AI compliance for Manitoba municipalities. What FIPPA actually requires.

The legislation

What FIPPA Part 3 requires of municipalities

Manitoba's Freedom of Information and Protection of Privacy Act (FIPPA) governs how local public bodies (including municipalities, school divisions, and other local government bodies) collect, use, disclose, retain, and dispose of personal information.

Part 3 of FIPPA (Protection of Privacy) applies to all public bodies, including municipalities. It requires reasonable security arrangements to protect personal information (s. 41) and a written policy on retaining personal information (s. 40(1)). Those obligations do not disappear when the information passes through an AI system. If staff are using ChatGPT, Microsoft Copilot, or any other AI platform in the course of their work, even informally, FIPPA applies.

Manitoba's privacy framework does not include a dedicated Information and Privacy Commissioner. The Manitoba Ombudsman handles privacy complaints under FIPPA for local public bodies. This is distinct from the other provinces covered here, and it shapes how compliance enforcement works in Manitoba.

The compliance gap

Shadow AI is already in your municipality.

KPMG Canada's 2025 survey of 349 respondents across federal, provincial and municipal government found that 48% use AI tools for work, and 39% do not have, or are not aware of, a clearly communicated data policy. In Manitoba municipalities, the gap between what staff are doing and the governance in place may be significant.

In our view, shadow AI (staff using ChatGPT, Gemini, or Microsoft Copilot without formal authorization or governance) is one of the main FIPPA exposure points for Manitoba local governments. It is a current risk, not a future one.

Under FIPPA, entering ratepayer data, bylaw records, or staff information into a public AI platform without authorization may amount to an unauthorized use or disclosure of personal information. It does not require a data breach in the traditional sense: the act of entering personal information into a third-party AI system may itself be the problem.

The oversight context

The Manitoba Ombudsman, not an IPC

Every other province covered by Spencer Morley Consulting's municipal practice has a dedicated Information and Privacy Commissioner: the OIPC in Alberta, BC and Saskatchewan, and the IPC in Ontario. Manitoba does not.

The Manitoba Ombudsman investigates privacy complaints under FIPPA. Its investigations are conducted in private (s. 52), and its recommendations are made public (s. 66(7)). Matters that are not resolved can go to the Information and Privacy Adjudicator, who can make binding orders (ss. 66.1, 66.8). A public report finding that a municipality did not comply with FIPPA can carry reputational and political consequences.

Practically, this means the complaint pathway in Manitoba runs through a general-purpose oversight body rather than a privacy specialist. The Ombudsman's staff investigate across a wide range of public sector issues, but the jurisdiction is clear, and the pathway for a citizen complaint is straightforward.

What you need to build

The core compliance components for Manitoba municipalities

The following checklist represents the foundational governance that a Manitoba local public body needs to address AI-related FIPPA exposure. This is not an exhaustive privacy framework. It is a practical baseline for governing AI use responsibly under the Act.

• Appoint an access and privacy coordinator

  Appoint a staff member in writing as the municipality's access and privacy coordinator, as the Access and Privacy Regulation requires (Man. Reg. 64/98, s. 2(1)). This person receives access requests, manages potential breaches, and maintains your privacy governance program. Document the appointment in a council or administrative resolution.

• Conduct a personal information inventory

  Map every location where your municipality collects, uses, or discloses personal information, including AI tools staff are already using. Shadow AI tools belong in this inventory, even if they are not officially sanctioned.

• Draft an AI acceptable use policy

  Create a formal policy governing staff use of AI tools. Specify which tools are sanctioned, which are prohibited, what data staff may and may not enter, and the consequences of unauthorized use. This is the control that addresses shadow AI directly.

• Establish breach response procedures

  Document the steps your municipality will follow if a privacy breach occurs: who is notified, in what timeframe, and what records are kept. Since January 1, 2022, FIPPA has required public bodies to notify the affected individual and the Ombudsman when a privacy breach creates a real risk of significant harm (s. 41.1).

• Deliver and document staff training

  Provide privacy and AI use training to all staff who handle personal information. Keep records of who was trained, when, and on what content. Training is a recognized safeguard that helps show compliance with s. 41.

• Review vendor and cloud agreements

  Review every software contract and cloud service agreement involving personal information. Confirm that data processing agreements are in place and that vendors meet FIPPA requirements. Flag any AI vendors processing citizen data without an executed agreement.

• Document and maintain the program

  Compile all of the above into a single governance document. Date it, sign it, and bring it to council. Establish a review cycle of at least once a year. Update it as your technology stack and AI use evolve.

For small municipalities

One CAO. The same legal obligation.

Larger Manitoba municipalities have in-house legal counsel, IT departments, and administrative capacity to address privacy governance internally. Small and rural municipalities (towns, rural municipalities, local government districts) typically don't.

The FIPPA obligation applies regardless of size. A rural municipality with a CAO and four staff has the same legal obligation as Winnipeg, with a fraction of the internal capacity to address it.

Spencer Morley Consulting's Municipal AI Framework is designed for exactly this context: remote delivery, minimal time demands on existing staff, and plain-language outputs that a non-technical CAO can implement and council can adopt. Every engagement begins with a structured AI Readiness Assessment that maps your actual exposure and produces a clear compliance roadmap.

Good AI governance has to reflect your municipality's own systems, staff, and risk profile. That is why our work starts with what your staff actually do.

Frequently asked questions

Manitoba FIPPA and AI: common questions