In Canada, shadow AI plays a dangerous game of legal patchwork: while federal privacy law currently lacks heavy fining power, one Quebec-based employee feeding customer data into an unsanctioned AI can trigger a penalty of up to $25 million or 4% of worldwide turnover under Law 25 (CQLR c. P-39.1, s. 90.1 ff.). The average breach still costs $4.45 million (IBM, 2023), and with Bill C-27 poised to bring GDPR-sized fines federally, the window of gentle enforcement is closing fast. The fix is not to lock the tools away, it is to arm your people with the know-how to innovate without lighting a compliance fuse.
The Foundation
AI Readiness
“No binding law yet doesn't mean no risk yet. We map what you have, train your people, and document it — ahead of the standard regulators are already pointing to.”
For: Digital agencies, marketing shops, and SMEs (5–25 employees), the exact segment Canada's own AI Strategy names as furthest behind on adoption.
What's delivered
- A full inventory of every AI tool in use, risk-tiered against the federal Voluntary Code of Conduct on Advanced Generative AI Systems and ISO/IEC 42001, with a Quebec Law 25 pass wherever tools touch personal information, ad targeting, audience profiling or candidate screening
- A 3-hour staff workshop on safe prompting and data handling, with certificates aligned to the Voluntary Code and ISO 42001 competency expectations
Why it matters now: Nearly half of Canadian SME owners have already put generative AI to work with no governance behind it. Quebec's Law 25 is already enforceable against exactly that gap, with no requirement that your business be based in Quebec — only that it touches a Quebec resident's data.
Outcome: A defensible paper trail and a trained team, in place before the rule that requires it exists.
Fixed scope · 10 business days · $4,900
The Specialized Add-On
Safe Content
“The review a $150k enterprise tool does, right-sized for a five-person studio.”
For: Agencies delivering AI-generated content to brand clients.
What's delivered
- Manual review of up to 15 AI-generated assets against likeness risk, copyright exposure, and Competition Act misleading-advertising exposure
- A client-facing "Content Passport" confirming what was checked and disclosed
- A short script for explaining AI use to clients without raising alarm
Why it matters now: The federal AI Strategy has already flagged AI-content labelling as a coming expectation, and a federal bill targeting non-consensual deepfakes is moving through Parliament. Getting disclosure and likeness review right now is cheaper than retrofitting it once either becomes law.
Outcome: Content that's ready for the labelling and disclosure standard Ottawa has already signalled.
Fixed scope · 5 business days
The Recurring Layer
Governance Retainer
“Canada's rules are being written in real time — a new AI ministry, a new national strategy, new bills on deepfakes and privacy. This is exactly when a retainer earns its keep.”
For: Graduates of our foundation engagement who want ongoing confidence.
What's delivered
- A living risk map, updated as new tools and vendor terms are adopted
- Plain-language alerts whenever federal (Voluntary Code updates, new bills) or provincial (Quebec Law 25, Ontario guidance) rules shift
- A standing advisory line for AI governance questions as they come up
Why it matters now: Unlike the EU, where the compliance target is at least written down, Canada's is still being assembled bill by bill. Tracking that shift yourself means reading federal and provincial developments in parallel; this tier means you don't have to.
Outcome: You stop having to track a genuinely fast-moving regulatory patchwork yourself.
Monthly retainer
Training Only
Intensive Workshop
“Half a day. Everyone in the room leaves knowing exactly what they can and can't do with AI.”
For: Teams that want training only, not full governance.
What's delivered
- A 4-hour hands-on session on safe AI use in creative workflows
- Certificates aligned with Canada's Voluntary Code of Conduct
- A 10-page reference guide (English or French) and 30 days of email Q&A
Why it matters now: Ottawa's strategy includes its own free AI-literacy push — good for the country, but it also means "we did some training" stops being a differentiator fast. Documented, certified, sector-specific training still will be.
Outcome: A team that can use AI confidently without a governance engagement.
Half-day