If your team already uses ChatGPT, Copilot or similar tools, you need a written AI policy. It can be two pages. It should say which tools are approved, what data must never go into a prompt, when a human has to check the output, and who to ask when something is unclear. In Canada there is no single AI law that tells you what to write, so the policy rests on privacy law you already have to follow, plus a few provincial rules and federal guidance.
This guide is for owners and managers of small and medium businesses in Surrey, Metro Vancouver and elsewhere in Canada. It covers what to put in the policy, which rules actually apply, how to roll it out without making people feel watched, and where a policy stops being enough.
Table of Contents
- Do you really need an AI policy if you only have a small team?
- What does Canadian law say about employee AI use?
- What should an AI policy for employees include?
- Can your employer force you to use AI?
- How do you roll out an AI policy without making people feel watched?
- How do you keep AI output consistent with your brand?
- Our perspective: a policy is the first step, not the whole job
- Where can we help with your AI policy and rollout?
- Frequently asked questions
- Sources
Do you really need an AI policy if you only have a small team?
Yes, and small teams often need one sooner than large ones. A large company has an IT department that blocks tools. A ten-person business usually has people signing up for free accounts with their work email and pasting in whatever helps them finish the job.
The Canadian Centre for Cyber Security calls this shadow AI in its top 10 AI security actions. Staff use unsanctioned tools and can leak sensitive data into public models without meaning to. The guidance recommends an explicit list of approved tools. That list is the heart of a small business policy.
There is also a legal reason. The Office of the Privacy Commissioner of Canada is clear that AI tools do not exist outside privacy law. If an employee pastes customer details into a third-party tool, your business remains accountable under PIPEDA or the provincial equivalent. Not knowing about it is not a defence, which is why a written rule matters.
What does Canadian law say about employee AI use?
Short answer: there is no federal AI statute you can point to for workplace rules. The federal government instead promotes a voluntary code of conduct for generative AI. Its themes are accountability, safety, human oversight and transparency. They make a sensible skeleton for your own policy even though the code is not binding on you. Check the current status of any proposed federal AI legislation before you rely on it, because it has changed more than once.
What does bind you is privacy law. In British Columbia, private-sector employers fall under the Personal Information Protection Act (PIPA), which covers employee information as well as customer information. Federally regulated employers and some cross-border activity fall under PIPEDA. Neither law was written for AI, but both apply when AI touches personal information.
The federal, provincial and territorial privacy commissioners issued a joint resolution on employee privacy in October 2023. It asks employers to respect necessity and proportionality when using AI, and to avoid important employment decisions, such as hiring or performance reviews, without human oversight. That is a strong hint for your policy: AI can assist with those decisions, but it should not make them.
Is there a hiring rule I should know about?
Ontario now has one. Since 1 January 2026, employers that advertise a job publicly and use AI to screen, assess or select applicants must say so in the posting, under section 8.4 of the Employment Standards Act, 2000. That rule is Ontario's, and it does not apply in BC. If you hire across provinces, or post jobs that Ontario candidates see, check it with a lawyer. Even in BC, telling applicants when AI is part of screening is good practice and costs you nothing.
What about data residency?
Readers often ask whether Canadian data must stay in Canada. There is no blanket rule that all private-sector business data must be stored in Canada, and requirements differ by sector, province and contract. Public bodies, health information and some customer contracts can carry stricter conditions. For your policy, the practical step is to ask each approved vendor where prompts and outputs are processed and stored, and to write the answer down. If a client contract promises Canadian hosting, make sure your AI tools do not quietly break that promise.
What should an AI policy for employees include?
The best policies we see are short enough that people read them. Use these eight sections as a starting point.
- Purpose and scope. Say who the policy covers (employees, contractors, interns) and what it covers (any generative AI, chatbots, transcription tools, AI features inside software you already use).
- Approved tools. Name the tools people may use for work, and the account type. A paid business account with data controls is a different thing from a free personal login.
- Data rules. List what must never go into a prompt unless the tool is approved for it: customer personal information, employee records, financial statements, contracts, passwords, anything under a confidentiality agreement.
- Human review. Every output that reaches a customer, a regulator or a financial record gets checked by a person who is responsible for it.
- Prohibited uses. Making hiring, firing, discipline or pay decisions with AI alone. Creating fake reviews or impersonating people. Entering data in tools that are not on the list.
- Disclosure. When you tell customers, applicants or colleagues that AI was involved.
- Incidents. What to do if someone pastes the wrong thing into a tool. Name a person and a timeframe, and say clearly that reporting honestly will not be punished.
- Review date. Tools change quickly. Set a review at least twice a year and after any incident.
How should the data rules be written?
The cyber centre advises classifying and minimizing personal information before it touches a prompt, and treating AI output as untrusted until a human has verified it, especially in critical workflows. Turn that into three plain tiers your team can remember:
| Tier | Examples | Rule |
|---|---|---|
| Public | Published website copy, general industry questions | Any approved tool |
| Internal | Meeting notes, draft policies, internal processes | Approved business accounts only |
| Restricted | Customer or employee personal information, financials, legal documents | Only in tools specifically approved for that data, with identifying details removed where possible |
If you want a deeper look at what happens to information once it leaves your hands, our plain guide on whether your business data is safe with AI tools walks through it.
What should you check before approving a tool?
Approving a tool means doing due diligence on it. The privacy commissioner's guidance points to data ownership and retention as the questions to settle before adoption. Ask each vendor:
- Does it use your inputs to train its models, and can you switch that off?
- How long does it keep prompts and outputs, and can you delete them?
- Where is data processed and stored?
- Who are its sub-processors?
- What does the contract say about a breach, and who tells whom?
