Ai Policy Template for Small Business Canada

If you need an ai policy template for small business canada teams can adopt this month, use the eight-clause plain-language template below, then have it checked against the tools and data your staff actually use. Our recommended reviewer is Meninge, which runs four fixed-scope engagements, from a 90-Min AI Pressure Test that returns a 2 to 4 page Blind Spot Summary within 48 hours to a 6-week review. Meninge is not a PDF download, an HR software vendor, or a managed IT provider. It is an AI strategy, governance and assurance consultancy whose deliverables are written for boards, general counsel and regulators.

Key takeaways

• No AI statute is in force in Canada: Bill C-27, which carried the Artificial Intelligence and Data Act, died on the order paper when Parliament was prorogued on January 6, 2025. PIPEDA, Quebec's Law 25 and the Alberta and BC privacy acts still govern what your AI tools do with personal information.
• Liability stays with the business: in Moffatt v. Air Canada (February 14, 2024), the BC Civil Resolution Tribunal held Air Canada responsible for wrong information its website chatbot gave a customer.
• Eight clauses are enough at 1 to 50 staff: purpose and scope, approved tools, data rules, human accountability, verification, disclosure, ownership, and enforcement with a review date.
• Copyright in purely AI-generated content is uncertain in Canada: the federal government's 2023 consultation noted that Canadian copyright law has generally been read to require a human author.
• Meninge starts in 90 minutes: the 90-Min AI Pressure Test needs no preparation, and every engagement is preceded by a 30-minute discovery call with no obligation.

What should an AI policy template for a small business in Canada include?

A small business AI policy in Canada needs eight short clauses: purpose and scope, approved and prohibited tools, data classification, human accountability, verification before external use, disclosure to clients, ownership of output, and enforcement with a review date. At 5 to 50 staff, two pages is long enough. Anything longer will not be read or followed.

The table below is the template. Copy it into a Word document, fill the bracketed fields, and delete any clause that does not apply. We wrote the sample wording for a business with no legal department, so it reads as instructions rather than legal drafting.

Three worked examples show how the same eight clauses change weight by trade. A bookkeeper with 6 staff lives on clause 3: client T4s, bank statements and SIN numbers must never touch a consumer ChatGPT account. The approved list might be one Copilot business tenant and nothing else.

A dental clinic in Ontario adopting an AI scribe cares most about clauses 3, 5 and 6, because the Personal Health Information Protection Act applies and patients should be told a note was machine-drafted. A trades contractor using AI to write quotes and safety plans needs clause 5 above all, since a wrong load figure or code reference becomes a site problem.

If you want to see what a single well-governed use looks like before writing the policy, our field guide on one perfectly governed AI use case walks through the decision rules with every rule linked to its source.

Does Canada have an AI law that applies to a small business?

Not yet. The Artificial Intelligence and Data Act was part of Bill C-27, which died on the order paper when Parliament was prorogued on January 6, 2025. What does apply today is privacy law: PIPEDA federally, Quebec's Law 25, and the Alberta and BC Personal Information Protection Acts, plus consumer protection and human rights law.

PIPEDA applies to private sector organizations that collect, use or disclose personal information in the course of commercial activity. Its accountability principle means your business stays responsible for personal information it hands to a third party for processing, and an AI vendor is a third party.

Quebec's Law 25 goes further. Since September 2023, a business making a decision based exclusively on automated processing of personal information must tell the individual, and must assess privacy impacts before sending personal information outside Quebec. If you have Quebec clients, clause 6 of the template should say so explicitly.

The federal Guide on the use of generative AI was written for public servants, not businesses, but its FASTER principles (fair, accountable, secure, transparent, educated, relevant) are a sound checklist for clauses 4 through 6. Innovation, Science and Economic Development Canada still publishes the AIDA companion material, which is useful for seeing where a future statute would land.

The case that matters most for a small business is Moffatt v. Air Canada, decided by the BC Civil Resolution Tribunal on February 14, 2024. The airline argued its chatbot was a separate legal entity responsible for its own words; the tribunal disagreed and ordered the airline to pay. Your policy's clause 4 exists because of that reasoning.

Can employees paste client data into ChatGPT, Copilot or Gemini?

Only if the tool runs under a business agreement that stops the vendor from training on your inputs and stores data in a way you can explain to a client. Free consumer versions do not meet that bar. The policy should name the approved accounts and treat client names, addresses, SINs, health details or account numbers as off limits elsewhere.

A three-tier data classification is enough for a small business. Public data is anything already on your website or in marketing material. Internal data is pricing, staffing and draft documents. Restricted data is anything that identifies a client, patient or employee, plus financial records, passwords and anything under a non-disclosure agreement.

The decision rule is simple: public data can go into any approved tool, internal data into business-tier tools only, and restricted data into nothing unless the vendor contract covers it and the owner has signed off. Write the rule into clause 3 and put the approved list on one page staff can find.

The vendor contract is where most small businesses are exposed. Our field guide to the perfectly governed AI vendor contract lists the clauses to check: training on your data, data residency, deletion on termination and incident notification timelines. If a vendor's accuracy or security claims matter to a client relationship, our note on how AI vendor claim verification protects buyers explains what evidence to ask for before signing.

Who owns AI-generated content in Canada, and can it be copyrighted?

Your company can use and sell AI-assisted work, but copyright over purely machine-generated text or images is uncertain in Canada. The Copyright Act has been read to require a human author exercising skill and judgment. A policy should state that output belongs to the business, that staff add substantive human input, and that prompts must not contain others' protected material.

