Every rule that governs AI in hiring and in small business. What it requires, what it does not, and where we fall short.

Providers and deployers of AI systems placed on the market or used in the EU. Article 50 splits by role: paragraphs 1 and 2 bind the PROVIDER, paragraphs 3 and 4 bind the DEPLOYER. No size threshold.

• 01As deployer of an emotion-recognition or biometric-categorisation system: inform the people exposed to it that it is operating, and process their data under the GDPR.
• 02As deployer publishing AI-generated or manipulated image, audio or video: disclose that the content is artificial.
• 03Provide that information clearly and at the latest at the moment of first interaction or exposure.

• 01As provider of a system that interacts directly with a person: design it so the person is informed they are interacting with an AI, unless that is obvious.
• 02As provider of a system generating synthetic audio, image, video or text: mark the output in a machine-readable format detectable as artificially generated.
• 03Generative systems already on the market before 2 August 2026 have until 2 December 2026 to comply with the Article 50(2) marking duty (new Art. 111(4)).

• 01No general 'we used AI to assess you' notice. Article 50(1) bites on systems a person interacts with — a recruiting chatbot or an AI interviewer — not on a CV-screening engine the candidate never converses with. That gap is exactly what Ontario s. 8.4 fills.
• 02No conformity assessment, no registration in the EU database, no risk-management system. Those are the Chapter III high-risk duties, deferred to 2 December 2027 (see EU-02).
• 03No bias audit and no human-review right.
• 04The text-disclosure duty in 50(4) applies only to text published to inform the public on matters of public interest, and not where a human exercised editorial control.

Set by Member States under Article 99. Breach of Article 50 transparency duties is subject to administrative fines up to EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher, with proportionate caps for SMEs.

Two exposures, both ours rather than a customer's. First: our terms of service and privacy policy still describe voice-tone and emotional-tone analysis the product does not perform. If the documents were accurate, deployers of BitStage would be pulled into the Article 50(3) emotion-recognition notice duty that took effect on 2 August. They are not accurate, and they are still live — open since 22 July. Second: The Signal Minute is presented by a synthetic anchor. We disclose that in words on every episode, which is more than most, but Article 50(2) requires machine-readable marking, and the transitional in Article 111(4) gives us until 2 December 2026 to do it. We have not done it yet.

→ Ledger entry 0001

C3, C4

“the natural persons concerned are informed that they are interacting with an AI system”

Reg. (EU) 2024/1689, Art. 50(1)

Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 50; application date per Article 113, second paragraph. OJ L, 2024/1689, 12.7.2024.

Developers and deployers of high-risk AI systems making or substantially factoring into a consequential decision, which expressly includes employment. A narrow exemption applies to deployers with fewer than 50 full-time employees that do not train the system on their own data.

• 01Use reasonable care to protect against known or reasonably foreseeable risks of algorithmic discrimination.
• 02Implement a risk-management policy and programme, and complete an impact assessment.
• 03Review the system annually to confirm it is not causing algorithmic discrimination.
• 04Notify a consumer when a high-risk AI system makes or substantially influences a consequential decision about them.
• 05Give an opportunity to correct inaccurate personal data used in the decision, and an appeal with human review where technically feasible.
• 06Disclose to a consumer that they are interacting with an AI system before the interaction occurs.
• 07Report discovered algorithmic discrimination to the Colorado Attorney General within 90 days.

• 01As developer: use reasonable care against algorithmic discrimination, and supply deployers the documentation they need to complete their own impact assessments.

• 01No independent third-party audit. The impact assessment is a self-assessment.
• 02No pre-approval, licensing or registration with the state.
• 03No private right of action — the Attorney General has exclusive enforcement.

Enforcement is exclusively by the Colorado Attorney General as a deceptive trade practice under the Colorado Consumer Protection Act. Rebuttable presumption of reasonable care where the statutory duties are met.

Of every row here, this is the one that most directly demands what we say we already do: notice, an explanation, a correction route, and human review. Whether BitStage's recruiter-verification step meets the 'appeal with human review' standard as drafted has not been assessed on the record. We suspect it does. Suspecting is not the same as having checked, which is the whole point of this publication.

B2, B4, B5

“The act extends the effective date of the requirements of Senate Bill 24-205 to June 30, 2026.”

SB 25B-004

Colorado SB 24-205 (Consumer Protections for Artificial Intelligence), signed 17 May 2024; effective date extended to 30 June 2026 by SB 25B-004, approved by the Governor 28 August 2025.

