HR Compliance 2026: The Legal Deadlines You Can't Miss in Canada

2026 is a pivotal year for HR compliance in Canada. Several obligations that used to be recommendations are becoming legal requirements, and they hit recruiting directly: what you must display in a posting, how you can use AI, what you must disclose to candidates. A poorly written job posting is no longer just a missed opportunity, it's a compliance risk.

This guide walks through the 2026 deadlines province by province, with their concrete impact on your hiring. It doesn't replace legal advice, but it gives you the map for where to look and what to fix before you're offside.

Ontario: AI and salary disclosure in public postings

This is the most structural change of the year. Since January 1, 2026, under amendments to the Employment Standards Act (ESA), employers with 25 or more employees must meet new obligations on public job postings.

AI use disclosure

If you use artificial intelligence to screen, assess or select candidates for a publicly posted role, you must disclose it in the posting. Concretely, a statement must inform candidates that AI is involved in the process. This obligation targets transparency: the candidate has the right to know an algorithm participates in evaluating their application.

The practical implication: every affected public posting must automatically generate this statement. Doing it by hand across dozens of postings invites omission and therefore risk. Modern recruitment platforms now include this statement automatically based on the posting's context.

Salary range disclosure

Also in Ontario, public postings must include information on expected compensation (a salary range) for covered employers. The end of "salary to be discussed" postings changes negotiation dynamics and pushes employers to structure their salary bands upfront.

Quebec: Law 25 continues to shape recruiting

In Quebec, Law 25 (modernizing personal-information protection) is fully in force and tightly governs the handling of candidate data.

Automated decisions

Article 12.1 is central for any recruiter using AI: a person must be informed when a decision concerning them is based exclusively on automated processing, and they have the right to have that decision reviewed by a human. In recruiting, this means a rejection cannot be sent automatically without human intervention. The "human-in-the-loop" principle is an obligation, not an option.

Consent and retention

Law 25 also requires collecting clear consent, limiting collection to what's strictly necessary, and respecting defined retention periods. A resume kept indefinitely "just in case" without a legal basis is non-compliant. We dedicated a full guide to Law 25 recruitment compliance, detailing the practical obligations for HR teams.

Pay transparency: a trend sweeping the country

Beyond Ontario, several provinces are advancing on pay transparency. British Columbia was a pioneer with its Pay Transparency Act, and other provinces are following at different paces. The overall direction is clear: displaying a compensation range is becoming the norm, not the exception.

For employers, this has two consequences. First, you have to structure your salary bands before posting, which is no small matter for an SMB that operated case by case. Second, internal pay transparency becomes inevitable: it's hard to publicly post a range that differs from what your current employees earn. External transparency forces internal consistency.

The province-by-province detail

The pace of adoption varies widely from one province to another, and an organization hiring across several provinces has to juggle this patchwork.

• British Columbia: the Pay Transparency Act already requires posting a salary range in public postings and prohibits asking a candidate for their compensation history. It's the most advanced province.
• Ontario: pay transparency joins the ESA obligations for covered employers, alongside AI disclosure.
• Quebec: pay transparency isn't yet imposed in postings to the same degree, but pay equity remains regulated and Law 25 dominates data obligations.
• Other provinces: several, including Prince Edward Island and Newfoundland and Labrador, have adopted or are studying pay transparency measures. The trend is national.

The practical rule for a multi-province organization: aligning on the most demanding province avoids maintaining different processes for each jurisdiction.

Penalties for non-compliance

Ignoring these obligations isn't a neutral bet. The penalties are dissuasive and, in Quebec, among the heaviest in the country.

Law 25 provides for administrative monetary penalties of up to CAD 10 million or 2% of worldwide revenue for a company, and penal fines that are higher still, up to CAD 25 million or 4% of worldwide revenue, depending on the severity of the breach. For an SMB, even the lower bound of a penalty can threaten the whole operation.

On the ESA side in Ontario, failing to meet posting obligations exposes you to fines and compliance orders. Beyond the amount, it's the signal sent to the market that's costly: a company sanctioned for its recruiting practices sees its employer brand lastingly affected, in a context where candidates are already wary.

The lesson is simple: the cost of compliance is almost always trivial against the cost of a penalty or a lawsuit.

Case study: a tech SMB with offices in Montreal and Toronto

Take a 40-employee software SMB, with offices in Montreal and Toronto, hiring about ten people a year on both sides of the provincial line.

