AI Governance Guide & FAQs for SMBs in Canada
Written by: The H2R Team
Most small and mid-sized employers are already using AI in the workplace. Employees use it to draft emails, summarize documents, and screen resumes, often without clear rules or precautions to take. This exposes your business to major risk, but the use of AI is hard to track and largely unavoidable.
This AI governance guide is written for Ontario employers who don’t have a dedicated compliance team (which is the case for most SMBs). We’ll cover what AI governance means, where employers commonly go wrong, policy wording that holds up in practice, and what to put in place first.
Table of Contents
What AI Governance Means for a Small Business
AI governance is the set of decisions a company makes about how AI gets used at work, and who is responsible for those decisions. In practice, it answers five questions:
- Which AI tools are people allowed to use?
- What information can go into AI?
- What work can AI help with, and what work is off limits?
- Who checks AI output before it reaches a client, a customer, or an employee file?
- Who owns the rules, and when do they get updated?
Large organizations may add risk registers, model audits, and ethics committees. For an SMB with only 20-200 employees, this may not be necessary on day one, but something to consider as your organization scales.
Formal frameworks like the NIST AI Risk Management Framework or ISO/IEC 42001 are useful to reference, but following them exactly may overcomplicate the process for smaller organizations that aren’t as AI-driven. If your organization’s AI use only involves something like drafting emails and summarizing documents, it’s best to take a simple, straightforward approach to governance.
Need Help Putting AI Governance Into Practice?
You don’t need a full-time HR team to build practical AI governance. Fractional HR support can help you set clear policies, define responsibilities, assess workplace risks, and give employees guidance on using AI appropriately.
AI Governance vs. AI Policy vs. AI Training
| What it is | What it looks like in a 50-person company | |
|---|---|---|
| AI governance | The overall system of decisions, ownership, and review | A named owner, an approved tool list, a quarterly check-in |
| AI acceptable use policy | The written rules employees follow | A two to four page document reviewed at onboarding |
| AI training | Teaching people to use tools well and safely | Hands-on sessions built around real tasks in each role |
A policy without training will get signed and forgotten. Training without a policy leaves people guessing where the lines are. Governance is what keeps both of them relevant.
Why AI Governance for Small Business Matters in 2026
Your Employees Are Already Using AI
Whether you’ve approved it or not, AI is already being used at work.
A 2026 Angus Reid Institute survey found that:
- Only 31% of Canadians who use AI at work said their employer had an official AI policy.
- 39% of Canadians said there was no AI policy at all.
A 2026 Employment Hero survey found that:
- 34% of Canadian workers hide their AI use from their employer.
- 45% of business leaders suspect employees are using personal AI accounts for work.
This demonstrates a troubling trend: People are more likely to hide AI use when the rules are unclear and they don’t know what is allowed.
The Everyday Risks of Using AI
For most small businesses, AI risks come from how the tools are used day to day:
- Confidential information leaving the business: Client names, pricing, employee details, or contracts entered into AI tools without checking how the data is handled.
- Wrong information reaching clients: AI-generated content that sounds right but contains an incorrect fact, figure, or legal detail.
- AI influencing people decisions: Using AI to screen applicants, draft performance reviews, or assess attendance can create greater legal risk.
Ontario Rules Already Apply to AI Use
Provincial laws already apply to AI usage. Here’s a quick overview:
| Rule | Who it applies to | What it means for AI |
|---|---|---|
| ESA job posting disclosure | Employers with 25+ employees when a public job is posted | Job postings must say if AI is used to screen, assess, or select applicants |
| ESA electronic monitoring policy | Employers with 25+ employees on January 1 | AI tools that monitor employee activity may need to be covered by the written policy |
| Ontario Human Rights Code | All employers | Employers remain responsible for discriminatory employment decisions, even when an AI tool or vendor is involved |
| Federal privacy law (PIPEDA) | Organizations handling personal information in commercial activity | Personal information entered into AI tools remains subject to privacy requirements |
Also worth watching: Bill C-36, introduced in June 2026, would replace PIPEDA with new private-sector privacy rules that include requirements around automated decision-making. At the time of writing, the bill is still before Parliament.