Colorado General Assembly, SB 24-205 bill page and enacted text.

Any person who conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an AI system in Texas. No employer-size threshold and no employment-specific trigger. Several of the heavier duties bind governmental entities only. Local AI ordinances are preempted.

• 01Refrain from developing or deploying an AI system with the intent to unlawfully discriminate against a protected class.
• 02Refrain from deploying AI intended to incite self-harm, harm to others, or criminal activity.
• 03That is substantially the whole of it for a private employer. Substantially complying with the NIST AI Risk Management Framework is an affirmative defence, not a duty.

• 01The same intent-based prohibitions apply symmetrically to developers. There is no documentation, model-card, impact-assessment, audit or disclosure-to-deployer obligation.

• 01No impact assessments, algorithmic audits or bias testing of any kind.
• 02No notice to applicants or employees that AI is in use.
• 03No registration, inventory or filing with the state for private employers.
• 04No general duty for a private business to disclose that a person is talking to an AI — that provision reaches governmental agencies, plus a health-care carve-in.
• 05Nothing is triggered by disparate impact. The statute says so expressly, and this is the single most misread thing about it.
• 06No private right of action.

Attorney General has exclusive enforcement, with mandatory written notice and a 60-day cure period. Civil penalties of $10,000–$12,000 for a curable violation, $80,000–$200,000 for an uncurable one, and $2,000–$40,000 per day for a continuing violation.

We include this row because of what it does not do. TRAIGA requires intent, and expressly forecloses disparate impact as a route to liability — so despite being the most-cited new AI statute of the year, it imposes almost nothing on a private employer using AI to hire. Any vendor selling TRAIGA compliance is selling you something you do not need. Your Title VII and Texas Commission on Human Rights Act exposure is entirely untouched by it.

C1, C4

“a disparate impact is not sufficient by itself to demonstrate an intent to discriminate”

Tex. Bus. & Com. Code § 552.056(c)

Texas Responsible Artificial Intelligence Governance Act, Act of 30 May 2025, 89th Leg., R.S., H.B. 149, codified at Tex. Bus. & Com. Code tit. 11, subtit. D, chs. 551–554. Signed 22 June 2025; effective 1 January 2026.

Office of the Texas Attorney General, Consumer AI Rights and complaint mechanism.

Any employer already covered by the Illinois Human Rights Act — broadly, one or more employees in Illinois for 20 or more calendar weeks. No AI-specific size threshold.

• 01Stop using AI that has the effect of discriminating on a protected basis in recruitment, hiring, promotion, renewal, training selection, discharge, discipline, tenure, or terms and conditions of employment.
• 02Stop using zip code as a proxy for a protected class.
• 03Notify an employee that AI is being used for any of those purposes.

• 01Nothing. The statute imposes no duty on the tool vendor.

• 01No bias audit, impact assessment or third-party testing of any kind.
• 02No ban on AI in employment decisions — use is lawful so long as it is non-discriminatory and noticed.
• 03No consent, no opt-out, no right to request a human alternative.
• 04No disclosure of the vendor, the model, the data sources, the logic, or what the tool weighs.
• 05No publication of anything, no filing with the Department, no AI-specific recordkeeping.
• 06The notice duty as drafted runs to an 'employee'. The prohibited-use clause reaches recruitment and hiring, but the notice subsection does not on its face extend to external applicants.

Enforced as an ordinary civil rights violation through the Illinois Department of Human Rights and the Human Rights Commission. No AI-specific penalty and no separate private right of action.

The duty sits on the employer, not on us. Worth flagging for any customer hiring in Illinois: the statute delegates the content, timing and means of the notice to the Department, and as of today the Department has adopted no such rules. There is a duty with no standard attached to it. Anyone telling you exactly what an Illinois AI notice must say is telling you more than the law does.

C3, C1

“For an employer to fail to provide notice to an employee that the employer is using artificial intelligence”

775 ILCS 5/2-102(L)(2)

775 ILCS 5/2-102(L), as added by Public Act 103-0804 (HB 3773), eff. 1 January 2026; definitions at 775 ILCS 5/2-101(M)–(N).

Illinois Department of Human Rights, Rules and Regulations index (no artificial-intelligence Part adopted as of 6 August 2026).

