Service · most popular starting point
Find out what your AI assistant would expose before your staff do
Copilot, Gemini, ChatGPT Enterprise and the agents built on them do not break your file permissions. They inherit every one you got wrong, and turn years of quiet oversharing into something anyone can find by asking a question in plain English. This review tells you what would surface, what oversight you actually owe under Canadian law, and what to fix before you switch it on — or before you widen a pilot that is already running.
Not ready to talk yet? Read the white paper first — what changes the day you switch Copilot on, what Canadian law requires before that day, and ten questions for the board.
Who this is for
Organisations of roughly fifty to a thousand people that are about to roll out an AI assistant across the business, or that have one running in a pilot and cannot say with confidence what it can see. It suits a board that has been asked to approve the licences and wants something better than the vendor's assurance, and an IT lead who suspects the permissions are not as tidy as the org chart suggests and would rather find out from us than from a staff member.
It is also the right first step if you have already had a near miss — somebody asked the assistant a question and got an answer they should not have — and you need a dated record that the organisation looked, and what it did about it.
Why now, in Canada
Not because a new statute has arrived. It has not. The Artificial Intelligence and Data Act died with Bill C-27 when Parliament was prorogued in January 2025, and Canada has no general private-sector AI law. Anyone telling you that you must be compliant with Canadian AI legislation should be asked which section of which act.
The exposure is operational before it is regulatory. The usual first incident is not a breach and not an attack. Somebody asks what the salary bands are and gets a correct answer, from a file they were never meant to read but were always technically entitled to. The assistant did nothing wrong. That is the point.
Where the law does reach, it reaches through Quebec. Law 25 has been in force since September 2023 and carries the only genuine automated decision-making regime in the country. If any intended use involves a decision based exclusively on automated processing, you must tell the individual and, on request, explain the information used, the reasons and the principal factors, and offer human review. If you have Quebec staff or Quebec customers, it applies whether or not you are in Quebec.
And PIPEDA's purpose limitation is the quiet one. Personal information collected for one purpose cannot simply be repurposed to train or ground a model. "We already held the data" is not an answer.
So the work happens before you switch it on, and most of it is not AI work at all. It is permissions, classification and retention — the unglamorous things that were already overdue.
What we actually do
What the assistant can reach, using the access your people already have.
- Sharing and permission sprawl across SharePoint, OneDrive, Teams and shared mailboxes — tested, not assumed
- Sample prompts run against a representative set of accounts, with what came back recorded
- Sensitive categories found in reach: HR, payroll, board papers, customer data, solicitor-client privilege
- Whether your labelling and data-loss controls actually change what the assistant returns
The policy, records and decisions the deployment needs around it.
- Whether Law 25's automated decision duties reach any of your intended uses
- Whether a privacy impact assessment is required, and what it has to say
- Acceptable-use rules for staff, written for the tools you actually run
- An AI system and agent register, so the board knows what is deployed and who owns it
- Who may publish an agent, what data it may reach, whose identity it acts under, and what happens to it when its author leaves
Two documents and a dated position.
- A written report: findings with severity, the evidence behind each, and what to fix in what order
- A one-page board summary: the position, the decisions only the board can take, and the date
- A minute-ready paragraph recording that the board considered it
- A re-check of the priority fixes, included, once you tell us they are done
What we do not do
We do not sell licences, we do not implement the fixes, and we are not partnered with any AI vendor. The review reports what we found. If the answer is that the deployment should wait, we say so, and that costs us nothing because we have nothing else to sell you at the end of it.
If you then want the tenant tidied up, we can introduce a firm that does that work. We will not then assess the result ourselves. That is the whole reason the findings are worth reading.
What this looks like in practice
The Copilot rollout that paused for three weeks, on purpose
A 140-person Toronto professional services firm with clients in Quebec, four weeks from Microsoft 365 Copilot go-live.
Why it mattered now. Copilot does not break permissions; it reads everything a user can already open and summarises it on request. Quebec clients’ data falls under Law 25, which requires a privacy impact assessment before a new system processes it, and Bill C-36, tabled in June 2026 to replace PIPEDA, would add transparency duties for automated decisions.
What we found.
- A first-year associate could ask Copilot for “salary review 2025” and receive a summary of partner compensation, from a finance folder shared firm-wide in 2019.
- Quebec client tax files were reachable by most staff through inherited team-site permissions, and no privacy impact assessment covered the change.
- The AI policy said “do not enter client data into AI tools”, yet the tool being deployed was built to read client data.
What the board received. Three fixes to complete before go-live and two within 90 days. The partners moved go-live back three weeks and launched to a pilot group first.
“The risk was never the AI. It was eight years of sharing that nobody had looked at.”
This is an illustrative composite based on typical engagements, not a named client. Source: ISED, Bill C-36 tabled June 2026.
What it costs
One tenant, one assistant, up to roughly a thousand accounts. The fee is fixed in the scoping letter and does not change afterwards.
From CAD $6,000
Plus applicable taxes. Larger tenants, more than one assistant, or an agent estate built on top of the assistant are priced on scope — and you have the figure in writing before any work starts. No day rates.
If you want to know where you stand first, the Copilot readiness check takes about ten minutes and gives you a written position. No account, no email address.
Free
The AI rollout governance pack — the document set we work from — is CAD $595 if you would rather run the review internally. Our acceptable use policy template is free.
There is no Canadian AI Act to certify against, and we are not a certification body. What you receive is a dated assessment against a published control set, which is what a customer, an insurer or a director is actually asking for.
What actually happens, and when
First conversation
No charge and no obligation. We establish which assistant, how many people, what it is meant to do, and whether a review is worth doing yet. Some organisations are better served by the free readiness check first, and we will say so.
Within a week
A scoping letter with the fixed fee, what is in and out, and the access we need: a read-only reporting account and a small number of test accounts that mirror real roles.
Your effort
Allow four to six hours of your IT lead's time across the engagement, mostly at the start. Nobody else needs to be involved until the walkthrough. This is the part organisations underestimate, so we would rather say it plainly.
Two to three weeks
We test exposure, review the oversight documents you already have, and draft findings. If we find something serious we tell you the same day rather than saving it for the report.
Walkthrough
An hour with the people who will act on it, and a separate twenty minutes with the board or its chair if wanted. You receive both documents that day.
Afterwards
The findings are yours. When the priority fixes are done we re-test them and issue a dated confirmation, included in the fee.
Allow three to four weeks from first conversation to walkthrough for a single tenant. Timings assume access arrives reasonably promptly; if it does not, we will tell you what is holding it up rather than quietly slipping.
There is no charge for the first conversation and no obligation at the end of it. If a review is not the right next step, we will tell you what is. What actually governs AI in Canada is set out in full, free, on There is no Canadian AI Act.