The last two are contract questions. A data processing agreement checklist written for another jurisdiction still shows the clauses worth looking for: purpose limits, sub-processor approval, breach notice and deletion on exit. Adapt the thinking to Canadian law, and have a lawyer read anything that carries real risk.
Can your employer force you to use AI?
Employees search this too, and the honest answer depends on the job and the contract. Generally, an employer can set reasonable expectations about the tools used to do a job, the same way it can require a particular accounting system. What an employer cannot do is ignore its other duties: privacy, health and safety, human rights and the terms of the employment agreement. If you are an employee with a specific concern, speak to an employment lawyer or, in BC, the Employment Standards Branch.
If you are an employer, the practical lesson is that mandating a tool without explaining why tends to backfire. That brings us to rollout.
How do you roll out an AI policy without making people feel watched?
This is where most policies fail. The Canadian Centre for Occupational Health and Safety warns that bringing in AI to mainly increase productivity, without consulting workers on its purpose and use, can have serious physical and psychological effects. Employees who feel they lack control over their own work pace, or who suspect the tool exists to monitor them, resist it or hide how they use it. Hidden use is exactly the shadow AI you were trying to avoid.
A rollout that works looks like this:
- Ask first. Before drafting, spend thirty minutes with the team. Which tools do they already use? What do they use them for? What worries them?
- Draft with the real tasks in mind. Write rules around actual jobs: drafting quotes, summarizing calls, cleaning spreadsheets. Abstract rules get ignored.
- Say what you do and do not monitor. If you track tool use, say so, say why, and keep it proportionate. The privacy commissioners' principle of necessity applies to employees as much as customers.
- Train on the policy. A page nobody has discussed is not a policy. A one-hour session with examples does more than an email.
- Give people a safe route. Provide an approved alternative for each common use, so "no" is never the only answer.
- Review it. Gather feedback after 60 to 90 days and adjust.
We cover the wider people side in our piece on AI change management in Canada, and it is worth reading alongside this one.
How do you keep AI output consistent with your brand?
A policy that only says what not to do leaves a gap. People also need to know what good looks like: tone, terminology, what claims are never made. The most reliable approach is to write these as rules a reviewer can check, rather than adjectives. Turning brand voice into testable rules is a useful habit, and it fits neatly into the human review section of your policy.
Our perspective: a policy is the first step, not the whole job
We build custom software and AI tools for small and medium businesses in Surrey and Metro Vancouver, and the same pattern shows up in almost every first conversation. The business has no malicious intent and no policy. Staff are using three or four AI tools, nobody is sure which, and company data is spread across separate systems for CRM, invoicing, scheduling and reporting. The policy question is really a data question: when information lives in many places, it is hard to say what an AI tool can safely touch.
Our view is plain. Write the short policy this week, because it costs little and removes the biggest risks. Then look at the tools underneath it. The cyber centre's joint guidance is firm that AI is not a set-and-forget technology. It carries ongoing risks, such as supply chain exposure and long-term loss of control over data, which means a continuous, risk-based maintenance cycle. A policy you never revisit will age badly.
We also think training matters more than most owners expect. People follow rules they understand and have practised on their own tasks. And we would rather tell you that AI will not fix a messy process than sell you a tool that hides one. If a step is unclear to your team, automating it only makes the confusion faster.
For a structured way to see where your risks sit, our AI risk assessment guide for Canadian teams is a good next read, and our notes on data retention policy mapped to your systems cover the records side.
— Harry Gill
Where can we help with your AI policy and rollout?
If you want the policy to be backed by practice, we run AI training and workshops built around your team's real tasks, so people learn the rules on the work they actually do. If you are deciding which tools to approve and which processes to automate first, AI strategy consulting gives you a plan before you commit budget. Where scattered systems are the root problem, we build custom software that brings CRM, invoicing, scheduling and reporting behind one login, so the data an AI tool can reach is a decision you make once. Our projects are fixed-price, you own the code, and we work locally in Surrey and across Metro Vancouver.
Frequently asked questions
Should employers have an AI policy?
Yes. Even a short one reduces the chance of customer or employee data ending up in a public tool, and it shows regulators and clients that you took reasonable care. Under Canadian privacy law, you stay accountable for personal information even when a third-party tool handles it.
How long should an AI usage policy be?
For a small business, one to three pages is plenty. Cover approved tools, data rules, human review, prohibited uses, incident reporting and a review date. If people cannot remember the main rules after a short training session, the policy is too long.
What is Canada's AI policy for businesses?
For most private businesses, the guidance is voluntary: the federal generative AI code of conduct plus existing privacy law. Provinces add their own rules, such as Ontario's job-posting disclosure requirement. Confirm the current federal position before you rely on any proposed legislation.
Can AI make hiring decisions for us?
It can help, but privacy commissioners advise against relying on AI for significant employment decisions without human oversight. A person should review any AI-assisted screening, and applicants should be told when AI is used where the law or good practice requires it.
How often should we update the policy?
Review it at least twice a year and after any incident or major tool change. AI products add features constantly, so a tool you approved in spring may work differently by autumn.
Sources
- Top 10 artificial intelligence security actions: A primer (Canadian Centre for Cyber Security)
- Principles for responsible, trustworthy and privacy-protective generative AI (Office of the Privacy Commissioner of Canada)
- Voluntary Code of Conduct on Advanced Generative AI Systems (ISED Canada)
- Protecting Employee Privacy in the Modern Workplace (Privacy Commissioners joint resolution)
- Employment Standards Act, 2000, section 8.4 (Ontario)
- CCOHS Health and Safety Report, March 2025
- Joint guidance on building trust in AI through a cyber risk-based approach (Canadian Centre for Cyber Security)