Note: This is general information, not legal advice. If you’re using AI for hiring, discipline, termination, or other employment decisions, get advice specific to your situation.
Where Employers Usually Get AI Governance Wrong
Banning AI Entirely
A complete ban of all AI usage feels like the safest and easiest option, but it’s not that simple. It doesn’t guarantee that your people aren’t using AI. What it actually does guarantee is that AI use moves to personal phones and personal accounts, where usage is hidden and you have no visibility at all.
The Borrowed Enterprise Policy
Someone downloads an AI policy written for a bank or a large tech company, swaps in the logo, and sends it out. It refers to an AI ethics board you don’t have, a model risk team you don’t have, and approval steps nobody will follow.
When a policy doesn’t match how the business actually runs, people ignore it.
Rules Too Vague to Act On
“Use AI responsibly” is not a rule. Neither is “exercise caution with sensitive information.” Employees can’t follow a standard when they don’t know how to put it into practice.
But how do you know when rules are too vague? If two reasonable people could read a line in your policy and reach opposite conclusions, that line needs rewriting.
Nobody Owns Your AI Policy
The policy gets written, approved, and filed. Six months later the tools have changed, three new ones are in use, and nobody’s responsible for checking and updating the policy accordingly. Governance without an owner quietly expires, and rules that were once clear are now creating more uncertainty.
Treating AI as an IT Problem
IT should vet tools for security. But most AI governance questions are people questions: What’s fair in hiring? What should employees disclose? How do managers handle mistakes? What does training look like?
That’s why AI governance usually works best as a shared responsibility between operations, HR, and whoever manages your technology.
Who Is Responsible for AI Governance?
Who Is Responsible for AI Governance in a Company?
Leadership is accountable, but day-to-day ownership works best with one named person. Everyone else has a defined part to play.
| Role | Responsibility |
|---|---|
| Owner or leadership team | Sets risk appetite, approves high-risk uses, funds tools and training |
| AI governance leade.g., an operations manager or HR lead | Keeps the tool inventory, answers questions, runs reviews, handles reports, and updates the policy as needed |
| IT or your managed service provider | Security review, account setup, access controls |
| HR | People-related uses, training, policy communication, employee concerns |
| Managers | Apply the rules in their teams and review AI-assisted work |
| Employees | Follow the policy, check their own output, report problems |
In a 30-person company, one person may wear three of these hats. That’s fine, as long as it’s written down and everyone understands who’s responsible for what.
What Role Should Leadership Play in AI Governance?
Employees notice quickly when leaders don’t follow their own rules. In practice, leadership should:
- Decide where AI is encouraged and where it’s off limits: This call shouldn’t be delegated.
- Approve high-risk uses personally: Anything that informs decisions about employees or handles sensitive client data.
- Pay for approved tools: If the company won’t fund business accounts, people will use free personal ones. A September 2026 CDW Canada report found that a third of Canadian office workers still have no approved AI tools available to them.
- Use the approved tools themselves: A leader pasting board documents into a personal chatbot undoes the policy faster than any memo or overdue update.
- Make reporting safe: If people are punished for honest mistakes made with AI, they’ll stop reporting them.
Who Should Approve AI Tools Before They Are Adopted?
A tiered approval process can help keep low-risk tools from waiting weeks and stops high-risk tools from slipping through.
| Type of tool | Who approves |
|---|---|
| Personal productivity with no sensitive datae.g., writing help, scheduling | AI governance lead |
| Handles client, financial, or confidential business data | AI governance lead plus IT review |
| Informs decisions about employees or applicants | Leadership sign-off plus HR review |
New AI features in software you already use count too. Applicant tracking systems, CRMs, and office suites add AI features regularly, and some are switched on by default. Regardless of if you were aware or not, you’re still accountable for them.
Compare two ways of writing the rule:
- Weak: “All AI tools must be approved by management.”
- Stronger: “Before using a new AI tool, or turning on AI features in software we already use, submit a request to the AI governance lead. Tools that will handle client or employee information also need IT review.”
The stronger version names the person, covers built-in features, and tells employees what triggers extra review.
How Can SMBs Keep Track of the AI Tools Employees Are Using?