Employers with 25 or more employees on the day a posting is posted. Head-count, not FTE — part-time, casual, probationary, laid-off and on-leave employees each count as one, aggregated across all Ontario locations. Applies to a 'publicly advertised job posting': an external posting advertised to the general public in any manner. Excludes general recruitment campaigns, help-wanted signs, internal-only postings, and work performed outside Ontario. The Crown and its agencies are exempt.

• 01State in the posting that AI is used, where AI is used to screen, assess or select applicants — including where a third-party recruiter does the screening on your behalf.
• 02Disclose expected compensation or a range; a stated range may not span more than $50,000/yr. Exempt above $200,000/yr.
• 03State whether the posting is for an existing vacancy.
• 04Tell every interviewed applicant whether a hiring decision has been made, within 45 days of their last interview.
• 05Omit any Canadian-experience requirement from the posting and any associated application form.
• 06Retain each posting and any associated application form for 3 years after public access is removed, and the interview follow-up for 3 years from the day it was given.

• 01Nothing directly. The duty sits on the employer even when the vendor does the screening — so the practical vendor obligation is to give customers the disclosure language and to tell them plainly that AI is in the loop.

• 01No bias audit, impact assessment or testing of any kind.
• 02No description of which tool is used or how it works. The Ministry's own guide states a bare statement that AI is used is enough.
• 03No candidate consent, no opt-out, no right to a human alternative, no accommodation process.
• 04No duty to fill the vacancy, to hire at the posted compensation, or to say who was hired.

Compliance orders and notices of contravention from an employment standards officer; prescribed monetary penalties of $250 / $500 / $5,000 for first, second and third contraventions in a three-year period. Prosecution under s. 132 carries fines up to $100,000 for an individual and $100,000 / $250,000 / $500,000 for a corporation on successive convictions. Reports go to PubliclyAdvertisedJP@ontario.ca; enforcement is ministry-initiated.

This is our home jurisdiction and the row most likely to bind our customers. Whether BitStage ships ready-to-paste s. 8.4 disclosure language with every role has not been assessed on the record. Until it is, this row says so.

C3

“shall include in the posting a statement disclosing the use of the artificial intelligence”

ESA, 2000, s. 8.4(1)

Employment Standards Act, 2000, S.O. 2000, c. 41, Part III.1 (ss. 8.1–8.7); artificial intelligence defined in O. Reg. 476/24, s. 2(1). E-Laws currency date 31 July 2026.

Ontario Ministry of Labour, Immigration, Training and Skills Development, 'Requirements related to publicly advertised job postings' (updated 24 February 2026).

Employers regularly employing five or more individuals; part-time and out-of-state employees count toward the five. Public entities regardless of size. Critically, an agent acting for an employer in recruitment, screening or hiring — including through an automated-decision system — is itself an employer under these regulations, which pulls vendors directly into scope.

• 01Stop using any automated-decision system, selection criterion or proxy that discriminates on a protected basis.
• 02Be able to show that any ADS selection device with adverse impact is job-related and consistent with business necessity.
• 03Retain records for four years — extended from two — expressly including automated-decision system data and selection criteria.
• 04Preserve all relevant records, including ADS data, once on notice of a complaint, until proceedings and appeals are finally terminated.
• 05Provide reasonable accommodation where an ADS assessment or video-interview analysis may screen out applicants protected by disability or religious creed.
• 06Build an accommodation-request mechanism into any online application technology that screens, ranks or prioritises on schedule or availability.
• 07Keep ADS-administered tests from operating as a pre-offer medical or psychological examination or a disability-related inquiry.

• 01Comply as an employer. Section 11008(e)(3) makes an agent an employer, so a screening vendor carries the same duties directly rather than by contract.

• 01No mandated bias audit. Anti-bias testing is evidentiary, not obligatory — the presence or absence of it is relevant to a claim or defence, but nothing requires it, sets a method, or sets a cadence.
• 02No applicant notice. Nothing in the package requires telling an applicant that an ADS is in use, what it measures, or what it produced.
• 03No ban on anything. ADS use, video-interview analysis and game-based assessment all remain lawful; liability runs through ordinary discrimination analysis.
• 04No registration, no impact assessment, no audit filing, no opt-out, no human-review right.
• 05Creates no new cause of action — enforcement runs through existing FEHA channels.

No new penalty regime. Remedies are the existing FEHA remedies pursued through the Civil Rights Department and the courts.

