Your Team Is Already Using AI. Write the One-Page Rule Now.

Article

Ask most owners whether their business uses AI and you'll hear a quick no. Ask their staff and you may hear something different.

The numbers point at that gap. In Statistics Canada's latest business conditions survey, only 25.2% of businesses said they plan to use AI in the next 12 months , and more than half (52.7%) said they had no plans at all. Of those without plans, 79.1% said AI isn't relevant to what they sell. Meanwhile, KPMG's 2025 survey of Canadian employees found 51% use generative AI tools at work , and 73% of those users open them daily or a few times a week.

These are different surveys of different groups, so don't subtract one from the other. Read together, though, they suggest something worth taking seriously. "We don't use AI" often describes the owner's plans. It doesn't always describe what's happening at the dispatch desk, the front counter or the back office.

The free chatbot is the new USB stick

Plenty of small businesses run lean. The person writing the customer email is often also doing the invoices and answering the phone. A free AI tool that turns a messy note into a clean reply in ten seconds is very tempting. Nobody's being reckless. They're being efficient with whatever is in front of them, and that can include a customer's name, address, order history or a payment dispute.

Canada's privacy regulators have already spoken to this. Their joint principles for generative AI , issued by federal, provincial and territorial commissioners in December 2023, make the point that these tools sit inside existing privacy law, not outside it. For businesses using them, the guidance is practical. Use anonymized or de-identified information in prompts where you can. Enter sensitive or confidential personal information only where it's authorised. And remember that accountability for a decision rests with the organization, not with the software that helped make it.

You own what your chatbot says

The second risk runs the other way: AI talking to your customers. In 2024, B.C.'s Civil Resolution Tribunal ordered Air Canada to pay a customer $812 after its website chatbot gave wrong information about bereavement fares. The tribunal found the airline hadn't taken reasonable care to make sure the chatbot was accurate. It made no difference, the decision said, "whether the information comes from a static page or a chatbot."

$812 is small money for an airline. The principle isn't small for anyone. If you put an AI assistant on your website, your WhatsApp Business line or your booking page, and it quotes a delivery date, a warranty term or a price, a customer can reasonably treat that as your word. Even the people using these tools are wary of them: KPMG found 58% of Canadian employees are extremely or very concerned about inaccurate AI answers . Your customers won't be grading on a curve.

The rules are about to get heavier

On June 15, 2026, Ottawa tabled Bill C-36 , the Protecting Privacy and Consumer Data Act. It would replace Part 1 of PIPEDA, Canada's federal private-sector privacy law. As of early October, Parliament's LEGISinfo page shows it at second reading with no activity yet. Nothing has changed today, and the text could still be amended.

The direction is clear all the same. According to Torys LLP's summary , the bill as tabled would:

allow administrative penalties of up to the greater of $10 million or 3% of gross global revenue;

require organizations to keep a privacy management program scaled to the volume and sensitivity of the personal information they hold;

require notice when an automated system is used to make a prediction, recommendation or decision with a legal or similarly significant effect on someone, along with a right to ask for review by a person;

give individuals a private right of action once a contravention has been found.

The usual advice is to wait until a bill becomes law. That's backwards here. The cheapest compliance work is the habit you build while the stakes are still low.

The one-page rule

You don't need a consultant or a 40-page policy. You need one page your team will actually remember. Five lines cover most small businesses:

Name the approved tools. Pick one or two, ideally on a business account where you control the settings. Everything else stays off limits for work data.

List what never goes into a prompt. SINs, health details, banking or card numbers, driver's licence numbers. For customer emails, use first names or initials, not full names with addresses.

A person reads it before a customer does. Any AI draft that goes out under your name gets checked by a human first.

Someone owns the bot. If you run a customer-facing chatbot, one named person reviews what it says about prices, policies and timelines, on a set schedule.

Flag decisions about people. If AI helps screen job applicants or set credit terms, write that down and make sure a person makes the final call.

Key takeaways

Your staff may well be ahead of your policy. That isn't a discipline problem; it's a gap you can close in an afternoon. Today's privacy law already applies to how your team uses AI. A Canadian tribunal has already held a business to its chatbot's words. And Ottawa has a bill on the table that would raise the penalties sharply. A one-page rule written this month costs almost nothing. Writing one after a customer complaint costs a lot more.

If you'd rather compare notes than start from a blank page, that's the kind of conversation our Chamber exists for: Punjabi-Canadian business owners talking about what's actually working, without a vendor in the room. Explore membership and bring your one-page rule to the table.

This is general information, not legal advice. Talk to a qualified privacy or legal professional before you adopt or change policies on customer data.

Sources

Statistics Canada, The Daily: Canadian Survey on Business Conditions, third quarter 2026 (August 31, 2026)

KPMG in Canada: Canadian employees call for clear and transparent AI policies as adoption grows (November 27, 2025)

Office of the Privacy Commissioner of Canada: Principles for responsible, trustworthy and privacy-protective generative AI technologies (December 7, 2023)

Radio-Canada / CBC News: Air Canada found liable for chatbot's bad advice on plane tickets (February 2024)

Parliament of Canada, LEGISinfo: Bill C-36 (45th Parliament, 1st session)

Torys LLP: Bill C-36: Federal government revives privacy legislation (June 18, 2026)