Start with a short anonymous survey asking which tools people use, for what tasks, and whether they use company or personal accounts. Then check expense reports, company credit card statements, and your admin console for AI subscriptions.
Record the results in a simple register. A spreadsheet with the tool, its owner, approved uses, what data it can handle, and a next review date is enough. Expect a few surprises, like several tools doing the same job or a team using a free version of something the company already pays for.
Assessing and Managing AI Risk
How Can Businesses Assess AI Risks Before Implementing a Tool?
Most SMBs don’t need a formal risk methodology. Before you buy or switch on a tool, ask:
- What information will it touch?
- Will its output go outside the company?
- Does it affect decisions about people?
- What happens if it’s wrong, and would anyone notice?
Keep the review proportionate. A writing assistant that never sees client data may need 15 minutes. A tool that screens applicants or handles client records needs a full vendor and privacy review before you sign anything. The time to find out a tool trains on your data is before the contract is in place.
What AI Governance Controls Should SMBs Have in Place?
Think about controls the way you’d separate required and preferred qualifications in a job posting. Some are needed on day one, others can wait until the basics are working.
| Required now | Add as your AI use grows |
|---|---|
| An inventory of approved tools | Formal vendor risk scoring |
| Clear rules on what data can go into AI | Data loss prevention software |
| Human review rules for client-facing and people-related work | Documented review logs and audits |
| One named owner | A cross-functional AI committee |
| Basic training for everyone | Advanced training for heavy users |
| An incident reporting process | Formal incident response testing |
What Data Should Employees Never Enter Into AI Tools?
A three-level system is about as much as people will remember under deadline pressure:
- Green, fine in approved tools: Public information, general writing tasks, drafts with no identifying details.
- Yellow, approved business-account tools only: Internal documents, non-sensitive project details, anonymized data.
- Red, never enter unless a tool is specifically approved for it: Employee personal information, health information, client confidential data, financial account details, passwords, and anything under an NDA.
Before approving any tool for yellow or red data, confirm where the data is stored, whether it’s used to train the vendor’s models, and how long it’s kept.
How Often Should an AI Governance Framework Be Reviewed?
- Every quarter: The tool inventory and approved uses.
- Every year: The full framework and policy.
- Right away: When you add a tool that handles employee or client information, a vendor changes how its system works, something goes wrong, or the law changes.
Between reviews, keep a simple incident log and spot-check a sample of AI-assisted client work each month.
Human Oversight and AI Decision-Making
What AI Decisions Require Human Review?
| Level of review | Examples |
|---|---|
| A person makes the decisionAI can inform, not decide | Hiring, promotion, pay, performance ratings, discipline, termination, accommodation requests |
| A person checks before it's used | Client documents, marketing copy, job postings, policy drafts |
| Light or no review | Internal drafts, brainstorming, formatting |
How Can HR Ensure Human Oversight of AI Decisions?
“A human reviews it” means very little if the reviewer is skimming and clicking approve. Meaningful oversight needs three things:
- Authority: The reviewer can overrule the tool without having to justify it.
- Time: Reviewing 200 AI-ranked applicants in 20 minutes isn’t oversight.
- Understanding: The reviewer knows what the tool looked at and what it didn’t.
One useful check is to track how often reviewers disagree with the tool. If the answer is almost never, the review may not really be happening.
When Should Employees Be Told AI Is Being Used in a Decision About Them?
Before AI meaningfully contributes to a decision about their job, pay, schedule, evaluation, or monitoring. Tell people up front, not after a complaint.
A good explanation covers what the AI did, what information it used, who made the final call, and how to raise a concern:
- Weak: “Your schedule was generated by our workforce management system.”
- Stronger: “Our scheduling software suggested this week’s shifts based on forecasted sales and your availability. Your manager reviewed and approved the final schedule. If something doesn’t work, let your manager know as soon as possible.”
AI Governance in HR and Employment
How Should Companies Govern AI Used in Recruitment and Hiring?
- Know what your hiring software does: Many applicant tracking systems now score, rank, or filter candidates, and some of these features are on by default.
- Disclose where required: As covered above, Ontario employers with 25 or more employees must say in public job postings whether AI is used to screen, assess, or select applicants.
