AI in business.
People in charge.

Start with a useful job,
not an AI shopping list.

A tool drafts, summarises or suggests something for a person to review. An agent takes actions through connected systems, within the permissions it has been given. A draft reply is not the same as permission to send it. That difference changes the risk and the safeguards you need.

These are illustrative opportunities, not accounts of delivered projects. Suitability depends on your systems, information and people.

A trades or service business

Turn approved job notes into a draft follow-up or checklist. A person checks site details, pricing and commitments before anything goes to a customer.

A shop or hospitality business

Draft answers from current opening hours, product details or policies. Keep stock, refunds and exceptions tied to checked records and a human decision.

An office or community organisation

Find material in an approved document collection or turn consented meeting notes into draft tasks. Check the source and the people assigned before sharing.

A repetitive internal process

A limited agent might sort incoming requests or prepare an update for approval. Begin with read-only access, a narrow task and an agreed route for anything uncertain.

Sometimes a better template, a search filter or ordinary automation is the simpler answer. Use AI only if it improves the whole job, including checking and upkeep.

Keep the work
that makes it yours.

Before asking what can be automated, ask your people what they enjoy. A customer conversation, writing a thoughtful note, solving a tricky problem or practising a craft can be meaningful work, not wasted time.

Look for the tedious steps around that work first. Preparing background notes may help someone have a better conversation. Replacing the conversation may remove the very thing the customer values. Let the person doing the work help set that boundary.

Keep room for learning, too. If AI always does the first attempt, a newer colleague may lose the chance to build judgement. Agree when to work without it, who checks the result and how skills will be maintained.

Useful is not the same
as right.

Ask whether a use is fair, honest and morally defensible, not just whether it saves time or is allowed. Who benefits? Who carries the risk? Could you explain the choice plainly to the person affected?

Own the result. Verify the evidence.

Your business remains accountable for what it publishes, sends or decides. Name a person who can review the work, correct mistakes and handle concerns. A confident answer is not evidence: check claims, quotations, calculations and references against reliable original sources. If you cannot verify it, do not present it as fact.

Do not use AI to invent fake reviews, testimonials, credentials or experience. Do not present generated work as proof of expertise you do not have, or use a synthetic person or voice to imply a real endorsement. Credibility is worth more than a convincing shortcut.

Consider the person with the least power.

Test for unfair treatment and discrimination, including differences in language, disability or background. Take extra care with children, vulnerable people and anyone who may struggle to challenge a decision. Do not let an AI score quietly become the final word on hiring, access to a service or another consequential decision. Keep qualified human review and an accessible way to question or correct the outcome.

Make disclosure useful, not decorative.

Tell people when AI involvement could affect their choices, trust or understanding. If they are speaking with an AI assistant, say so and offer a human route. If synthetic media could be mistaken for real evidence, make its nature clear. Explain important limitations and who is accountable.

That is different from adding an indiscriminate AI label to every spellcheck or internal draft. Choose disclosure that is meaningful in context, respect applicable rules and agreements, and never conceal AI use to mislead someone about authorship, expertise or a human relationship.

Privacy starts before
the first prompt.

Map what information would leave your systems, where it would go and who could see it. Publicly available personal information is not automatically free to reuse. Confirm the appropriate authority for the proposed use and obtain meaningful consent where required. A staff member having access to a record does not automatically authorise uploading it elsewhere.

• Use data minimization. Start with invented or properly de-identified examples. Remove unnecessary names and details. De-identification needs checking: a combination of details can still identify someone.
• Review the vendor terms and settings. Check retention and deletion, whether inputs or outputs are used for model training, storage locations, subprocessors and who can access the data. Do not assume a paid plan or a Canadian address settles these questions.
• Set access controls. Use separate, limited permissions for the task. Keep passwords, recovery codes and sensitive client or employee records out of unapproved tools. Limit and protect logs as well as prompts.
• Plan for change and mistakes. Decide how to remove access, report an exposure and review new vendor terms or features. If the data use cannot be explained or controlled, stop before connecting it.

For further reading, see the Canadian privacy regulators’ Principles for responsible, trustworthy and privacy-protective generative AI technologies, published by the Office of the Privacy Commissioner of Canada. Their principles cover matters including consent, appropriate purposes, accountability, openness and safeguards.

This guide is not legal advice, a compliance assessment or a certification. Applicable obligations depend on your organisation, activity and jurisdiction. Get qualified privacy or legal advice where needed.

Give it a small job.
Keep a firm hand on the controls.

1. Define one task and one owner.

   Write down the intended benefit, what the system must never do and who is accountable. Agree what a useful result looks like and what would make you stop. Include the people doing and affected by the work.

2. Start read-only, before writes.

   Test with a small approved sample and no authority to change records. Compare outputs with the current process. Try missing information, misleading instructions and unusual cases, not just easy examples. Treat instructions inside emails and documents as untrusted content, not permission for an agent to act.

3. Grant limited authority, not general access.

   If actions are justified, allow only named systems and operations. Require explicit human approvals for moving money, sending messages, deletes and changes to access permissions. The reviewer needs to see the proposed action, destination and supporting evidence before approving, not just a vague “continue” button.

4. Make stopping and recovery real.

   Keep an appropriate activity record, a way to stop the agent and revoke its access, and a tested rollback or recovery plan. Some actions, such as a sent message, cannot simply be undone. Keep those behind approval and know how to handle a mistake.

5. Count the whole cost. Review the fit.

   Include subscriptions, usage charges, checking time, operating cost and maintenance. Set usage limits and a review date. Assign responsibility for permissions, tool changes and retesting. Continue only if the benefit survives those costs and the agreed safeguards work. Otherwise, adjust or retire it.

Supervision is part of the design, not a temporary obstacle on the way to universal automation. No tool removes your responsibility to understand the work.