Before approving an AI tool, your business should be able to name the person responsible, explain what information it can use, and show how someone checks its work. Those decisions matter whether the tool drafts emails or supports a business process.

For a small or medium-sized business, AI governance can start with a shared register, clear approval rules and a review date. The aim is to let staff use AI for worthwhile work without leaving decisions about privacy, accuracy and authority to whoever signed up first.

Start with the obligations that already apply

Canada's privacy commissioners say organizations developing or using generative AI must comply with applicable Canadian privacy laws; AI does not sit outside existing legislation.[1]

For Ontario businesses, assess which law applies to each activity. PIPEDA generally covers personal information handled in commercial activities, while Ontario has separate legislation concerning personal health information.[6] Do not assume PIPEDA covers every employment record: its employee-information coverage applies to federally regulated businesses.[6]

The commissioners' AI guidance calls for organizations to document their legal authority for collecting, using and disclosing personal information.[1] A vendor's approval or an internal manager's sign-off cannot replace that assessment.

NIST's AI Risk Management Framework provides a voluntary structure, not Canadian law.[2] Its core functions are Govern, Map, Measure and Manage.[3] Use them to organize the work below, rather than treating a completed checklist as proof of compliance. This is operational guidance, not legal advice; obtain advice for sensitive or regulated uses.

1. Give one person authority to own the program

Name an AI governance owner, such as the operations leader or an executive with authority over technology decisions. IT can assess controls, but leadership should decide which risks the business will accept.

Write down who approves new uses, who reviews privacy questions and who can suspend a tool. Give the owner a deputy and a recurring leadership review slot.

Where PIPEDA applies, the organization must designate someone accountable for compliance with its privacy principles.[4] Your AI owner should work with that privacy lead; creating an AI role does not transfer the organization's responsibility to a vendor.

2. Inventory uses, not just subscriptions

Ask each team to list the tasks for which it uses AI. Include AI features inside existing software, browser extensions and meeting tools, as well as standalone services. NIST's framework includes maintaining an inventory of AI systems.[3]

For each use, record:

The business purpose and responsible manager.
The tool, account type and people with access.
The information entered and systems connected.
What the output influences, and whether the tool can take action.
The reviewer, approval status and next review date.

One tool may have several entries. Drafting a public announcement and summarizing customer records need separate decisions, even when employees use the same application.

3. Match the review to the possible harm

Use a simple internal risk triage. These are suggested management categories, not official Canadian legal classifications:

Low risk: drafting from public information, with no personal or confidential data and no ability to change business systems. The user checks the result.
Moderate risk: working with approved, non-sensitive internal material or preparing customer communications. Require a documented data review and a named reviewer before use.
High risk: influencing hiring, access to services or other consequential decisions; processing sensitive personal information; or changing important records. Pause until leadership, IT and appropriate privacy or legal advisers have assessed the use.

Assess what could go wrong, who could be affected, how likely the problem is and whether the business could reverse it. NIST calls for risk treatment based on impact, likelihood and available resources.[3] Record the reasons for approving, restricting or rejecting each use.

4. Approve the task and its data together

An approved-tools list should specify permitted uses and data categories. Avoid a blanket statement that a product is "safe for business".

Keep passwords and other access credentials out of prompts. A useful default is to keep personal information and confidential customer material out of AI tools unless the specific use has been reviewed and authorized. The privacy commissioners recommend using anonymized or de-identified information in prompts where possible and reasonable, and entering personal information only where authorized.[1]

Explain how staff can request an exception. Record the business need, permitted information, restrictions and approval expiry date. Ask whether the task can work with less information before approving more access.

5. Check the vendor's actual contract and settings

Review the product edition you will buy and the settings you will deploy. Ask the vendor:

Are prompts, uploads or outputs used for model training, and can that use be disabled?
How long is information retained, and what does deletion cover?
Where is information stored, processed and accessed, including by subcontractors?
Which access controls and logs are available in this edition?
What incident notification, support and exit arrangements will apply?

Save the answers, contract and configuration evidence. Do not approve a tool on its hosting location or marketing description alone.

PIPEDA's accountability principle requires organizations to use contractual or other means to provide comparable protection for personal information transferred to a third party for processing.[4] Vendor review should therefore examine what happens to the information, not just whether the supplier signed an agreement.

6. Make human review a defined job

For every approved use, specify what the reviewer checks, when they check it and what they can stop. Give them the original material and enough time to verify the output. Test on non-sensitive examples before deployment and record failures.[3]

For customer correspondence, check factual statements and commitments before sending. For analytical work, check the source information and calculations. Require separate approval before an AI tool changes records or initiates a consequential action.

The privacy commissioners say accountability for decisions rests with the organization and recommend an effective challenge mechanism for significant decisions about individuals, including human review or reconsideration.[1] Build that route into the process before deployment.

7. Train staff on the decisions they actually face

Use examples from each team's work, with fictional or sanitized information. Have staff practise choosing permitted data, spotting an unsupported answer and escalating a questionable use.

Give everyone a short guide covering approved tools, prohibited inputs, required checks and the person to contact. Include contractors who use your systems. NIST identifies role-appropriate AI risk training as part of governance.[3]

Keep attendance and update the guidance when approved uses change. Make early reporting easier than quietly trying to repair a mistake.

8. Prepare for incidents and keep useful evidence

Add AI incidents to your existing response procedure. Include unauthorized disclosures, harmful outputs and unexpected system actions. Name who contains the problem, contacts the vendor and assesses privacy obligations.

Staff should stop the affected workflow and report it promptly. Preserve relevant evidence securely, restrict access and avoid circulating sensitive prompts through ordinary email.

Where PIPEDA applies, breaches of security safeguards involving personal information under your control that create a real risk of significant harm must be reported to the OPC, and affected individuals must be notified.[5] Keep records of every breach of security safeguards involving personal information under your control, including those below the reporting threshold, for at least two years.[5] Notification to affected individuals must occur as soon as feasible after determining that a qualifying breach occurred.[5]

Keep a governance folder containing the inventory, approvals, vendor checks, training records, test results and incident decisions. Set a quarterly review as a starting point, with earlier reassessment when the tool, data, permissions or purpose changes. NIST recommends planned monitoring and periodic review.[3] Retain necessary evidence under defined schedules rather than collecting every prompt indefinitely.

A manageable first month

In the first week, appoint the owner and collect the inventory. Next, prioritize the highest-risk uses and publish interim tool and data rules. Use the remaining weeks to complete vendor checks, define reviewer duties and practise the incident procedure.

Your first leadership review should identify approved uses, unresolved risks and actions with owners and deadlines. Measure rework, errors and review effort alongside any time saved. Expand a use only when the evidence supports the decision.

ETG's technology strategy practice includes IT governance, risk assessment and vendor management.[7] If you need help deciding where to start, book a consultation with Evolved Technology Group.

AI governance for SMBs: a practical Canadian operating plan