This is the row that names our category in regulation: the definition expressly reaches 'analyzing facial expression, word choice, and/or voice in online interviews'. Our stated scoring position is that the model reads the transcript only — word choice, not face or voice. Whether that position is documented well enough to survive a records request, and whether we retain ADS data for the required four years, has not been assessed on the record.

A2, C4, B5

“A computational process that makes a decision or facilitates human decision making regarding an employment benefit”

Cal. Code Regs. tit. 2, § 11008.1(a)

Cal. Code Regs. tit. 2, div. 4.1, ch. 5, subch. 2 — new § 11008.1; §§ 11008, 11009, 11013, 11016, 11017, 11071 and others amended. Civil Rights Council, 'Modifications to Employment Regulations Regarding Automated-Decision Systems', OAL Matter No. 2025-0515-01, approved and filed 27 June 2025.

Office of Administrative Law, Notice of Approval of Regulatory Action (effective 1 October 2025).

Employers and employment agencies, with no size threshold, where the job is located in New York City at least part-time — or is fully remote but attached to a New York City office. The audit and publication duties turn on the job's location; the notice provision is drafted around a candidate who resides in the city, and those two triggers are not textually identical.

• 01Ensure an independent auditor performed a bias audit no more than one year before use, and stop using the tool once a year has passed.
• 02Use historical data of the tool for the audit; test data only where historical data is insufficient, with an explanation in the summary.
• 03Publish on your website, before use, the date of the most recent audit, a summary of results including selection or scoring rates and impact ratios, and the tool's distribution date — and keep it up for six months after last use.
• 04Notify candidates at least 10 business days before use, with instructions for requesting an alternative selection process or accommodation.
• 05Disclose the job qualifications and characteristics the tool will assess.
• 06Publish, or supply within 30 days of written request, the type and source of data collected and the retention policy.

• 01Nothing. The Department's own FAQ states the vendor that created the tool is not responsible for the audit — the employer is. A vendor may commission an audit, but the auditor is not independent if it has a financial interest in the vendor, so a vendor-paid audit needs care before an employer relies on it.

• 01No ban on automated tools, and no requirement that a human review the output.
• 02No duty to actually grant an alternative selection process — only to allow a candidate to request one.
• 03No publication of the full audit report; the summary of results and distribution date suffice.
• 04No auditor licensure, accreditation or registration. 'Independent auditor' is defined functionally.
• 05No filing with the Department and no pre-approval.
• 06Does not reach tools that merely inform rather than substantially assist or replace discretionary decision-making.

Not more than $500 for a first violation, and $500 to $1,500 for each subsequent violation. Each day a tool is used in violation is a separate violation, and each failure to give notice is a separate violation. Injunctive relief available to corporation counsel.

The audit duty is the customer's, not ours — but the customer cannot discharge it without data from us, and the independence rule means we cannot simply hand them an audit we paid for and call it done. Whether BitStage can supply the historical selection-rate and impact-ratio data an independent auditor would need has not been assessed on the record.

C3, C1, C4

“has been the subject of a bias audit conducted no more than one year prior to the use of such tool”

N.Y.C. Admin. Code § 20-871(a)(1)

N.Y.C. Local Law No. 144 (2021), N.Y.C. Admin. Code §§ 20-870 to 20-874; implementing rules 6 RCNY §§ 5-300 to 5-304. DCWP enforcement from 5 July 2023.

NYC Department of Consumer and Worker Protection, AEDT Frequently Asked Questions.

Providers and deployers of AI systems intended for the recruitment or selection of natural persons — placing targeted job advertisements, analysing and filtering applications, and evaluating candidates. Also promotion and termination decisions, task allocation, and performance monitoring under point 4(b).

• 01Nothing yet. The obligations below do not bite until 2 December 2027.
• 02From that date, as deployer: assign human oversight to a competent person, use the system per its instructions, monitor operation, keep logs, inform workers' representatives and affected workers before putting it into service, and give an affected person an explanation of the role the system played in a decision.

• 01Nothing yet.
• 02From 2 December 2027, as provider: operate a risk-management system, meet data-governance standards, produce technical documentation, enable logging, ensure accuracy, robustness and cybersecurity, undergo conformity assessment, register in the EU database, and affix CE marking.

• 01Nothing at all today. Any vendor selling on the basis that EU high-risk hiring rules are already live is wrong, and any buyer being hurried on that basis is being hurried on a false premise.
• 02The deferral is not a repeal. The requirements were postponed because national authorities and harmonised standards were not ready — not because they were abandoned.
• 03It does not defer Article 50. Those transparency duties took effect on 2 August 2026 and are unaffected (see EU-01).

