Using AI at work in Canada: a checklist

1. 01

   Where is data stored at rest, and in which jurisdiction?

2. 02

   Where is it processed?

3. 03

   Is customer content used for training?

4. 04

   Can users and admins delete data?

1. 01

   Which models are used, and who operates them?

2. 02

   Can you change models without changing vendors?

3. 03

   Is there a self-hosted path for sensitive workloads?

1. 01

   Are shared workspaces role-based?

2. 02

   Are integrations scoped to what each user can already access?

3. 03

   Is public sharing opt-in and revocable?

1. 01

   Does the tool cite sources?

2. 02

   Can answers be checked independently?

3. 03

   Is it clear when an answer is uncertain?

1. 01

   Write a one-page AI-use policy

   what may go in, what must stay out, who reviews outputs before they leave the building.

2. 02

   Name an owner

   someone who approves new integrations and answers staff questions.

3. 03

   Train briefly

   ten minutes on checking sources and spotting a confident wrong answer saves hours later.

4. 04

   Review quarterly

   tools change fast; revisit vendors, settings and the policy.

Obligations under PIPEDA, Québec’s Law 25 and other provincial laws depend on your organisation and data. Consult your privacy officer or counsel.