AI Station

Approving your first AI tool: a governance checklist for Canadian leaders

Before approving an AI tool, leaders should know what data it uses, who approves its actions and what happens when it is wrong. A practical checklist for Canadian businesses, including Quebec's rules on automated decisions.

Leadership and governancePublished 3 minute read

Key points

  • Start with the decision the tool supports, then ask what data it uses, where that data is processed and which AI providers are involved.
  • Keep a named person accountable for every action the tool can take. Begin with suggestions rather than automatic changes.
  • Quebec's private-sector privacy law requires an organization to tell a person when a decision about them is made only by automated processing, and to let them have it reviewed by a person.

Start with the decision, not the tool

Most AI approvals go wrong at the start. The conversation is about which product is best, rather than which decision the business wants to improve and what the tool is allowed to do about it. Write the decision down in one sentence: "The dispatcher chooses which technician goes to which job." Everything else follows from that sentence.

A governance checklist

Data

  • What data goes into the tool, and does it include personal information about customers, employees or suppliers?
  • Where is that data stored and processed? Which AI providers are involved, and do they use your data to train their models?
  • Can you delete the data on request, and how long does the vendor keep logs?

Decisions and approvals

  • Which actions can the tool take on its own, and which need a person to approve them?
  • Who is accountable for each type of action, and how quickly must they respond?
  • What is recorded when someone accepts, changes or rejects a suggestion?

Vendors and providers

  • Does the contract say what happens to your data at the end of the engagement?
  • Does the vendor tell you when it changes the AI model or provider it relies on?
  • What support do you get when the tool produces a wrong result?

Measurement

  • What number will show whether the tool is working, and what is its baseline?
  • What result means go, and what result means stop?

Records and complaints

  • How can a customer, employee or supplier ask about a decision the tool influenced?
  • Who handles those requests, and in what timeframe?

Quebec's rule on automated decisions

If your business operates in Quebec, or serves Quebec residents, the private-sector privacy law (commonly called Law 25) includes a specific rule for decisions made with personal information. Under section 12.1 of the Act respecting the protection of personal information in the private sector, an enterprise that makes a decision about a person based exclusively on automated processing must inform that person no later than when it tells them the decision. On request, the person can ask what personal information was used, the main factors and parameters behind the decision, and can submit observations to a staff member who can review it.

Read the full text of the Act and check with your legal adviser about how it applies to your business. This article is a summary, not legal advice.

Write it down before the pilot

Before any AI tool is switched on, put four things in writing: the decision it supports, the number that will be measured and its baseline, the approval rules, and the conditions under which the pilot stops. A one-page document that all of these are signed off on is worth more than a long proposal that nobody re-reads.

This is the approach we use when we run pilots. Our pilot process sets out what we agree in writing before any work begins.