AI governance for Canadian firms, built on rules that actually apply
Trusted by
AI governance, three pillars, one operator.
One Canadian team works out what binds you, then builds the AI governance framework and the controls that back it.
Obligation mapping
We establish which rules reach you: sector, province, and whether you touch the EU at all. Naming what doesn't apply is half the value, because scoping an AI compliance programme to the strictest regime you've heard of is how firms buy work they'll never need.
Policy and model inventory
Every model catalogued with an owner, an approval record, and a review date. Your AI policy stays short and points at that register, because the register is the artifact people actually keep current.
Technical controls
Logging, access boundaries, and human review gates wired into the systems, not written in a binder. AI oversight only counts when someone can pull the log for a decision a model made last Tuesday.
Does AI Governance work the same way in every industry?
No. The AI Governance work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in government, Protected A, B and C data handling; and in defence and aerospace, controlled goods rules, CMMC and the flow-down from your prime. We keep the service and change the part that bends.
E-23 covers AI models from 2027-05-01. Model inventory and approval records, built.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Controlled goods rules, CMMC and the flow-down from your prime set what a supplier can do.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
What do you need from AI Governance?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- AI Governance
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584An AI governance framework for Canadian firms, made real.
Most AI governance work starts with the wrong rulebook. Here's how to find yours first.
Start with your rulebook, not the strictest one.
An AI governance framework worth having names your obligations, your models, and who answers for each. The pillars are the same everywhere: accountability, transparency, fairness, privacy. That part is settled and you can read it free on any vendor site. The work is deciding which rules bind you, because scoping to the strictest regime you've heard of is how firms buy a compliance programme they don't need. We start by asking whether you have EU users at all. Many Canadian firms don't, and the answer changes the budget by a lot.
Controls, not documents.
Then we build controls, not documents. Risk sits in three places. The model somebody deployed without telling anyone, which no policy catches. Approval that exists as an email thread rather than a record. And a framework whose review dates passed a year ago. We do model inventory, ownership, logging, and human review gates, and we use NIST AI RMF to organise the work because its four functions (Govern, Map, Measure, Manage) are practical and it's the most widely adopted reference. A framework is a filing system for decisions. It doesn't make them.
What actually binds a Canadian firm today.
Canadian obligations, as they stand on 2026-08-20. There's no federal AI statute in force: AIDA died at prorogation in early 2025 and the government has said it won't return as drafted, with narrower bills moving instead, including Bill C-36 on privacy and consumer data and Bill C-34 on digital-safety duties covering certain AI chatbot services (source: Torys LLP, 2026). What does bind you: PIPEDA, Quebec's Law 25, and for federally regulated financial institutions OSFI Guideline E-23, published 2025-09-11 and effective 2027-05-01, which covers AI and machine learning models directly (source: OSFI). The EU AI Act reaches you only if you touch EU users, and its penalties run to 35M euros or 7% of global turnover (source: Government of Canada Trade Commissioner Service).
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our AI oversight work runs.
Four steps, and the first one often saves the most money. Scoping means telling clients which regimes don't apply to them, and that conversation shortens a lot of proposals including our own. We'd rather build a framework that covers your real obligations well than a bigger one covering hypotheticals badly. After scoping, the work is unglamorous: catalogue the models, name owners, wire the logging, set review dates that someone is accountable for keeping.
Engagement phases
Phases 01 to 04
Scope the obligations
Sector, province, EU exposure, contractual commitments. We name what doesn't apply and why, in writing, so nobody reopens the question in month four.
Inventory the models
Every model in use, including the ones nobody registered. Owner, purpose, data, and approval status for each. Shadow deployments turn up in this step, and they always do.
Build the controls
Logging, access boundaries, human review gates, and an approval record. In the systems, not in a document, so the evidence is a query rather than a promise.
Set the review cadence
Dates, owners, and what triggers an out-of-cycle review. Regulation moves, and this is the step that keeps the framework current after we've gone.
AI governance questions, answered straight.
Answers first, including which rules probably don't apply to you. An architect takes the call.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- AIAI Readiness AssessmentA Canadian AI readiness assessment that examines your permissions and data, not a questionnaire.
- AIOn-Premise and Sovereign AISovereign AI for Canadian firms, on your hardware or in a Canadian region, with provable residency.
- AIRAG ImplementationCanadian RAG implementation that fixes retrieval quality first, because that's what fails.
Not sure where you stand? Take the free AI Governance readiness assessment