From the application date, Article 99 fines up to EUR 15 000 000 or 3% of worldwide annual turnover for breach of provider or deployer high-risk obligations.

A 60-second scored role rehearsal used to evaluate candidates falls squarely inside Annex III point 4(a). We have roughly sixteen months. We would rather say that plainly than let the deferral read as a reprieve — the honest position is that we are not yet built to the Chapter III standard and the clock is running.

C3

“2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III”

Reg. (EU) 2026/1744, Art. 1(40)(b)

Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689, Art. 1(40)(b), replacing Art. 113 third paragraph point (c). OJ L, 2026/1744, 24.7.2026; in force 27 July 2026. Annex III point 4(a) of Reg. (EU) 2024/1689 unamended.

European Commission, 'AI Omnibus enters into force' (Digital Strategy newsroom).

Any supplier using generative artificial intelligence to interact with a person in a consumer transaction, and separately anyone providing services in a licensed or state-certified occupation. No size threshold, and it reaches out-of-state sellers dealing with Utah consumers. The definition is narrow: the system must be designed to simulate human conversation and produce unscripted output. A scripted chatbot or a recommendation engine falls outside it.

• 01If a customer clearly and unambiguously asks whether they are speaking to a person or a machine, tell them it is artificial intelligence. That is the whole of the duty for an ordinary business.
• 02If you hold a professional licence: disclose proactively, but only where the interaction collects sensitive personal information or gives personalised financial, legal, medical or mental-health advice.
• 03Deliver that disclosure verbally at the start of a spoken interaction, and in writing before a written one.
• 04Consider taking the statutory safe harbour: disclose clearly at the outset and throughout that the system is artificial intelligence and not a person. Doing so removes exposure entirely.

• 01Nothing. Every duty sits on the business or the licensed individual. A vendor whose product ships with a permanent notice that it is an artificial intelligence assistant hands its customer the safe harbour, which is a commercial argument rather than a legal obligation.

• 01No proactive notice for an ordinary business. The 2025 amendment repealed the earlier provision and added the requirement that the customer ask clearly and unambiguously first.
• 02Proactive disclosure for licensed occupations is now limited to high-risk interactions, not every interaction. That is a substantial narrowing from the original 2024 law.
• 03No registration, impact assessment, audit, bias testing, record-keeping or inventory.
• 04No obligation to label AI-generated marketing content, images or copy.
• 05No private right of action.

Administrative or court fine up to $2,500 per violation, plus injunctions, disgorgement, payment to injured individuals, and the Division's costs. Breaching an order carries up to $5,000 per violation.

We do not operate a customer-facing conversational system in Utah. Included because it is the rule most often described to small businesses as requiring a permanent chatbot banner, and after the 2025 amendment it does not.

“shall disclose that the individual is interacting with generative artificial intelligence and not a human, if the individual asks”

Utah Code § 13-75-103(1)(a)

Utah Code sections 13-75-101 to 13-75-106, enacted by Senate Bill 226, Laws of Utah 2025, repealing and replacing section 13-2-12 as enacted by Senate Bill 149, Laws of Utah 2024.

Any person carrying on an enterprise, with no size, revenue, employee or sector threshold, that renders a decision based exclusively on automated processing of personal information. It reaches organisations outside Quebec that collect personal information in connection with Quebec activities.

• 01Tell the person that the decision was based exclusively on automated processing, no later than the moment you tell them the decision itself.
• 02On request, tell them what personal information was used, the reasons and the principal factors and parameters behind the decision, and their right to have that information corrected.
• 03Give them an opportunity to submit observations to a member of your staff who is in a position to review the decision.
• 04Where an outside supplier processes the personal information, have a written contract covering confidentiality, purpose limitation, destruction, breach notification and audit rights.

• 01Section 12.1 binds the enterprise making the decision, not the vendor. In practice your contract must oblige the vendor to give you the factors and parameters, because without them you cannot answer a request.

• 01The factors and parameters are disclosed on request only. Just the bare fact of automated processing is proactive.
• 02It does not apply where a person meaningfully participates in the decision. The trigger is decisions made exclusively by machine.
• 03No registration, licensing, algorithmic impact assessment or filing with the regulator.
• 04No right to opt out, and no right to demand a person re-make the decision — only to make observations to someone able to review it.
• 05No small-business exemption.

