AI governance and responsible-use policy

Canada's federal, provincial and territorial privacy commissioners have published nine principles covering the development, provision and use of generative AI: legal authority and consent, appropriate purposes, necessity and proportionality, openness, accountability, individual access, limiting collection, accuracy and safeguards. They also point to privacy impact assessments. An AI governance policy turns those principles into rules staff can follow.

Generative AI arrived in most workplaces without a project plan. It is built into Microsoft 365, Google Workspace, meeting tools, CRMs and browsers, and free consumer tools are a click away. That creates real exposure: client or patient information pasted into a public chatbot, AI-generated text sent to clients without review, meeting transcripts stored where nobody expected, and automated decisions about people that no one can explain.

Canadian regulators have signalled their expectations. In December 2023 the federal, provincial and territorial privacy commissioners published Principles for responsible, trustworthy and privacy-protective generative AI technologies, which apply existing privacy principles such as legal authority and consent, appropriate purposes, necessity and proportionality, openness, accountability and safeguards to organizations that develop and use generative AI. Quebec's private-sector law already requires organizations to inform people when a decision about them is based exclusively on automated processing. Governance is how you show you have thought about these issues before something goes wrong.

We start by finding out what is really happening. That means reviewing sign-in and app-consent records in Microsoft Entra ID or Google Workspace, web and network logs where available, browser extensions, and the AI features switched on inside the software you already license, then confirming it with a short staff survey. The result is a register of AI tools and uses, each with an owner, the data involved and the business purpose.

Not every use needs a committee. We set up tiers so low-risk uses move quickly and high-risk ones get proper review:

The acceptable-use policy is the document every employee reads. We keep it short and specific: approved tools, the categories of data that may never be entered, when output must be reviewed by a qualified person before use, labelling of AI-assisted work where clients or regulators expect it, and how to request a new tool. Behind it sits a governance standard for leadership that covers roles, the approval process, record-keeping and incident handling.

Governance only works if someone checks. We align oversight with the four functions of the NIST AI Risk Management Framework (Govern, Map, Measure, Manage), released in January 2023, scaled to the size of your organization. In practice that means: an accountable executive; an AI register reviewed on a set schedule; audit logging switched on for enterprise AI tools where the platform supports it; retention settings for AI interactions that match your records policy; and a simple route for staff to report AI errors or misuse. Where you want to go further, ISO/IEC 42001 provides a certifiable management-system structure, and Canada's voluntary code of conduct for advanced generative AI systems describes expectations for developers and managers of those systems.

AI governance work is scoped in writing before work starts. Fees are quoted per engagement. The technical rollout of Microsoft Copilot is a separate engagement, covered on our Copilot readiness page.

• AI tool and use register, with owners and data categories
• Risk-tier model and approval workflow
• Staff acceptable-use policy (plain language, two to four pages)
• Leadership governance standard with roles and review cadence
• Configuration notes for logging, retention and access settings in your AI tools
• A one-page briefing for the board or partners