Employee Monitoring With AI: Rules Before Tools

Workplace monitoring used to mean a timesheet and a badge reader. Software now offers screenshots on an interval, keystroke counts, sentiment scoring on internal chat, and an engagement number per person per day, at a price a ten-person company can afford. Regulators are catching up unevenly: the UK government opened a consultation on regulating workplace monitoring technologies that runs until 30 September 2026, while Ontario has had a disclosure requirement on the books since 2022 that many employers here still have not met.

What Ontario already requires

Part XI.1 of the Employment Standards Act, added by Bill 88 in 2022 and in effect since October 11 of that year, requires employers with 25 or more employees on January 1 of any year to have a written electronic monitoring policy in place before March 1 of that year.

The policy has to say whether you electronically monitor employees. If you do, it has to describe how and in what circumstances, state the purposes for which the information may be used, and carry the date it was prepared along with the dates of any changes. Every employee gets a copy within 30 days, and within 30 days of any revision.

The scope is wider than most owners assume. Electronic monitoring is not defined in the Act, and Ministry of Labour guidance describes it as all forms of monitoring done electronically, whether or not the equipment is employer-issued and whether the employee is at the workplace or away from it. Vehicle GPS, badge swipes, call recording, access logs and the reporting built into the software you already pay for all sit inside that.

Requirements differ across the country, and federally regulated workplaces and Quebec operate under their own frameworks. Confirm which applies to you. None of this is legal advice.

The part that is usually misread

Ontario's guidance is explicit that the policy requirement does not create a new right to privacy for employees and does not limit what an employer may do with information obtained through monitoring. It is a disclosure rule.

Which means compliance and good judgment are separate exercises. A business can write a lawful policy saying it screenshots every desktop every four minutes and uses the results in performance reviews, hand it to everyone within 30 days, and be entirely compliant while doing something that costs it three good employees by spring. The legal floor is low here, so the interesting decisions are all above it.

What AI actually changed

Traditional monitoring produced records. This person badged in at 8:42. This call lasted six minutes. This file was opened. Records are dull, checkable, and an employee who disputes one can point at the log.

The newer products produce inferences. An engagement score. A sentiment reading on someone's messages. A flag that a person is a retention risk or a security risk. Nobody can contest a number derived from a model they cannot see, and the person on the receiving end has no way to know what would move it.

Inference also imports the bias problem. A model scoring communication style will read some people as disengaged for reasons that track how they write rather than how they work, and the risk lands hardest on staff writing in a second language or communicating differently for reasons connected to a protected characteristic. We described the general mechanism in AI bias in a small business.

Where monitoring earns its keep

Safety. Vehicle telematics on a fleet, lone-worker check-ins, equipment interlocks. The measure is the outcome, staff generally accept it once the purpose is stated, and it prevents real harm.

Billing accuracy. Professional services firms billing by time need defensible records, and automatic capture beats reconstructing Thursday on a Friday afternoon. Our note on AI time tracking covers doing that without a surveillance framing.

Regulated recordkeeping. Call recording in financial advice, access logs in healthcare. The obligation exists independently and the tooling just satisfies it.

Security. Unusual access patterns, large exports, logins from unexpected places. This watches systems rather than people, which is a meaningfully different thing to build and a much easier one to explain.

Where it backfires

Attach consequences to a measure and the measure improves, including by routes nobody intended. Keystroke targets produce keystrokes. Activity scores produce mouse movement. Response-time targets produce fast, thin replies to customers who needed a real answer. This is the same dynamic we set out in your AI will optimise for the score you set, except the optimiser is a person who now resents you.

The exit risk is asymmetric too. Surveillance tends to be tolerated by people with fewer options and resented by people with many, so the staff most likely to leave over it are the ones you least want to lose. In a small business that can be two people out of twelve, and the tool costs $8 a seat.

Five rules before you buy anything

1. Name the problem in one sentence, without using the word productivity. "Three vehicles are idling for an hour a day" is a problem. "I want visibility" is a feeling, and it buys the wrong tool every time.

2. Measure outcomes, not activity. Jobs completed, errors, safety incidents, customer outcomes. Activity metrics measure the appearance of work and are the easiest thing in the world to fake.

3. Prefer records over inferences. Collect facts a person can check and dispute. Treat engagement and sentiment scores as unproven, because from the employee's side they are indistinguishable from an opinion with a number on it.

4. Tell people before you turn it on, in plain language. What is collected, why, who sees it, how long it is kept, and what it will and will not be used for. Ontario requires the disclosure anyway, so the only decision left is whether it reads like a legal notice or like something a person wrote.

5. Write down what you will not do with it. This is the rule that buys back trust. Committing in writing that monitoring data stays out of performance reviews, or that location tracking stops at the end of a shift, costs you almost nothing operationally and changes how the whole thing is received.

A note on monitoring AI-assisted work

A newer version of this question is arriving as teams adopt AI: how do you assess someone's work when a model wrote the first draft. Output volume becomes a useless measure almost immediately, and the temptation is to reach for surveillance to fill the gap. Judging the thinking rather than the typing is the better answer, and we went into it in tracking work when AI writes it.

If you need a starting document, our AI policy generator produces a draft in a few minutes, and whether your business needs an AI policy covers what belongs in it. Have a lawyer look at the monitoring section before it goes out.

Frequently Asked Questions

Is employee monitoring legal in Canada?

Monitoring itself is generally lawful, and the obligations attached to it vary by province and by whether you are federally regulated. Ontario is the clearest case: under Part XI.1 of the Employment Standards Act, added by Bill 88 in 2022, employers with 25 or more employees on January 1 of any year must have a written electronic monitoring policy in place before March 1 of that year. Other provinces, federally regulated workplaces, and Quebec each have their own frameworks, so confirm which applies to you rather than assuming Ontario’s rule travels. None of this is legal advice.

What must an Ontario electronic monitoring policy contain?

Four things. Whether the employer electronically monitors employees. If it does, a description of how and in what circumstances it may do so. The purposes for which information obtained through monitoring may be used. And the date the policy was prepared plus the date of any changes. The policy has to be given to every employee within 30 days of the deadline to have it, and an updated policy within 30 days of any revision.

Does a monitoring policy give employees new privacy rights?

No, and this is widely misread. Ontario’s Ministry of Labour guidance is explicit that the requirement to have a policy does not create a new right to privacy and does not limit an employer’s ability to use information obtained through monitoring. It is a disclosure obligation. That makes the policy a legal minimum rather than an ethical position, and the gap between the two is where most of the workplace damage happens.

What counts as electronic monitoring?

Broadly, more than most employers expect. Electronic monitoring is not defined in the Ontario ESA, but Ministry guidance describes it as all forms of employee monitoring done electronically, whether or not it happens on employer-issued equipment and whether the employee is at or away from the workplace. GPS in a work vehicle, badge swipes, keystroke logging, screenshots, call recording and access logs all sit inside that description.

Does AI monitoring actually improve productivity?

It reliably improves the measured number, which is a different thing. Anything you measure and attach consequences to will go up, including by routes you did not intend, so keystroke targets produce keystrokes and activity scores produce activity. Monitoring earns its keep where the measure is the outcome, such as safety incidents or billable accuracy. It works poorly where the measure is a proxy for effort, because the proxy is easier to satisfy than the work.