Administrative monetary penalties up to $50,000 for a natural person, and for anyone else the greater of $10,000,000 or 2% of worldwide turnover. Penal fines run to the greater of $25,000,000 or 4% of worldwide turnover. Where an unlawful infringement is intentional or results from gross fault, the court awards punitive damages of at least $1,000 on top of compensation.

This is the only in-force statutory duty of its kind in Canada, and it binds anyone making fully automated decisions about people in Quebec. Whether our own products would meet the explanation and review requirements has not been assessed on the record.

B4, B5

“who uses personal information to render a decision based exclusively on an automated processing”

P-39.1, s. 12.1

Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, section 12.1, added by SQ 2021, c. 25.

Any person using a bot to communicate with another person online in California. There is no user threshold on who is caught — the ten-million-visitor figure that appears in most summaries defines a separate term used only to exempt web hosts and internet service providers. A one-person business running a sales chatbot on a low-traffic site is inside the section. The real limit is intent: the bot must be deployed to mislead about its artificial identity in order to incentivise a sale or influence a vote.

• 01If your bot is deployed to drive a sale or influence a vote and could mislead someone into thinking it is a person, disclose that it is a bot.
• 02Make that disclosure clear, conspicuous, and reasonably designed to inform the people it interacts with.

• 01Nothing. The duty is on whoever uses the bot. Service providers of online platforms, including hosts and internet service providers, are expressly exempt.

• 01You do not have to be a large platform to be caught. The ten-million-user threshold is an exemption for infrastructure providers, not a limit on scope. Most published summaries of this law get that backwards.
• 02It does not reach support bots, booking bots or answer bots that are not trying to pass as human to close a sale.
• 03No specific wording, placement, font or permanent banner is prescribed.
• 04No duty to disclose that content was AI-generated. No registration, filing or record-keeping.
• 05No private right of action, and the chapter names no enforcing agency and sets no penalty.

None specified. The chapter contains no fine, no penalty and no designated regulator. Disclosure is a complete defence.

We run no sales bot in California. Included because it is widely cited to small businesses as a compliance burden, and read against its own text it imposes a single sentence of disclosure with no penalty attached.

“A person using a bot shall not be liable under this section if the person discloses that it is a bot.”

Cal. Bus. & Prof. Code § 17941(a)

California Business and Professions Code sections 17940 to 17943, added by Statutes of 2018, chapter 892 (Senate Bill 1001).

Anyone making a representation to the public to promote a product or a business interest. No size, revenue or sector threshold. There is no need to prove anyone was deceived, or that the person reached was in Canada, so website copy, advertisements, decks and app listings all count.

• 01Make no representation about artificial intelligence that is false or misleading in a material respect, judged on the general impression it conveys rather than only its literal words.
• 02Before publishing any claim about what your artificial intelligence does or how well it performs, carry out an adequate and proper test and keep the evidence.
• 03Be ready to discharge the burden of proof yourself. The statute puts proof of adequate and proper testing on the advertiser, not the regulator.
• 04Do not claim to use artificial intelligence if you do not, and do not overstate how autonomously it works.

• 01Nothing distinct. If you republish a vendor's performance figure as your own claim, you carry the burden of substantiating it. A supplier's marketing deck is not an adequate and proper test.

• 01There is no artificial-intelligence-specific substantiation provision in Canadian law. The substantiation paragraphs added in 2024 apply to environmental claims only. Claims about artificial intelligence are caught by the pre-existing general performance provision.
• 02No duty to label AI-generated marketing content, no duty to disclose that you use artificial intelligence, and no algorithm transparency duty.
• 03No pre-clearance or registration of advertising.
• 04Subjective description that is not a performance claim does not trigger the testing duty.

Civil penalties up to the greater of $10,000,000 for a first order or three times the benefit derived, or 3% of annual worldwide gross revenues where the benefit cannot be determined. Criminal conviction on indictment carries a fine at the court's discretion and up to 14 years. Since 20 June 2025 any person may seek leave to bring a deceptive-marketing application to the Competition Tribunal where it is in the public interest, a markedly lower bar than applies to other conduct.

Our home jurisdiction, and the one that most directly governs how we describe our own work. Whether every performance claim we publish was tested before it was published has not been assessed on the record.

D7

“not based on an adequate and proper test thereof, the proof of which lies on the person making the representation”

Competition Act, s. 74.01(1)(b)

Competition Act, RSC 1985, c. C-34, sections 52, 74.01(1)(a) and 74.01(1)(b); private access to the Tribunal under section 103.1 from 20 June 2025.

