Shadow AI at Work: Visibility Before Policy

Start With Visibility

For Canadian workplaces, the immediate AI governance problem may not be an approved system. It may be an unapproved tool used quietly by a recruiter, manager, or worker. The practical question is whether the employer knows which tools are being used, what information is entered, and who remains accountable for the result.

A tool can receive a résumé, an employee complaint, performance notes, or confidential business information. Its output can move into hiring or evaluation without a clear review record. Visibility comes before policy: identify use, then match controls to purpose and consequences.

The proportionate response is not necessarily to ban every tool. Create a path for approved use, boundaries around personal and confidential information, human responsibility for consequential decisions, and a review process that can change with the rules.

What the Canadian evidence shows

The adoption curve is moving, but it is not uniform. Statistics Canada’s Q2 2026 business survey reported that 19.2% of Canadian businesses used AI to produce goods or deliver services. A secondary analysis of the supplied Statistics Canada data places the comparison points at 12.2% in Q2 2025 and 6.1% in Q2 2024. This indicates acceleration from a low base, not universal adoption.

Worker use is broader than the business-level measure. A Canadian workplace statistics compilation reports generative AI use rising from 17% of Canadian employees in September 2024 to about 30% in July 2025. It also reports that many AI users bring their own tools to work and that some office workers have used tools they believed their employer had not approved. These secondary figures support a direct governance question: can an employer discover use before something goes wrong?

HR is a sensitive setting. Groom & Associés’ Canadian HR analysis cites research reporting AI use in at least part of recruitment at 83% of Canadian organizations and planned increases in HR AI investment at 92% of companies. It stresses that employment privacy law is provincial and fact-specific; the figures are not a legal threshold or a map of every organization’s tools.

The legal and policy picture is a patchwork. BLG’s June 2026 guide for Canadian employers discusses Ontario disclosure developments, Manitoba’s public-sector Bill 51, proposed federal Bill C-36, and possible EU consequences for Canadian employers recruiting in the EU. The supplied research identifies Quebec’s Law 25 as fully in force since September 2024 and Nova Scotia’s Bill 234 as proposed. A proposal is not a current obligation.

The Office of the Privacy Commissioner’s generative-AI principles point toward data minimization, accountability, transparency, and lifecycle review, but are guidance, not a substitute for applicable law. The supplied HR analysis notes that adverse effect can be sufficient under the Canadian Human Rights Act and provincial codes. In Ontario, the joint IPC and OHRC principles described by DLA Piper are non-binding and frame reliability, safety, privacy, transparency, human rights, and accountability.

The public takeaway is to measure use, protect information entering the tool, preserve human accountability, and distinguish enacted law from proposals and guidance. The statistics come from different populations, dates, and methods, so they indicate direction rather than what is happening inside one employer. Source disclosure: this issue uses the supplied Statistics Canada survey, secondary workplace compilations, official privacy guidance, and Canadian legal analyses; those sources are not interchangeable datasets.

This is general educational information, not individualized legal, employment, financial, privacy, medical, cybersecurity, investment, or technical audit advice.