AI hiring compliance audits for
We audit the automated screening, scoring, ranking and chatbot steps inside your ATS against Quebec Law 25, Ontario's ESA Part III.1 and PIPEDA, then hand you findings with the evidence attached. Not a policy template.
YOUR OBLIGATIONS
The obligations attach to the employer using the tool, not to the company that sold it. Below is what each one actually requires of an automated hiring step.
Law 25
Every private-sector employer collecting candidate data in Quebec.
- A decision based exclusively on automated processing must be disclosed to the candidate. On request you must give the personal information used, the reasons and the principal factors, and offer a route to a person who can review the decision (s. 12.1).
- A privacy impact assessment (EFVP) is required before any project that involves personal information, and before candidate data is communicated outside Quebec (ss. 3.3, 17).
- Technology with identification, location or profiling functions must be disclosed, with those functions off by default (s. 8.1).
- A database of biometric characteristics must be declared to the Commission d'accès à l'information at least 60 days before it goes into service (Act to establish a legal framework for information technology, s. 45).
ESA Part III.1 – Job Postings
Employers with 25 or more employees, for publicly advertised postings. In force since January 1, 2026.
- A posting must state that artificial intelligence is used to screen, assess or select applicants when it is (s. 8.4).
- A posting may not require “Canadian experience” (s. 8.5).
- Postings and every application form received under them must be kept for three years (s. 8.6).
PIPEDA
Federally regulated employers, and the ATS and AI vendors processing candidate data on your behalf where no provincial law substitutes for it.
- Consent must be meaningful: a candidate has to be able to understand what the automated step does with their data before they apply (Principle 4.3).
- Individuals can ask what personal information is held about them, how it was used and to whom it was disclosed, and challenge its accuracy (Principle 4.9).
- Accountability follows the data to the vendor: a scoring model run by a third party is still your decision (Principle 4.1.3).
Human rights codes
Every employer, every posting, with or without AI.
- Application forms and interviews may not seek information about a prohibited ground unless it is a genuine occupational requirement (Quebec Charter s. 18.1; Ontario Code s. 23). A chatbot asking the question is still the employer asking.
- A neutral rule that screens out a protected group disproportionately is discrimination unless it is justified. A knockout criterion in a scoring model is a neutral rule.
ONE AUDIT, SIX CHECKS
Each check answers one question a regulator, a tribunal or a candidate's lawyer could ask you tomorrow. Each ends in a finding with evidence you can hand to counsel.
Human Review Check
Is your human review real?
Whether a person actually reviews the AI's hiring decisions or just clicks approve. We measure review speed per decision (a review under five seconds is not oversight), whether reviewers ever override the model in both directions, and whether near-identical candidates get the same outcome across different reviewers.
What you get
- Review-latency distribution per reviewer and per stage
- Override rate, split by direction (AI reject → human accept, and the reverse)
- Consistency score across reviewers on matched candidates
Hidden Criteria Check
What is your AI secretly rejecting people for?
The actual rules the hiring software applies, not the ones in the vendor brochure. We extract every knockout and weighting criterion from the live configuration and flag those that could be illegal: a driver's licence for a desk job, “Canadian experience”, gaps in employment, postal codes. Any face, voice or video scoring tool is treated as a hidden rejection factor, because in Quebec it is also a biometric database.
What you get
- Inventory of every automated screening criterion, with its source (vendor default, your configuration, learned weight)
- Each criterion rated for adverse-impact risk
- Biometric exposure statement, including whether the CAI declaration was made
Bias Test
Does your AI treat people differently based on name or background?
A batch of near-identical test applications, varying only name, age signals and school, sent through your live pipeline. We compare outcomes pair by pair. Applications are flagged as tests and withdrawn once the run is complete.
What you get
- Outcome deltas for each varied attribute, with sample sizes
- Stage at which divergence appears (parse, score, rank, chatbot)
- Reproducible test set so you can re-run after remediation
Disclosure Check
Are you disclosing your AI use the way the law requires?