Competition Bureau, consultation on artificial intelligence and competition: What We Heard report, 27 January 2025.

Any person, partnership or corporation in or affecting commerce. No size, revenue, sector or geography threshold — a sole trader advertising an AI-powered service is caught on the same terms as a platform. Banks, common carriers and some non-profits sit outside the Commission's jurisdiction.

• 01Hold competent and reliable evidence for every objective claim about what your AI does — and hold it at the moment the claim is first made, not afterwards.
• 02Hold that evidence again each time the claim is repeated.
• 03Do not describe a product as artificial intelligence if the underlying technology is not what a reasonable customer would understand as artificial intelligence.
• 04Do not claim your AI performs better than a non-AI alternative without evidence comparing the two.
• 05Do not use AI to generate reviews, testimonials or endorsements.

• 01Nothing distinct. Section 5 reaches whoever makes the claim. The Commission's one attempt to hold a tool vendor liable for what customers did with its output was reopened and set aside in December 2025, on the reasoning that the complaint did not support the allegation and the order unduly burdened a nascent industry. Vendor liability for downstream misuse is not current policy.

• 01No registration, filing, licence, impact assessment, audit or written AI policy.
• 02No obligation to disclose that you use artificial intelligence internally.
• 03No obligation to label AI-generated marketing copy as AI-generated.
• 04No pre-clearance of advertising.
• 05Substantiation need not be a formal scientific study unless the claim is one professionals would test scientifically.

No civil penalty for a first deception. Remedies are injunctive relief and consumer redress. Civil penalties, currently up to $53,088 per violation, attach only to breaching an existing order or rule. Recent outcomes: a company claiming its AI content detector was 98% accurate when real-world accuracy was around 53% took a consent order and four years of compliance reporting; an AI legal-services claim settled at $193,000; deceptive AI-powered advertising claims cost three media companies close to $1 million in May 2026.

This is the row that carries real money for a small business, and the exposure is not about disclosure at all — it is about performance claims. Barnes Signal Advisor makes claims about what its work does. Whether every one of them is substantiated to this standard, before it was published, has not been assessed on the record.

D7

“each time such representation is made thereafter, they possess and rely upon competent and reliable evidence”

FTC Decision and Order, Docket C-4822

Federal Trade Commission Act section 5(a)(1), 15 U.S.C. § 45(a)(1). Enforcement sweep announced 25 September 2024.

Nobody, today. This row exists to record an absence rather than an obligation.

• 01Nothing. Canada has no federal artificial intelligence statute and has never had one.
• 02What binds a Canadian small business instead: the Competition Act on what you claim, Quebec's section 12.1 if you make fully automated decisions about people in Quebec, and general privacy law on the personal information your systems consume.

• 01Nothing under federal artificial intelligence law, because there is none.

• 01The Artificial Intelligence and Data Act was Part 3 of Bill C-27. It reached committee, stalled there, and died when Parliament was prorogued in January 2025. It was never reinstated and never reached third reading or the Senate.
• 02Federal privacy law contains no automated-decision provision at all — no right to an explanation, no right to contest, no notice that a decision was automated, no obligation to keep a person in the loop.
• 03The 2023 joint principles on generative artificial intelligence from Canada's privacy regulators are guidance, not law. They use the word should throughout and create no new obligations.

None, because there is no statute. Bill C-36, introduced on 15 June 2026, would create the first federal automated-decision obligations and floats penalties up to $10,000,000 or 3% of global revenue. As of 6 August 2026 it sits at second reading and is not law.

We include this because a great deal of what is sold to Canadian businesses as artificial intelligence compliance refers to a statute that does not exist. If someone quotes the Artificial Intelligence and Data Act at you, it died in January 2025. Watch Bill C-36 instead — its automated-decision duties would trigger where a system assists or replaces human judgement, which is a wider test than Quebec's.

“a rules-based system, regression analysis, predictive analytics, machine learning, deep learning, a neural network or other technique”

Bill C-36, s. 2(1), definition of automated decision system

Bill C-27, 44th Parliament, 1st Session — died on prorogation, January 2025. Bill C-36, 45th Parliament, 1st Session, introduced 15 June 2026, at second reading.

Innovation, Science and Economic Development Canada — Artificial Intelligence and Data Act page, archived.