Four documents · thirty-two controls · CAD $595
The structured way through work that is mostly not AI work
Everything in this pack is public. Microsoft publishes the method, Quebec publishes the statute, and OWASP publishes the agent guidance. What does not exist anywhere is a sequenced way through it that an owner or an operations lead can actually run. That is what you are buying, and we would rather say so plainly than pretend the information is secret.
What is actually in it
Gap analysis workbook
Thirty-two controls in four phases, in the order a rollout has to do them.
- Know what is already exposed — the inventory, ownerless spaces, organisation-wide and external sharing, broken inheritance, where the sensitive material actually lives.
- Set the guardrails — defaults, labels that carry real enforcement, rules on what may be put into a tool, and a way of seeing what is in use.
- Records, retention and the law — prompts retained and discoverable, purpose limitation decided, contracts checked.
- People and agents — accountability, the register, who may publish an agent, the Rule of Two, and the leaver process.
- Each control says what it means in plain words, why it matters, and where to look for it. Status, evidence, owner and target date are yours.
The other three documents
Each does one job, and the workbook points at them where they are needed.
- AI system and agent register. Every assistant, integration and agent: what it reaches, who owns it, whether anyone approved it, whether it acts alone. The AI counterpart of a records-of-processing register.
- Rollout plan and decision gates. Four gates, each a decision by a named person on a date. Pilot design, acceptance criteria written before the pilot rather than after, and a go or no-go record.
- Law 25 automated decisions. The assessment, the three duties, model notice wording, and the records of explanations given and human reviews carried out.
- Excel and Word. Nothing locked, watermarked or protected.
The two lines that do the most work
The workbook counts itself, but the totals are the least interesting part of it. Two lines on the summary sheet matter more than the rest put together.
- Controls marked in place with no evidence recorded. This is the line an auditor, an insurer or an acquirer will ask about, and it is the gap between believing something is done and being able to show it. It is usually not zero.
- Phase 1 controls not yet in place. This is the line that decides whether you should switch anything on at all. Everything in Phase 1 is about knowing what is already exposed — and turning on an assistant before you know that is how a salary file ends up in a search result.
Who this is for, and who it is not
It is written for an owner, an operations lead or an office manager who has been handed responsibility for an AI rollout and is not a specialist. Every control is in plain words, and the technical feature names sit in a separate column so they can be handed to whoever administers the tenant.
It is not for a large enterprise with a dedicated governance function, who will already have their own control set and will find this too light. And it will not configure anything for you — see below.
AI rollout governance pack
All four documents. Yours to keep, edit and rebrand. Licensed to one organisation.
- Two Excel workbooks that count themselves, with dropdowns and fill-in cells marked.
- Two Word documents you can put your own logo on.
- Revisions free for twelve months, which matters here because feature names in this area change quarterly.
- English. Available in French Canadian on enquiry.
CAD $595
Buy the AI rollout pack — $595Secure checkout by Stripe · emailed within one working day
Try the free one first
There is no reason to buy this before you know whether you need it, and one of the free tools will tell you in five minutes.
- The readiness check asks twelve of the same questions and gives you the gaps in fix order.
- If it comes back comfortable, you probably do not need this pack yet.
- If it comes back uncomfortable, this is the structured version of the same thing.
- No email address, nothing recorded.
Free
Take the readiness checkFive minutes · nothing leaves your browser
Where the line falls
This pack will not configure anything, and we will not configure it for you.
It tells you what to do, in what order, and records who decided it. The permissions clean-up, the labelling and the tenant configuration belong to you or to your IT provider. We do not remediate what we assess, which is the reason our assessment of it is worth anything — and it does mean that if what you want is somebody to come and fix it, we are the wrong people and will say so.
Completing this pack is not a certification. It does not make you compliant with any standard or statute, and it is not legal advice. On the Law 25 questions in particular, where the answer is close, take Quebec counsel and keep their view in writing alongside the form.
What to read first
If you have not yet read what actually governs AI in Canada, start there and it is free. There is no Canadian AI Act, whatever a supplier may have told you, and knowing what genuinely applies changes what this pack is for.
Current at 29 August 2026. Feature names in this area change frequently and legislative status moves; revisions are free for twelve months and every document carries its own date.