Why start with governance
Technical controls are useless if nobody knows which AI tools are in use, with what data and under whose responsibility. Governance answers those questions: who decides, which uses are allowed, how risks are assessed and how you respond when something goes wrong.
In most organizations the first finding is the same: employees already use public AI tools, often with internal documents, because no approved tool was offered to them. Banning without offering an alternative just moves the problem to personal phones.
The NIST AI Risk Management Framework
Published in January 2023 by the US NIST, the AI RMF is voluntary, free and internationally recognized. It is organized into four functions:
- Govern: policies, roles, responsibilities and risk culture.
- Map: understand the context, uses and possible impacts of each system.
- Measure: assess and track risks, including through testing.
- Manage: treat the priority risks and respond to incidents.
The NIST AI 600-1 profile, published in July 2024, adapts the framework to risks specific to generative AI.
The ISO/IEC 42001 standard
Published in December 2023, ISO/IEC 42001 defines an artificial intelligence management system, on the same model as ISO/IEC 27001 for information security. It is certifiable: a useful argument when customers or partners ask you to show that your use of AI is under control. An organization already certified to ISO 27001 can build on many of its existing processes.
In Québec: Law 25 already applies
As soon as an AI system processes personal information, Law 25 governs how it is used. Three obligations come up often:
- Privacy impact assessment (PIA): mandatory for any project to acquire, develop or overhaul an information system involving personal information. An AI project usually qualifies.
- Communication outside Québec: when the information is processed by a provider hosted elsewhere, which is common with cloud AI services, a PIA must show that it will receive adequate protection.
- Fully automated decisions: a business that makes a decision based exclusively on automated processing of personal information must inform the person. On request, it must explain the information used, the reasons and the main factors behind the decision, and let the person submit observations to someone who can review the decision.
In Canada and elsewhere
- Federal: the Artificial Intelligence and Data Act (AIDA), part of Bill C-27, died on the order paper in January 2025. Bill C-36, tabled in June 2026, proposes a private-sector privacy reform that would regulate automated decision systems. It has not been passed yet.
- Voluntary code of conduct: since 2023, the federal government has offered a code of conduct for the responsible development and management of advanced generative AI systems.
- European Union: if you offer products or services in the EU, the AI Act may apply. Regulation (EU) 2026/1744, the “digital omnibus”, pushed the obligations for Annex III high-risk systems back to December 2, 2027.
Where to start
- Appoint an AI owner, working with the person in charge of protecting personal information.
- Take inventory of the AI tools in use, official or not.
- Adopt an acceptable use policy approved by management: allowed tools, prohibited data, human review of generated content.
- Offer an approved tool, configured so your data is not reused for training.
- Train employees on good habits and on AI-specific risks.
- Assess and test the most exposed systems first, starting with those that touch personal information or can take action.