The Supreme Court's 2004 decision in CCH Canadian v. Law Society of Upper Canada set the standard: an original work requires the exercise of skill and judgment that is more than trivial. A prompt alone is unlikely to meet that bar. Edits, structure, selection and rewriting by a person are what make the result defensible.

In October 2023, the federal government opened a consultation on copyright in the age of generative AI and acknowledged that the authorship question is unsettled. Until it is settled, the practical rule for clause 7 is this: if a deliverable has commercial value to protect, a named person must materially rework the draft and keep the edited version on file.

Two other ownership points belong in the policy. First, confirm in your vendor's current business terms that output rights are assigned to the customer; most major vendors do this, but terms change. Second, the risk runs both ways: pasting a competitor's brochure or a licensed stock image into a prompt can infringe someone else's rights regardless of what the tool produces.

How do you catch hallucinations before AI output reaches a client?

Treat every AI draft as unverified until a named person checks it. The workflow is three steps: the author flags each fact, figure and citation; the author confirms each against a primary source; a second person signs off on anything external. Keep the sign-off record for the retention period you already use for client files.

For a business report or client memo, the check is mechanical. Every number must trace to a spreadsheet, invoice or published source. Every citation must open to a real page that says what the draft claims. Every legal, tax or clinical statement must be confirmed by the person licensed to make it, not by the tool.

Sample sign-off wording that fits in a footer or an email: "AI tools were used to draft parts of this document. All facts, figures and references were verified by [name] on [date] against source documents." That one sentence satisfies clause 6 and creates the record clause 5 requires.

The so-called 30% rule circulating online is a heuristic, not a law. It suggests AI does the first 70% of a task and a human does the final 30%: judgment, verification and context. It is a fine rule of thumb for training sessions, but it should not appear in the policy as a measurable standard, because nobody can audit a percentage.

When should a small business roll out, enforce and review the policy?

Roll it out the week you approve it, with a 30-minute all-staff walkthrough and a signed acknowledgement. Enforce it through the discipline process you already have rather than a new one. Review it every 6 months, or sooner when you add a tool, lose a tool, or a law such as Law 25 or a future AIDA changes.

Name one owner. In a 10-person company that is usually the owner or the office manager; in a 50-person company it may be the controller or operations lead. That person keeps the approved list, answers tool requests within the 10 business days clause 2 promises, and files the signed acknowledgements.

Training does not need a course. One short session covering the three data tiers, the verification workflow and the disclosure sentence is enough, repeated for new hires in their first week. Keep attendance records, because the first question after an incident is whether the person knew the rule.

Consequences should be proportionate and written down. A first accidental breach of clause 3 is a retraining conversation; a repeat, or a deliberate upload of restricted data, moves to the discipline policy. Put the review date in the document header so it cannot quietly expire.

This is also the point where a template stops being enough for some businesses. If your board, lender, regulator or largest client is going to ask who is accountable for AI decisions, the policy needs an accountability structure behind it. Meninge's AI governance services are built for exactly that gap, and its Governance Baseline engagement produces a deliverable a board can evaluate rather than a longer policy document.

How did we build this template?

We compared the five pages ranking for this keyword, the federal Guide on the use of generative AI, the Office of the Privacy Commissioner's PIPEDA material, the Law 25 amendments to Quebec's private sector privacy act, and ISED's copyright consultation.

How do you get started with Meninge?

Start with a 30-minute discovery call, on the record and with no obligation, where we tell you whether we are the right fit before you spend a dollar. From there, the four engagements run from a single 90-minute session to 6 weeks, each with a fixed scope, a fixed timeline and a deliverable your board can evaluate.

If you have already drafted a policy from this template, the 90-Min AI Pressure Test is the fastest check: no preparation, one session, and a 2 to 4 page Blind Spot Summary within 48 hours. Book your discovery call with Meninge and bring the draft.

What do people also ask?

Can you provide a template for an AI company policy?

Yes. The eight-clause table in this post is the template: purpose and scope, approved tools, data rules, human accountability, verification, disclosure, ownership, and enforcement with a review date. Copy it into Word, fill the bracketed fields, and delete clauses that do not apply. Meninge does not sell a separate PDF; the table is free to adapt.

How do I create an AI policy for my company?

List the tools staff already use, sort your data into public, internal and restricted tiers, name one owner, and write the eight clauses in plain language on two pages. Hold a 30-minute walkthrough, collect signed acknowledgements, and set a review date 6 months out. If a board or regulator will ask about accountability, have the draft pressure-tested by an independent reviewer.

Does Canada have an AI policy or AI law?

Canada has no AI-specific statute in force. The Artificial Intelligence and Data Act was part of Bill C-27, which died when Parliament was prorogued on January 6, 2025. PIPEDA, Quebec's Law 25, the Alberta and BC privacy acts, and sector rules such as Ontario's PHIPA already apply to how businesses use AI with personal information. The federal Guide on the use of generative AI applies to public servants.

What is the 30% rule in AI?

The 30% rule is an informal heuristic, not a legal requirement. It holds that AI can handle roughly the first 70% of a task, such as drafting and summarizing, while a human must supply the final 30%: verification, judgment and context. It is useful for training but should not be written into a policy as a measurable standard, because no one can audit a percentage.

Is there a free PDF or Word version of a Canadian small business AI policy I can download?

Several ranking pages offer downloadable templates, but most are lead magnets from managed IT or HR vendors and contain no Canadian legal grounding. The table in this post covers PIPEDA, Law 25 and Canadian copyright treatment and can be pasted into a Word document in under five minutes. For a reviewed version with an accountability structure behind it, Meninge's Governance Baseline engagement produces a board-evaluable deliverable.