail.

Why Most SMBs Are Quietly Non-Compliant

The AI definition was drafted to be broad. Ontario Regulation 476/24 captures "a machine-based system that, for explicit or implicit objectives, infers from the input it receives in order to generate outputs such as predictions, content, recommendations or decisions" (Lexology). Osler's employment law analysis observes that the same disclosure statement applies whether an employer is using "basic keyword screening" or "machine learning algorithms that assess the probability of candidate success" — meaning the regulation captures legacy ATS features that many employers no longer think of as AI (Mondaq / Osler).

The practical consequence is a quiet compliance gap. An SMB owner who has not personally deployed ChatGPT into hiring may still trigger Section 8.4 through:

• Resume ranking scores produced by the ATS
• Automated skills-match recommendations on candidate dashboards
• Chatbot-based pre-screening questions on the careers page
• Video interview scoring tools embedded in third-party platforms
• AI-enhanced search filters that rank or surface applicants by inferred fit

These are the same class of adopted-but-ungoverned AI tools that create cost and security exposure — the difference is that Section 8.4 attaches a specific legal obligation to the hiring variant.

The Penalty Regime

ESA enforcement is not theoretical. Section 108 authorizes compliance orders. Section 132 authorizes prosecution and fines, with the maximum penalty raised from $50,000 to $100,000 under the companion Working for Workers Five Act (Koskie Minsky LLP). Repeat offenders face higher exposure. Employees who suspect non-compliance can file complaints with the Ministry of Labour, triggering an investigation that examines the employer's broader job posting and recruitment practices, not only the specific complaint.

The enforcement model is complaint-driven. Five months into the law, the Ministry of Labour has not yet announced an audit program targeting Section 8.4 specifically, but the complaint pathway is live and active. Employers who quietly continue posting non-compliant job ads are betting against an applicant or employee filing a complaint — a bet that gets weaker as awareness of the rule spreads.

A Four-Step Compliance Audit

What it is: An ESA Section 8.4 compliance audit is the process of identifying every AI-enabled point in your recruiting workflow, drafting an accurate disclosure statement, embedding it in every public posting and application form, and establishing governance for new AI tools before they enter the workflow. It is the recruiting-specific slice of the same AI readiness assessment that DeployLabs runs across an SMB's full operations.

How it works: Four steps.

*Step 1 — Inventory every recruiting tool in use.* List the ATS, resume parsers, candidate scoring modules, chatbots, video interview platforms, skills assessment vendors, and any internal AI tool an employee has used to draft postings or evaluate candidates. The inventory is broader than most HR teams expect. Generic AI tools (ChatGPT, Microsoft Copilot, Claude) used by a hiring manager to evaluate a resume count. Vendor-supplied AI features in the ATS count. Boilerplate filters that have been quietly upgraded to AI-powered ranking count.

*Step 2 — Determine which tools touch screening, assessment, or selection.* For each tool, ask: does this tool produce a score, ranking, recommendation, or content that influences which candidates advance? If yes, Section 8.4 applies. When uncertain, err on the side of disclosure (Lexology).

*Step 3 — Draft and embed the disclosure.* The Ministry guidance permits minimal language: a single sentence stating that AI is used in screening, assessment, or selection is sufficient. Lock the disclosure into the ATS posting template so postings cannot be published without it. The same disclosure must appear in any associated application form (Human Resources Director Canada).

*Step 4 — Build governance for new tool adoption.* The compliance gap that creates Section 8.4 exposure is the same gap that creates AI cost, security, and data-handling exposure: tools enter the workflow without governance review. Establish a written approval step for new AI-enabled vendors that documents what the tool does, whether it touches candidate decisions, and what disclosure language applies.

How to win: Employers who run the audit, embed the disclosure, and lock the governance step ahead of any new tool adoption convert Section 8.4 from a compliance risk into a documented operational process. Employers who skip the audit are accumulating exposure that compounds with every job posting.

The Bigger Pattern

The ESA Section 8.4 disclosure rule is one regulatory expression of a broader truth about how SMBs adopted AI. Most adoption happened tool by tool. The CRM vendor added an AI tab. The ATS shipped a candidate scoring update. A hiring manager opened ChatGPT to evaluate a resume. None of those steps were governance decisions. They were product upgrades and workflow shortcuts that became permanent before the organization noticed — and the same dynamic applies to the AI-versus-business-automation decision that most SMBs have not yet made deliberately.

When the Ontario legislature wrote a disclosure rule, the resulting compliance gap is not a function of any one tool. It is a function of how AI got into the recruiting workflow without a governance layer. The same structural pattern is showing up in AI cost exposure, AI data handling, and AI vendor concentration. Each regulatory wave will expose another seam in the same ungoverned adoption pattern.

The audit framework above resolves the specific Section 8.4 question. The harder question — what other ungoverned AI tools are in your workflows, and what exposure do they create — is the one most SMBs have not yet asked.

The Counterargument Worth Addressing

Some SMB owners read disclosure rules as compliance noise — a Toronto employer with 30 staff posting one or two roles per quarter may reasonably ask whether anyone is actually going to file a complaint over a missing AI disclosure line. The bet is not unreasonable for a single posting in isolation.

The bet gets weaker on three timelines. First, applicant awareness of the rule is growing as legal publications, HR industry media, and labour-side outlets explain the rights (Koskie Minsky LLP). Second, the Ministry has signalled that further guidance is coming, which usually precedes enforcement attention. Third, the rule is the leading edge of a broader regulatory wave — Bill C-27 / AIDA at the federal level, sector-specific AI rules in financial services and healthcare — that all share the same structural premise: AI used to make consequential decisions must be disclosed and governed (Osler / Mondaq).

The employer who runs the audit now builds a governance habit that is cheap to apply to the next wave. The employer who skips it is betting that no regulator and no applicant ever notices — across an expanding regulatory surface.