- Don’t let AI reject people on its own: A person should review before anyone is screened out.
- Check outcomes: Compare who moves forward at each stage for patterns that don’t make sense.
- Keep records: Ontario’s job posting rules also require covered employers to keep recruitment records for three years.
On disclosure wording:
- Weak: “We may use technology in our hiring process.”
- Stronger: “We use AI-assisted software to help screen applications for this role. A member of our hiring team reviews applications before any candidate is declined.”
Only include that second sentence if it’s true. To be fair to the technology, AI screening isn’t automatically worse than a tired recruiter skimming 300 resumes at 9:00 pm.
How Should Companies Govern AI Used for Employee Performance Decisions?
AI can help a manager turn rough notes into clear review language. It shouldn’t generate ratings, rank employees, or recommend discipline on its own. Productivity data from monitoring tools is especially easy to misread, since it doesn’t know who spent two weeks training a new hire or is working under an accommodation.
- Weak policy wording: “Managers may use AI to support employment decisions.”
- Stronger: “AI may help draft review language or summarize notes. It may not rank, score, or recommend employees unless the tool has been approved for that use. Final decisions are made and documented by a manager.”
How Should Companies Handle an AI System That Produces Biased Results?
- Pause the affected use until you understand what happened.
- Preserve records of the tool’s output and the decisions made.
- Revisit affected decisions where you can, such as re-reviewing screened-out applicants.
- Talk to the vendor, and get legal advice if the bias may relate to a protected ground.
- Fix or replace the tool, then document what changed.
Remember who carries the risk. When an AI-assisted people decision goes wrong, the employer is accountable, not the vendor.
What AI Training Should Employees Receive?
| Group | Training focus |
|---|---|
| Everyone | Policy basics, data rules, checking output, reporting problems |
| Managers | Reviewing AI-assisted work and keeping people decisions human |
| HR and hiring managers | Applicant tracking system features, bias, disclosure requirements |
Train on real tasks within 30 days of hire, with a refresher session each year. Avoid “intro to AI” sessions that only cover generic information instead of what’s directly relevant to the role/organization.
How Should Employees Report Concerns About an AI System?
Name a contact (usually the AI governance lead) plus a backup, offer an anonymous option, and commit to acknowledging reports within one business day. Most importantly, protect good-faith self-reporting. Someone who pasted a client file into the wrong tool should feel safe telling you within the hour, otherwise, you might never know.
Want a Second Set of Eyes on How Your Team Uses AI?
Most AI governance gaps show up in HR first: hiring tools nobody fully understands, reviews drafted with AI, and no clear process when something goes wrong. H2R works alongside your team to assess how AI is actually being used and build practical guardrails around it.
We can review usage and help you develop an AI policy from it.
AI Vendors and Third-Party Tools
Most SMBs buy AI rather than build it, which makes vendor review one of the most practical parts of AI governance.
What Questions Should SMBs Ask AI Vendors Before Adopting a Tool?
- Where is our data stored and processed?
- Is our data used to train your models, and can we opt out?
- How long do you keep our data, and how do we delete it?
- Who on your side can access it, and how will you notify us of a breach?
- Has the tool been tested for bias, and can you share the results?
- Can a person override every output?
- Can we switch individual AI features off?
- Will you tell us before AI features are added or changed?
It’s better to be safe than sorry. If a vendor can’t answer these clearly, that tells you something.
What Should SMBs Look for in an AI Vendor’s Terms and Conditions?
| Clause | What you want | Red flag |
|---|---|---|
| Use of your data | No training on your inputs, or a clear opt-out | A broad licence to use your content to improve their services |
| Retention and deletion | A defined period, with deletion when you leave | Indefinite retention |
| Confidentiality | Your inputs treated as confidential | No confidentiality commitment |
| Changes to terms | Advance notice | Changes at any time without notice |
| Liability | Reasonable limits for data breaches | Liability capped at a month of fees |
Free versions often have different terms than business versions, so read the terms for the plan you actually use.
What Should Happen When an AI Vendor Changes How Its System Works?
