The short version
- Since 1 January 2026, Ontario employers with 25 or more employees must state in publicly advertised job postings whether AI is used to screen, assess or select applicants.
- Federal privacy reform is back. Bill C-36 was introduced on 15 June 2026 and would replace Part 1 of PIPEDA with a new statute. It is not law yet.
- Quebec's Law 25 is fully in force and is the strictest private sector privacy regime in the country.
- Continuous criminal monitoring does not work in Canada the way it does in the United States. Canadian criminal record checks are point in time and require fresh consent each time.
- Vulnerable sector checks still cannot be automated by any third party. They are done in person at a local police service.
- Identity verification has moved from a separate step to the front door of the criminal record check.
Most background screening content written for Canada is recycled American content. It talks about county court feeds, FCRA adverse action, and always-on criminal alerts, none of which apply here in the same way.
This article covers what is genuinely changing for Canadian employers in 2026, and just as usefully, what is not.
1. AI disclosure is now a hiring rule, not a talking point
This is the biggest practical change of the year for Canadian recruiters.
As of 1 January 2026, Ontario's Employment Standards Act requires employers with 25 or more employees to disclose the use of artificial intelligence in publicly advertised job postings, where that AI is used to screen, assess or select applicants. The definition is broad. It covers resume parsers that rank candidates, chatbots that pre-screen, and any automated system that scores or shortlists.
Unofficial guidance published by the Ministry of Labour in February 2026 indicates that a plain statement is sufficient. Employers do not need to describe how the system works.
The same set of amendments brought in four other requirements for the same employers:
- Expected compensation or a compensation range must appear in the posting
- Canadian experience requirements are prohibited in postings and application forms
- Interviewed applicants must be told whether a decision has been made, within 45 days of the last interview
- Postings and application forms must be retained for 3 years after the posting comes down
For staffing agencies posting on behalf of clients, this matters twice over. The obligation sits with the employer, and the agency is usually the one writing the ad.
What this means for screening: if your screening step involves automated scoring or automated adjudication of results, that is worth reviewing against the disclosure rule. Automation that collects consent, chases references and assembles a report is administrative. Automation that decides who advances is not, and it is the second kind that draws scrutiny under human rights law as well as under the ESA.
Sources: Ontario ESA job posting rules, Fasken, Koskie Minsky
2. Federal privacy law is being rewritten, again
PIPEDA was written in 2000 and is still the federal law governing how personal information is collected and used in commercial activity, including background screening.
Two earlier attempts to replace it failed. Bill C-11 did not proceed in 2020. Bill C-27 died on the Order Paper in January 2025 when Parliament was prorogued.
On 15 June 2026, the federal government introduced Bill C-36. If passed, it would enact the Protecting Privacy and Consumer Data Act, repeal Part 1 of PIPEDA, and rename what remains the Electronic Documents Act. It includes documented privacy management programs, more detailed consent rules, a right to disposal of personal information, privacy impact assessments for international transfers, and far higher penalties than PIPEDA allows today.
It is a bill, not a law. Nothing about it is in force.
Meanwhile the provinces have not waited. Quebec finished rolling out Law 25 in September 2024. Alberta and British Columbia have their own Personal Information Protection Acts. In practice, many national employers have already standardized on the strictest rule in their footprint rather than the federal floor.
What this means for screening: the direction of travel is consistent across every one of these regimes. Collect less, state the purpose plainly, keep it for a defined period, and be able to show your consent trail. That is worth building now regardless of what happens to Bill C-36 this autumn.
Sources: Blakes on Bill C-36, Filion Wakely
3. Continuous monitoring means something different in Canada
American screening vendors market continuous criminal monitoring as a standard product. It is a real product and it works, because of how records are held in the United States.
Criminal records there sit in thousands of county and state court systems, many of which publish or license their filings. A monitoring service subscribes to those feeds and matches new filings against an enrolled workforce. The same approach is used for driving records, professional licences, and federal sanctions and exclusion lists. When something new appears, the employer gets an alert.
Three things are worth knowing before assuming it transfers
- Under the Fair Credit Reporting Act, ongoing monitoring needs disclosure and authorization that expressly cover checks during employment, not just a pre-hire consent. Acting on an alert triggers the adverse action process.
- Several states add their own restrictions on top.
- Most alerts are new arrests or filings, not convictions. An arrest is not proof of conduct, and treating it as one is where employers get into trouble.
| Mechanism | United States | Canada |
|---|---|---|
| Record source | County and state court feeds | RCMP CPIC, police services only |
| Third party access | Subscription or licence | Not available directly |
| Consent model | Standing authorization for the employment period | Informed consent per search |
| Practical equivalent | Always-on alerts | Scheduled re-screening |
That model does not transfer to Canada. Background screening providers cannot query CPIC directly. The Canadian Police Information Centre is maintained by the RCMP and access is restricted to police services and authorized agencies. There is no equivalent set of public court feeds to subscribe to. A Canadian criminal record check is run by an accredited police partner, on request, against a signed informed consent from the candidate.
