AI Policy and Staff Training

This is the cheapest engagement on the site and the one most businesses need first. Your staff are already using AI. Statistics Canada found 44.4% of AI-using businesses had changed training or staffing because of it, and 32.0% had trained existing employees. The other two thirds have people improvising with client data and no written rule.

The Ontario rule that already applies to you

Since January 1, 2026, an Ontario employer with 25 or more employees must state in every publicly advertised job posting whether artificial intelligence is used to screen, assess or select applicants. It comes from amendments to the Employment Standards Act, 2000 and Ontario Regulation 476/24.

The disclosure itself is short. You do not have to explain how the tool works. What catches employers is scope: an applicant tracking system that ranks or filters candidates is very likely captured, and plenty of employers do not know theirs does that. The threshold counts employees on the day the posting goes up. The full detail is in the note on Ontario's AI job posting disclosure rule.

What the policy covers

• Which tools are approved, and which are specifically not, named rather than described in categories.
• What may never be pasted into a general chatbot: client personal information, anything under a confidentiality agreement, credentials, and unreleased commercial terms.
• Which outputs need a human check before they leave the building, and who that human is.
• Disclosure: when a customer, a candidate or a regulator has to be told, including the job posting duty.
• What happens when somebody breaks the rule, written so it is a process rather than a firing.
• A record of the decision, dated, because "we had no idea" stops being available once you have.

The training half day

Two to three hours, on site or remote, for the people who actually touch the work. Not an awareness session. Staff bring a real task from their own week and we do it, with the policy open, so the rule is learned against the job rather than against a slide.

The most common outcome is not enthusiasm. It is somebody discovering that the task they were about to automate should not be automated, and somebody else discovering that a task nobody thought about takes four hours a week and could take ten minutes. That second person is usually why the workflow automation conversation starts.

Why this is not optional any more

PIPEDA complaints to the federal Privacy Commissioner rose 109% year over year to 3,044. The Commissioner's May 2026 finding against OpenAI established that Canadian privacy law reaches AI training data, prompts and outputs. An employee pasting a client list into a free chatbot is a disclosure of personal information by your organisation, and the fact that nobody told them not to is your problem rather than theirs.

A written policy does not make that impossible. It makes it a breach of a known rule instead of a normal Tuesday, which is the difference between an incident you can respond to and one you cannot explain.