Treat significant updates like a new tool: check whether the change affects data, decisions, or risk level, re-test it on a few real tasks, and update your inventory. For example, if an applicant tracking system update adds automatic candidate ranking, an Ontario employer with 25 or more employees may now need to add AI disclosure to its job postings.
Canadian Considerations for AI Governance
What Canadian Considerations Should SMBs Include in Their AI Governance Framework?
Canada has no comprehensive AI law for private businesses. The national AI strategy released in June 2026 relies on privacy reform and targeted rules instead. Beyond the Ontario rules covered earlier, keep these in mind:
- Quebec’s Law 25: If you make a decision about someone based only on automated processing of their personal information, you must tell them and give them a way to have it reviewed by a person.
- Other provinces: British Columbia and Alberta have their own private-sector privacy laws that cover employee information, and employment rules vary by province.
- Human rights law everywhere: Every province and territory prohibits discrimination in employment, whether a decision came from a manager or an AI tool.
- Sector rules: Health information custodians, federally regulated financial institutions, and regulated professions may have extra requirements.
Creating an AI Governance Policy
What Should an AI Governance Policy Include?
- Roles and ownership
- Approved tools and the approval process
- Data rules (green, yellow, red)
- Human review requirements
- Rules for HR and people decisions
- Vendor requirements
- Training expectations
- Incident reporting and response
- A review schedule
How Can SMBs Create an AI Governance Policy?
- Take inventory of the tools and uses already in place.
- Agree on risk appetite with leadership. Where is AI encouraged, and where is it off limits?
- Draft the policy with a short round of input from managers.
- Test it. Give three employees a few realistic scenarios and see whether the policy tells them what to do.
- Train and launch, then book the first review.
Most businesses with 25 to 200 employees can get through these steps in about 90 days.
What Happens If an AI System Violates Company Policy or Produces Harmful Results?
- Contain it. Stop the use and pull back the output if you can.
- Assess the impact. What data was involved, and who was affected?
- Fix what you can. Correct the output, contact the client, or reconsider the decision.
- Check privacy obligations. Under PIPEDA, breaches that create a real risk of significant harm must be reported to the Privacy Commissioner and to the people affected.
- Document it and update the policy. This prevents similar incidents from happening again.
Separate honest mistakes from deliberate breaches. Someone who reports their own error quickly should be treated very differently from someone who ignored the rules and hid it.
Ready to Put AI Governance Into Practice?
If you’d rather not build this alone, H2R works alongside your team to assess current AI use, write governance that fits how you actually operate, and train people on the tools they already use. We work with you, not for you.
Frequently Asked Questions
What is AI governance?
AI governance is the set of decisions a company makes about how AI gets used at work, and who is responsible for those decisions. It covers which tools are allowed, what information can go into them, who checks the output, and when the rules get updated.
Who is responsible for AI governance in a company?
Leadership is accountable, but day-to-day ownership works best with one named person, often an operations manager or HR lead. IT handles security reviews, HR covers people-related uses, and managers apply the rules in their teams.
What data should employees never enter into AI tools?
Employee personal information, health information, client confidential data, financial account details, passwords, and anything covered by an NDA should stay out of AI tools unless a specific tool has been approved for that type of data.
What AI decisions require human review?
Any decision about a person’s job should have a human decision-maker, including hiring, promotion, pay, performance ratings, discipline, and termination. Client-facing work should also be checked by a person before it goes out.
What Canadian considerations should SMBs include in their AI governance framework?
Canada has no comprehensive AI law for private businesses, so the main considerations come from privacy law, employment standards, and human rights law. In Ontario, employers with 25 or more employees must disclose AI use in publicly advertised job postings, and Quebec’s Law 25 adds rules for decisions based only on automated processing.
How often should an AI governance framework be reviewed?
Review the approved tool list every quarter and the full framework at least once a year. Add a review whenever you adopt a tool that handles employee or client information, a vendor changes how its system works, or something goes wrong.
What should an AI governance policy include?
Roles and ownership, approved tools and an approval process, data rules, human review requirements, rules for HR and people decisions, vendor requirements, training, an incident reporting process, and a review schedule.
Enjoyed this article? Share this post!
Follow H2R on Social