The situation in the room
A Canadian procurement team asks an AI vendor where data is processed, whether personal information trains models, and how the service meets Canadian privacy obligations. The answers point to another jurisdiction's materials.
The tool may be global. The buyer's accountability to people in Canada is not outsourced with the processing. The work looked active from the outside. Inside the organization, the unanswered decision was still controlling what happened next.
What the situation is telling you
PIPEDA continues to govern personal information in much of Canada's private sector. Quebec's Law 25 adds specific obligations, including around privacy impact assessment and automated decisions. AIDA died on the order paper and is not law.
That distinction matters because organizations often respond to the visible symptom. They buy another capability, add another review, or ask employees to try harder. The underlying distribution of authority, knowledge, and responsibility stays unchanged.
The sharp version is this: activity is not alignment. A credible programme connects the business outcome, the rules, and the people expected to carry the change.
Why the usual response fails
No federal AI-specific law does not mean no Canadian rules.
When leadership leaves that decision implicit, each function fills the gap with its own incentives. Technology sees deployment, finance sees cost, legal sees exposure, communications sees a message, and frontline teams see new accountability without new authority.
No federal AI-specific law does not mean no Canadian rules.
The decision behind the work
Apply the rules in force to the actual data flow. Ask where data goes, who can access it, what purpose applies, what the vendor retains, and how a person can understand or challenge an automated decision where required.
Write the answer so that a person outside the project can use it. Name the owner, the boundary, the evidence, and the moment the decision gets reviewed again. If the answer depends on knowing who was in a particular meeting, it is not yet an operating decision.
This is where strategy earns its name. It reduces the number of choices people have to remake in private and gives the organization a stable reference point when the next tool, vendor, or urgent request arrives.
What good practice looks like
Treat data sovereignty as a distinct governance question. Location, legal jurisdiction, foreign access, contractual control, and model improvement terms all matter to the answer.
Good practice is visible in ordinary work. People know what they may do, what they must check, who can decide, and where an exception goes. Leaders hear the same account from different teams because the framework is shared rather than remembered differently.
The aim is not perfect control. The aim is a system that notices when reality changes and knows who has to respond. That creates movement without pretending uncertainty has disappeared.
Make the answer operational
Start with the smallest version of the decision that still changes behaviour. Put it in plain language and test it with the people who will use it under pressure. Ask them what they would do, what they would record, and who they would call when the ordinary case stops being ordinary. Their hesitation will show where the instruction is still abstract.
Then connect the decision to the systems around it. A rule without training becomes a document people forget. Training without authority becomes advice people cannot follow. Authority without review becomes a permanent answer to a changing question. The three have to move together, with one person accountable for keeping them connected.
Review the result through actual work rather than confidence surveys alone. Look at a sample of decisions, outputs, exceptions, and escalations. Ask whether the intended boundary held and whether people found a hidden route around it. When the evidence changes, revise the operating choice openly and record why. That is not inconsistency. It is governance doing its job.
What to do on Monday
1. Get vendor answers on processing and storage in writing. Keep the action small enough to complete, specific enough to observe, and connected to a named decision rather than a general ambition.
2. Confirm whether a privacy impact assessment is required. Keep the action small enough to complete, specific enough to observe, and connected to a named decision rather than a general ambition.
3. Name the person accountable for explaining the data flow. Keep the action small enough to complete, specific enough to observe, and connected to a named decision rather than a general ambition.