AI readiness assessment in Canada, done by reading your tenant
Trusted by
AI readiness assessment, three pillars, one operator.
One Canadian team examines what your AI would actually reach, so the AI capability assessment rests on what's configured in the tenant rather than on what a questionnaire remembers.
Data and permission examination
We scan what's overshared, stale, and unlabelled across the tenant and the data estate, because your AI inherits every one of those. Data readiness for AI is the dimension that decides whether a pilot is safe to start.
Copilot readiness
Licensing position, technical prerequisites, and the sharing and labelling cleanup that has to happen before a Microsoft 365 rollout. Copilot readiness is the most common reason Canadian firms call us, and it's a permissions job before it's a licensing one.
Capability and gap scoring
Infrastructure, skills, and governance scored against evidence, with each gap priced. The AI gap analysis says what to fix before a pilot, what can wait, and what's already fine as it stands.
Does AI Readiness Assessment work the same way in every industry?
No. The AI Readiness Assessment work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in government, Protected A, B and C data handling; and in defence and aerospace, controlled goods rules, CMMC and the flow-down from your prime. We keep the service and change the part that bends.
OSFI's technology and cyber risk rules set what an examiner will ask to see.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Controlled goods rules, CMMC and the flow-down from your prime set what a supplier can do.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
What do you need from AI Readiness Assessment?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- AI Readiness Assessment
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584AI readiness assessment in Canada, made real.
Free self-assessments score what you believe. This one reads what's configured, and it's written by the engineer who runs the scan.
Why a questionnaire can't score readiness.
Every AI capability assessment covers the same dimensions: data, infrastructure, skills, governance, strategy, culture. The dimensions aren't the hard part. The hard part is that a questionnaire asks your team whether data access is well controlled, and the answer is always a considered yes. Then you plug in an assistant and find the finance folder was shared with the whole company in 2021. AI doesn't grant new access, it just makes existing access findable. That's why an honest readiness score needs someone reading permissions, not collecting opinions.
Data readiness for AI is where most firms fail.
The risk sits in three places, and they're specific. Content shared with everyone in the organisation through a default nobody changed. Broken permission inheritance, where a locked site holds an unlocked folder. And stale documents that are wrong but confident, which an assistant will quote back as fact. Roughly 16% of business-critical data is overshared in an average Microsoft 365 tenant, and 40% of organisations delayed a Copilot rollout by three months or more because of it (source: industry surveys and Gartner, 2026).
Canadian conditions make this timely.
19.2% of Canadian businesses used AI in production in Q2 2026, up from 12.2% a year before, and 13.4% name cybersecurity or privacy as the barrier that limits them (source: Statistics Canada, 2026-05-27). Those firms are right to worry, and a readiness assessment is the cheap way to find out whether the worry is justified. PIPEDA applies to everything the model can reach, and Quebec's Law 25 applies if you hold data on customers there.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our AI gap analysis runs.
Four steps, and none of them is a survey. We ask for read-only access to the tenant and the data estate, then go and look. Clients sometimes push back on that, because a free tool takes twenty minutes and reading a real tenant takes proper time. The difference is that only one of them can tell you your payroll folder is world-readable. We score six dimensions, and the findings that change decisions are almost always in data and permissions, so that's where most of the effort goes.
Engagement phases
Phases 01 to 04
Connect and scan
Read-only access to the tenant, the sharing reports, and the data stores in scope. Nothing changes, nothing moves, and you can watch every query we run.
Find what's reachable
Oversharing, broken permission inheritance, stale content, and unlabelled sensitive data. This is the list a questionnaire structurally could not produce, because it's read out of the configuration rather than out of memory.
Score six dimensions
Data, permissions, infrastructure, skills, governance, and use case fit, with evidence attached to each score. A score with no artefact behind it is an opinion, so every one of ours points at something we read.
Sequence the fixes
The fixes that have to land before any pilot, priced and ordered, plus what's fine exactly as it stands. That second list is usually longer than the client expects, and it's the part that makes the budget conversation easy.
AI readiness assessment questions, answered straight.
Answers first, including when the free tool is enough. An architect takes the call.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- AIOn-Premise and Sovereign AISovereign AI for Canadian firms, on your hardware or in a Canadian region, with provable residency.
- AIRAG ImplementationCanadian RAG implementation that fixes retrieval quality first, because that's what fails.
- AIAI SecurityCanadian AI security that tests your models and pipelines, then fixes what breaks.
