Short answer
There is no general rule that every use of AI must be disclosed, but as of October 2026 a growing set of specific rules apply. The common triggers are a person talking to an AI they could mistake for a human, a decision about someone made by software alone, AI used to screen job applicants, and realistic AI-generated images, audio, video or public-interest text.
Follow-up question Where is disclosure required: Quebec, Ontario job ads, the EU, US states?
Using AI to draft an email or brainstorm a slogan does not, by itself, oblige you to tell anyone. No general law in Canada, the United States or the European Union requires a label on every piece of work an AI touched. What the laws do target, as of October 2026, are situations where people could be misled or affected without knowing a machine was involved.
Four situations come up again and again:
- Someone is talking to an AI and could reasonably think it is a person.
- Software alone makes a decision about someone, such as refusing an application.
- AI screens people for a job.
- Realistic synthetic content (an image, voice or video of a real-looking person or event) or AI-written text on public affairs is published.
This article sticks to the law and is a general guide, not legal advice for your business.
A quick map of the rules
| Where | Rule | What triggers it | What you must say |
|---|---|---|---|
| Québec | Private-sector privacy act, s. 12.1 | A decision about a person based only on automated processing of their personal information | That the decision was automated, at the latest when you announce it; more detail and a human review on request |
| Ontario | Employment Standards Act, job postings | An employer with 25 or more employees uses AI to sort or evaluate candidates for a job advertised to the public | A statement in the posting that AI is used |
| European Union | AI Act, Article 50, applying from August 2, 2026 | Chatbots, deepfakes, AI-written text published to inform the public, emotion recognition | That the person is dealing with AI, or that the content was generated or manipulated |
| Utah | Generative AI consumer protection rules (2025) | A consumer clearly asks whether they are talking to AI; high-risk interactions in licensed professions | That it is generative AI and not a human |
Two cases worth knowing in detail
The EU chatbot and deepfake rules. Article 50 of the AI Act splits duties between providers (those who build an AI system) and deployers (businesses that use one). Providers must design chatbots so people are told they are interacting with AI, unless that is obvious to a reasonably attentive person in context. Deployers must disclose deepfakes, meaning realistic generated or altered images, audio or video, and must disclose AI-written text published to inform people about public-interest matters, unless a person reviewed it and someone holds editorial responsibility. The information has to be clear and given at the first interaction or exposure at the latest. A business outside the EU can be covered when the output of its AI system is used in the EU.
Utah's consumer rule. Since May 2025, a business using generative AI with consumers in Utah must confirm it is AI, not a human, when the person clearly asks. Licensed professionals must disclose it up front in high-risk interactions, such as collecting health or financial data or giving advice someone may rely on for an important decision. A business is protected from enforcement if its AI says clearly, at the start and throughout, that it is an AI assistant. Fines can reach $2,500 per violation.
A worked example: one small business, four sets of rules
A furniture maker in Drummondville sells online across Canada, the United States and Europe, has 30 employees and is hiring a sales representative in Ottawa. It uses an AI chatbot on its website, AI to sort job applications, and AI-generated lifestyle photos in its catalog. Its disclosure checklist looks like this:
| Use | Disclosure | Why |
|---|---|---|
| Website chatbot | Opening line: "I'm the AI assistant for our workshop. I can help with orders and products, and I can connect you with a person at any time." | EU Article 50 for European customers; Utah safe harbor; good practice everywhere |
| Ottawa job posting | "We use artificial intelligence to help screen, assess or select applicants for this position." | Ontario rule, since the company has 25 or more employees |
| Automatic rejection emails | A sentence saying the decision was automated and how to ask for a review, or a recruiter who reads every file | Québec section 12.1 if no person decides |
| Catalog photos | A caption such as "Room scenes created with AI; furniture photographed in our workshop" | Not required by the rules above for staged product scenes, but it avoids misleading customers |
An assistant can draft these lines for review:
I run a small furniture company. Draft four short disclosure statements in plain language, one each for: 1) the first message of our website chatbot, 2) a job posting where AI helps screen applicants, 3) an email telling an applicant their application was rejected by an automated system and how to request a review by a person, 4) a caption for catalog photos where the room is AI-generated but the furniture is real. Keep each under 40 words and avoid legal jargon.Try it: List every place your organization uses AI where a customer, applicant or member of the public sees the result. Next to each, write which of the four triggers applies, if any. The ones with no trigger are your choice; the others need a disclosure line.
Where is disclosure required: Quebec, Ontario job ads, the EU, US states?
Québec. There is no general AI-labeling law. The key rule is section 12.1 of the private-sector privacy act: when a decision about a person is based only on automated processing of their personal information, you must tell them, explain the main factors on request and let them present their views to someone who can review it.
Ontario job ads. For publicly advertised postings made on or after January 1, 2026, employers with 25 or more employees must say whether they use AI to screen, assess or select applicants. All employees count, part-time included, across every location. A short statement is enough, even when a recruiting firm does the screening; general "we're hiring" signs and internal-only postings are not covered.
The European Union. Article 50, described above, has applied since August 2, 2026.
US states. Rules vary by state and change quickly. Utah's answer-if-asked rule is one of the most direct for everyday businesses; if you serve customers in other states, check their rules before launching a chatbot or an automated decision process there.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act) — Official Journal of the European Union (EUR-Lex), July 12, 2024
- Your guide to the Employment Standards Act: Requirements related to publicly advertised job postings — Government of Ontario, February 24, 2026
- S.B. 226 Artificial Intelligence Consumer Protection Amendments (enrolled copy) — Utah State Legislature, May 7, 2025