Using AI-generated interview transcripts and summaries does not remove or reduce your legal obligations; once created and relied upon in hiring, they become “personal information” under federal privacy law. For federally regulated employers (and many private-sector organizations across Canada), the Personal Information Protection and Electronic Documents Act (PIPEDA) applies. If you used a Teams Co-Pilot transcript and summary as part of your assessment, both the full transcript and the AI summary form part of the candidate’s recruitment record. Under PIPEDA, organizations must retain personal information only as long as necessary to fulfill the purposes for which it was collected, but also long enough to allow individuals a reasonable opportunity to access it. In practice, if human rights legislation requires records to be kept for at least six months (to respond to discrimination complaints), many organizations retain recruitment records for one year to align with best practice and limitation risk. If the transcript informed the hiring decision, it is prudent to retain both the transcript and summary for at least the longest applicable retention period.

Under PIPEDA, candidates have a right to request access to their personal information in your custody or control. This would generally include interview notes, AI transcripts, and AI-generated summaries, subject to limited exceptions (for example, information protected by solicitor-client privilege or confidential commercial information). You may redact information about other candidates or internal comparative evaluations where appropriate, but you would typically need to provide the individual with access to their own transcript and summary within the statutory response timelines. Importantly, if the AI summary contains evaluative opinions about the candidate, those opinions are still considered their personal information.

There are additional compliance considerations when using AI tools. You must ensure meaningful consent—candidates should understand that AI transcription and summarization is being used, what information is collected, how it will be used, where it will be stored (including any cross-border data transfers), and how long it will be retained. Under PIPEDA’s accountability principle, your organization remains responsible for personal information processed by third-party service providers (such as Microsoft), so vendor contracts, data security safeguards, and clear internal policies are important. You should also ensure human oversight of AI summaries to mitigate accuracy issues or unintended bias that could raise human rights concerns under federal or provincial human rights legislation.

Finally, from a risk management perspective, treat AI-generated records the same as traditional interview notes: apply your documented retention schedule, restrict access on a need-to-know basis, and securely destroy records once the retention period expires. Ensure your recruitment and privacy policies expressly address the use of AI tools. Consistency, transparency, and documentation will be key if your organization needs to respond to a privacy access request, a complaint to the Office of the Privacy Commissioner of Canada, or a human rights allegation.

I hope this helps!
-HRInsider Staff