Consent is per check. There is no standing authorization that lets a provider re-run a candidate quietly every month.
So continuous monitoring in Canada is really scheduled re-screening: running a fresh check at a defined interval, with fresh consent, usually annually or on role change. That is a real risk control and worth building into policy for safety sensitive roles. It is just not the always-on product the marketing implies.
What this means for screening: if a vendor sells you continuous Canadian criminal monitoring, ask exactly what data source produces the alert and what consent covers it. If you are placing workers on both sides of the border, expect two different screening policies rather than one, because the underlying record systems are not comparable. See international checks for cross-border coverage.
Source: CPIC access and third party limits
4. Identity verification became the front door, not an add-on
The old model was an in-person ID check or a scanned driver's licence emailed to a recruiter. The current model is a document scan plus a liveness check, completed by the candidate on their phone, before the record search runs.
The reason is straightforward. A name-based criminal record check is only as good as the name behind it. Verifying who is submitting is the step that makes the rest of the result meaningful.
Two things worth being precise about, because vendors are often vague here
- A name-based check compares name and date of birth against the criminal names index. It is not a fingerprint check.
- A certified criminal record can only be issued on the basis of fingerprints submitted to the RCMP National Repository. Digital identity verification does not change that.
Credibled bundles identity verification into the criminal record check rather than billing it as a separate line.
5. Reference checking is where automation actually pays off
Criminal record checks were already fast. The slow part of most hiring workflows is references, and it is slow for a human reason: a recruiter leaves a voicemail, the referee does not call back, the file sits for a week.
Automated reference checking replaces the chasing, not the judgment. The request goes out, reminders run on a schedule, answers come back in a structured written format, and the whole exchange is timestamped.
The structured part matters more than the speed. A written, consistent set of answers across every candidate is defensible in a way that a recruiter's phone notes are not.
More on how this works: reference verification.
6. Social media screening keeps growing and keeps needing guardrails
Employers are looking at public digital footprints more than they were five years ago. The legal exposure has not moved.
A hiring manager searching a candidate personally sees everything: age, ethnicity, religion, family status, disability, all protected grounds under federal and provincial human rights legislation. Once seen, it cannot be unseen, and it is very hard to prove it played no part in the decision.
A properly run social media check is done by a third party, scoped to defined risk categories, and reports only what is job relevant. Protected characteristics are filtered out before the employer sees the report.
The trend is not more social media screening. It is more disciplined social media screening.
7. What is not changing, despite what you will read elsewhere
Blockchain credential wallets. Discussed for a decade. There is no meaningful adoption in Canadian hiring and no infrastructure behind it. Ignore it.
Predictive risk scoring. Systems that claim to forecast future conduct from past records sit directly in the path of human rights law, and now the Ontario disclosure rule as well. This is a liability, not a feature.
Vulnerable sector checks. Still only available in person at a local police service. No third party can automate them today. Any provider claiming otherwise is describing something else. If you are hiring into healthcare, childcare or education facing roles, plan for the in-person step.
Psychometrics as part of a background check. Assessment and verification are different products with different legal footing. Blending them in a single report is a bad idea.
What Canadian employers should do this year
- Audit your job postings against the Ontario rules if you have 25 or more employees in the province.
- Write down whether any tool in your hiring stack scores or ranks applicants, and disclose it if it does.
- Set a retention period for screening records and actually apply it.
- Define a re-screening interval for safety sensitive roles instead of relying on a check from four years ago.
- Confirm where your screening provider stores candidate data and who can access it.
- Route social media screening through a third party rather than doing it in the recruiter's browser.
Run Canadian checks without the subscription
Credibled runs Canadian criminal record checks, identity verification and automated reference checks online, pay per check, with no subscription.
Frequently asked questions
Yes. Since 1 January 2026, employers with 25 or more employees must state in publicly advertised job postings whether artificial intelligence is used to screen, assess or select applicants. Ministry of Labour guidance indicates a short plain statement is enough.
Yes. PIPEDA remains in force. Bill C-36, introduced on 15 June 2026, would replace Part 1 of it with the Protecting Privacy and Consumer Data Act, but the bill is still before Parliament.
Not in the American sense. Third party providers cannot access CPIC directly, and Canadian criminal record checks require informed consent for each search. The practical equivalent is scheduled re-screening with fresh consent.
US monitoring services subscribe to county and state court record feeds and match new filings against enrolled workers. Canada has no equivalent feed. Criminal record information sits with the RCMP in CPIC, third party providers cannot query it directly, and each search needs its own informed consent.
No. Vulnerable sector checks are only available in person at a local police service. No third party provider can automate them.
No. A name-based check compares name and date of birth against the criminal names index. A certified criminal record requires fingerprints submitted to the RCMP National Repository.
There is no single national rule. Ontario now requires publicly advertised job postings and application forms to be kept for 3 years after the posting is removed. For screening results, set a defined retention period tied to the purpose of collection and apply it consistently.