Screening software parses applications into structured fields, applies criteria, and orders the result. Two very different things get sold under that name — deterministic filters and model-based ranking — and only one of them can tell you why a candidate came out where they did.
Key takeaways
Screening is not a single act. It is six, and the risk is concentrated in two of them.
1. Ingest. Applications arrive from a job board, an email address or a form, usually as PDFs of wildly varying quality.
2. Parse. Text is extracted and mapped to fields — employers, dates, titles, education, credentials, location. This is optical character recognition plus entity extraction. Nothing has been judged yet, and parsing errors here propagate silently into everything downstream.
3. Normalise. Job titles, credential names and employer names are reconciled so “CPA, CGA” and “Chartered Professional Accountant” are the same thing. This is where most of the quality difference between products lives.
4. Knockout criteria. Deterministic filters: does the applicant hold the required licence, are they legally able to work here, do they have the specific certification the role legally requires. Binary, explainable, auditable.
5. Ranking. A model scores or orders the remaining applicants against the requirement. This is the step that is neither binary nor easily explainable, and it is where the legal exposure lives.
6. Shortlist and human review. A person reads the top of the list, and — this is the part that gets dropped — samples the middle and the bottom.
A filter encodes a rule you wrote. If the rule is wrong you can see that it is wrong, and you can explain to anybody why an applicant was excluded. A ranking model encodes a pattern derived from data, and it can reproduce whatever was in that data, including patterns nobody intended and nobody wrote down.
That is not an argument against ranking. It is an argument for knowing which one you have bought, insisting that the knockout criteria stay in the filter layer where they are inspectable, and never letting a model infer a requirement you did not state.
From 1 January 2026, an Ontario employer with 25 or more employees must include in a publicly advertised job posting a statement disclosing the employer’s use, if any, of artificial intelligence to screen, assess or select applicants. The disclosure does not have to be elaborate: the guidance says it is enough to state that artificial intelligence is used for that purpose. The same provisions require the expected compensation or range, a statement of whether a vacancy exists, and prohibit any Canadian experience requirement in the posting or associated application form.
The Act defines artificial intelligence broadly — a machine-based system that, for explicit or implicit objectives, infers from the input it receives to generate outputs such as predictions, content, recommendations or decisions. Whether a particular system falls inside the definition depends on the facts, but a tool that ranks applicants plainly does. Where a third party advertises or screens on the employer’s behalf, the employer remains responsible for the posting meeting the requirements.
One definitional point is easy to miss and changes what else applies. The Act treats an “interview” as a meeting, in person or using technology, between an applicant and the employer or someone acting for it, where questions are asked and answers given to assess suitability — and it expressly excludes a preliminary screening carried out before the selection of which applicants to interview. So a screening tool applied to the whole applicant pool does not, by itself, trigger the 45-day outcome notice. An automated interview applied to a shortlist may.
An application is personal information, and the Personal Information Protection and Electronic Documents Act governs how a private-sector organisation collects, uses and discloses it. What actually counts as personal information is broader than most employers assume, and the obligations attach to applicant and employee data alike.
The Office of the Privacy Commissioner’s principles for generative AI translate that into design rules for screening. Know and document your legal authority for the collection, and where consent is that authority, make it specific and meaningful. Limit collection, use and disclosure to what the identified purpose requires, and avoid function creep — do not reuse an applicant pool for something the applicant did not agree to. Be open about what is collected and why. Where a system forms part of a decision-making process, maintain records adequate to fulfil an access request about that decision. And where an output is not meaningfully explainable, the guidance asks whether the use is appropriate at all, and expects an opportunity to request human review or reconsideration.
Background and reference checks are a separate consent question again, and one worth settling before the screening stage rather than after — the Ontario employer guide to background checks when hiring sets out where the boundaries sit.
Three things, none of which can be delegated to the tool that produced the list.
Write the criteria before the vacancy opens, tied to the duties of the job, and keep them out of the free-text prompt. Read a sample from below the shortlist, because a screening system that is quietly wrong looks exactly like one that is right if you only ever read the top. And record the reason a person was advanced or not, in words — a score is not a reason.
A staffing agency screens 340 applications for eight warehouse supervisor roles at a client in Mississauga.
The knockout filter is deterministic and short: legally able to work in Canada, holds a valid forklift certification, available for the posted shift pattern. Those are rules, they are stated in the posting, and each exclusion is explainable to the applicant.
The remaining 210 are parsed and normalised, and a model orders them against the stated requirement. The recruiter reads the top 40, and then reads 15 drawn at random from ranks 100 to 210. Two of those fifteen are obviously strong — both had their supervisory experience described in a format the parser mangled. That finding goes back to the vendor and, more usefully, changes the process: the parser output is now spot-checked against the source document for a sample of every batch.
The client’s posting carries the AI disclosure and the compensation range. The agency keeps the posting, the application form, the criteria and the shortlist rationale. When one unsuccessful applicant asks why, there is an answer that is not “the system ranked you 148th”.
Separate the layers before you buy anything. Write your knockout criteria as rules. Ask the vendor which of parsing, filtering and ranking their product does, and how each exclusion can be explained. Ask what happens to the applications. Then run it alongside your existing process for one full requisition and compare the two shortlists — not to see whether the tool agrees with you, but to see what it missed.
Do we have to tell candidates we use AI to screen?
In Ontario, yes, in the posting itself, for a publicly advertised job posting by an employer with 25 or more employees — the requirement took effect on 1 January 2026. Elsewhere, openness is still the expectation under the privacy commissioner’s guidance.
Can a screening tool reject someone automatically?
A deterministic filter applying a stated, job-related requirement can exclude someone on a rule you can explain. A ranking model should not be wired to auto-reject, because you would be unable to explain the decision and the guidance expects a route to human reconsideration.
Does this apply to a small employer?
The Ontario posting requirements attach to employers with 25 or more employees counted on the day the posting goes up, with part-time and casual employees each counted as one. Privacy obligations under PIPEDA do not have a size threshold in the same way.
A 30-minute call is enough to tell you whether AI pays for itself here.