In Toronto, its public postings must now display a salary range and disclose AI use in screening, since it exceeds the 25-employee threshold. In Montreal, it must ensure no automated rejection goes out without human validation, collect clear consent and apply retention periods to its resumes. Because it recruits in both provinces, the simplest path is to apply the highest standard everywhere: salary ranges on all postings, an automatically generated AI statement, systematic human validation of decisions and a complete audit log.

The concrete result: a single recruiting policy, consistent from one province to the next, rather than two parallel processes to maintain and risk confusing. And an unexpected benefit: this rigor becomes an argument with candidates, who perceive a transparent, serious employer.

What these changes cost (or earn)

Compliance has a cost, but non-compliance has a higher one: penalties, litigation, reputational damage. And done well, compliance becomes an attraction asset. A candidate who sees a clear salary range and a transparent statement about AI use perceives a serious, respectful employer. Transparency, imposed by law, turns into an employer-brand argument, as we explain in our guide to employer brand strategy.

Conversely, these obligations slightly raise the cost of posting. Recall that the cost of a hire in Canada already sits between CAD 4,700 and CAD 7,000 in direct costs, a figure we broke down by province in our Canadian hiring-cost analysis. Automating compliance (AI statements, ranges, traceability) keeps these obligations from turning into extra administrative hours.

A four-step compliance rollout plan

Faced with this pile-up of obligations, the best approach isn't to tackle everything at once, but to proceed in order of risk and effort.

1. Map your obligations. List the provinces where you recruit and your headcount. That determines which rules apply: AI disclosure and salary ranges in Ontario depend on the 25-employee threshold, while Law 25 applies from the very first candidate in Quebec.
2. Fix your public postings first. This is the most visible part and the most easily penalized. Add salary ranges and the AI-use statement where required. Ideally, automate the generation of these statements to avoid omissions at scale.
3. Secure your decision processes. Make sure no rejection is sent without human validation, set up an audit log of AI-assisted decisions, and document who validates what. This is the heart of Law 25 compliance.
4. Structure data management. Define and apply retention periods, collect clear consent, and set up a mechanism to respond to candidates' access and deletion requests.

An organization that follows this order tackles the highest risk first and spreads out the effort, rather than being paralyzed by the scale of the project.

2026 recruitment compliance checklist

• Your Ontario public postings include a salary range (employers 25+)
• Your public postings disclose AI use when it's involved in selection
• No rejection is sent automatically without human validation (Law 25)
• You collect clear consent for processing candidate data
• You apply defined retention periods to resumes and candidate data
• Every AI-assisted decision leaves an audit trail
• Your salary bands are structured before any posting

If you're a multi-province organization, the prudent rule is to align your practices with the most demanding province: it simplifies your processes and keeps you safe everywhere.

Frequently asked questions about 2026 HR compliance

Does AI disclosure apply to small businesses?

In Ontario, the obligation to disclose AI use in public postings targets employers with 25 or more employees. Below that threshold, the formal obligation doesn't apply, but transparency remains a best practice: a candidate who later discovers an algorithm filtered them loses trust, regardless of company size. In Quebec, by contrast, Law 25 governs candidate-data processing with no headcount threshold.

Do you have to post the exact salary or is a range enough?

Pay transparency obligations cover a compensation range, not a single figure. The range must be realistic, though: an overly wide range (say CAD 40,000 to 120,000) empties the obligation of meaning and can be seen as an attempt to circumvent it. The spirit of the law is to give candidates useful information before they apply.

Is an automated rejection banned in Quebec?

It isn't automated processing that's banned, it's a decision based exclusively on it, with no possibility of human review. Concretely, AI can rank and pre-screen, but a human must validate any rejection before it's sent and the candidate must be able to request a review. That's the human-in-the-loop principle, detailed in our guide to Law 25 recruitment compliance.

How long can you keep a resume?

Law 25 requires keeping personal information only as long as necessary for the purpose it was collected for. In practice, this means defining a retention period (often around two years after last contact), disclosing it to the candidate, and purging data beyond it. Keeping a resume indefinitely "just in case," with no basis and no notice to the candidate, is a classic compliance failure.

Key takeaways

• 2026 moves several HR obligations from advice to law, notably AI and salary disclosure in Ontario.
• In Quebec, Law 25 mandates human-in-the-loop on any automated decision and rigorous handling of candidate data.
• Pay transparency is becoming the national norm, forcing employers to structure their bands.
• Done well, compliance becomes an employer-brand advantage, not just a constraint.

The good news: most of these obligations can be automated. Generating the AI statement based on the posting's context, enforcing human validation before any rejection, tracing every decision and applying retention periods: these are mechanisms that a recruitment platform built for the Canadian market integrates natively. To understand the Quebec regulatory foundation, start with our guide to Law 25 recruitment compliance.