Every point at which AI touches the hiring process, mapped against what Ontario and Quebec require you to say, where, and when. If a biometric tool is in use, we also check whether it was reported to Quebec's privacy regulator at least 60 days before it went live.
What you get
- Touchpoint map: each automated step against the notice a candidate actually saw
- Gap list by jurisdiction, with draft wording
- CAI declaration status and timeline
Chatbot Compliance Check
Is your hiring chatbot asking questions it legally shouldn't?
Screening and interview questions produced by the chatbot, tested against the same human-rights standard that applies to a live interviewer: age, family status, disability, immigration status, religion. This is legal exposure, not a security test. We drive the conversation the way candidates do and record what it asks and infers.
What you get
- Transcript corpus with each prohibited-ground question flagged
- Inference log: what the bot concluded from answers it should not have sought
- Configuration changes that close each gap
Quebec Privacy Filing (EFVP)
Do you have the assessment Quebec requires before using AI in hiring?
The formal written privacy impact assessment (évaluation des facteurs relatifs à la vie privée) required before a project involving personal information. Delivered in French. Includes whether candidate data crosses the US border, on what basis, and, where biometrics are involved, whether the consent collected is specific enough for that exact use.
What you get
- Complete EFVP, in French, ready to file or to keep on record
- Cross-border data flow inventory with the contractual basis for each transfer
- Biometric consent adequacy opinion
REACH OUT FOR MORE INFORMATION
Tell us which ATS you run, where you hire, and what is automated. We reply to set up a short scoping call. No pricing page, no booking widget: this starts with a conversation.
Contact Us
HOW THE AUDIT RUNS
Nothing in your pipeline is changed. Everything is worked from exports you control and from the public application flow.
Scoping
Which ATS, which AI features are switched on, which provinces you hire in, headcount, and whether any video or voice assessment is in use. This fixes which of the six checks apply.
Configuration and log review
Read-only exports of screening rules, scoring configurations and reviewer decision logs. Checks 01, 02 and 04 are built from these.
Live tests
Matched test applications and scripted chatbot sessions through a posting of your choice. Checks 03 and 05. Test records are flagged and withdrawn at the end of the run.
Report
Findings ranked by exposure, each with its evidence and the obligation it triggers, a remediation order, and disclosure wording per jurisdiction. Quebec clients receive the EFVP alongside, in French.
WHAT LANDS ON YOUR DESK
Findings memo
Every finding stated as a fact, ranked by exposure, tied to the obligation it triggers.
Evidence appendix
The logs, configurations, transcripts and test outcomes each finding rests on. Written so counsel can use it.
Disclosure map
Each AI touchpoint against what a candidate was told, with draft notice wording for Ontario and Quebec.
Remediation order
What to fix first, what can wait, and what is only a documentation gap.
EFVP
The Quebec privacy impact assessment, in French, including cross-border and biometric consent analysis.
WHO THIS IS FOR
A fit if
- You hire in Quebec or Ontario through an ATS such as Workday, SuccessFactors, Greenhouse, Lever, iCIMS, Taleo or SmartRecruiters.
- At least one automated step decides which candidates a human ever sees: parsing, scoring, ranking, a chatbot screen or a video assessment.
- You lead HR, legal or the company itself, you know there is exposure, and you need its size before deciding what to do about it.
Not a fit if
- You are a vendor looking for a certification. We audit deployments, not products.
- You need a legal opinion. Findings are technical and evidenced; your counsel decides what follows.
FREQUENTLY ASKED QUESTIONS
REACH OUT FOR MORE INFORMATION
Tell us which ATS you run, where you hire, and what is automated. We reply to set up a short scoping call. No pricing page, no booking widget: this starts with a conversation.
Email:
info@shikitech.comCall:
+1-438-820-4567Working Time:
09:00 AM to 06:00 PM (EST)
Location:
3 Place Ville Marie,suite 400, Montréal, QC,
H3B 2E3