Lire cet article en français →
It is 2:23 p.m., in a distribution warehouse in Laval. An order picker scans his tenth box of the minute. His terminal tells him he is at 94% of his hourly target. He has not stopped to use the washroom in two hours — not because a supervisor is watching, but because every unlogged break drops his score. The supervisor is at the other end of the building. He has not made a single decision about this employee since this morning. The system has made them for him.
This scenario is not exceptional. It plays out in hundreds of Quebec SMEs that have deployed warehouse management systems, delivery platforms, or real-time productivity tools without anyone ever asking the following question: does this software generate psychosocial risk factors? And if so, how do you prove it under Law 27?
What the dashboard does not count
Law 27 — Quebec’s Law 27 (workplace psychosocial risks), meaning the amendments to the Act respecting occupational health and safety that came into force in stages beginning in 2023 — requires employers to identify and control psychosocial risks in their workplaces. The six risk factors recognized under Quebec law include workload, decision-making autonomy, recognition, social support, role clarity, and work-life balance. None of these concepts were formulated with an algorithm in mind as the source of pressure.
And yet, when it is software that sets the pace, flags every deviation, and produces a daily performance ranking, all of these factors are at play — but in a form that current standardized questionnaires do not capture accurately. An employee can honestly answer “never” to the question “does your supervisor give you regular feedback,” while his terminal sends him an alert every fifteen minutes. The feedback exists. It comes from a screen. It has no face, no intention, no context — and it never stops.
A study published in 2021 in the Journal of Occupational Health Psychology found that continuous algorithmic monitoring is associated with a significant increase in emotional exhaustion, independent of objective workload. It is not the volume of work that wears people down first: it is the loss of control over the conditions under which that work is done. An order picker who cannot decide on his own to go get a drink of water without it being recorded has not lost his autonomy through managerial negligence — he lost it by design. And at present, Law 27 does not name that mechanism precisely.
What an SME can do before a standard tells it how
The objection heard most often in OHS committees is this one: “We didn’t wait for an ISO standard before installing the system, so why would we need one to evaluate it?” It is a fair objection. SMEs have neither the time nor the resources to wait for a complete regulatory framework before acting. And as it happens, they are right not to wait — because the current grey zone does not protect them; it exposes them.
A realistic approach starts with a simple step: mapping, within the system already in place, what it measures, how frequently it flags deviations, and whether a human being intervenes between the alert and the consequence. This mapping does not require a consultant or a psychometric tool at the outset — it requires an hour with the IT manager and the floor supervisor, and the willingness to name what you see. When no one in the organization can explain how an automated alert translates into an experience for the employee who receives it, that is where risk begins to accumulate without a witness.
Then comes the question of proof. Law 27 requires that prevention efforts be documented. An SME that deploys an algorithmic management system and has no record of a psychosocial risk assessment tied to that system will not be able to demonstrate reasonable diligence if a problem surfaces — whether it is a psychological harassment complaint in which the algorithm is the vector, a work stoppage, or a CNESST inspection. The absence of documentation is not a neutral position: it is an exposure.
SMEs that start now — before a standard or a tribunal decision comes to define what “adequate prevention” means in an algorithmic context — will have an advantage that those who wait will not: data, a paper trail, and a practice already well established. CSS Consult has developed a psychosocial risk assessment process adapted to work environments where monitoring is automated, so that management can name what is happening before someone else does it for them.
The question that remains: if your CNESST came to you tomorrow and asked what assessment you had done of the psychosocial risks linked to your management system, what would you be able to show them?
What gets measured gets prevented. What gets proven remains.