An employer doesn't need every employee's fresh sign-off to set a new workplace rule — but changing someone's actual contract is a different, higher bar. Which one an AI-use rule is shapes where it belongs.
Short answer
As a standalone workplace policy, generally yes — not folded into an amendment of each employee's individual contract. Ontario law treats an ordinary conduct or tool-use rule differently from a change to a fundamental contract term, and it already requires a written, disclosed policy for a closely related situation: how the employer electronically monitors staff.
Once someone has accepted a job, changing a genuinely fundamental term of their employment — pay, title, core duties — generally requires fresh consideration, something of real value flowing back to the employee. An ordinary workplace conduct rule, like which tools staff may use for a task, isn't in that category — it's the kind of standing instruction an employer can generally set and update as part of running the business, provided it's actually communicated and doesn't reach into pay, title or core duties.
Ontario employers with 25 or more employees must already keep a written policy describing how and why they electronically monitor employees, provide it to staff within 30 days, and update it whenever the practice changes. An AI-use policy is the same shape of document, covering the same underlying question — what tools touch an employee's work and what happens with the data — and it fits naturally beside a monitoring policy rather than inside the individual employment contract.
Canada has no law dictating what a private employer's AI-use policy must say. The nearest reference point is ISED's Voluntary Code of Conduct on advanced generative AI, whose commitments — accountability, transparency, human oversight and monitoring — are written for the companies that build and operate generative AI systems, and bind only its signatories. It's a voluntary reference an ordinary business can borrow structure from, not a rule that applies to one.
See also: what actually happens when a rule like this gets broken, the ESA disclosure rule this kind of policy most closely resembles, the equivalent question for contractors rather than staff.
Writing and maintaining the rules a tool actually operates under, once it's live, is what ai-operations covers.
