AI compliance for Saskatchewan municipalities. What LAFOIP requires.

The legislation

LAFOIP: built specifically for local authorities

Saskatchewan, like Ontario, has a separate statute for local authorities. The Local Authority Freedom of Information and Protection of Privacy Act (LAFOIP) governs municipalities, boards of education, the Saskatchewan Health Authority, and other local authorities in Saskatchewan, separately from FOIP, which governs provincial government bodies.

LAFOIP requires Saskatchewan local authorities to establish policies and procedures to maintain administrative, technical and physical safeguards for personal information (s. 23.1). That obligation applies regardless of the technology involved. AI tools do not create an exemption from LAFOIP; they create new ways to fall out of compliance.

The Information and Privacy Commissioner of Saskatchewan (IPC Saskatchewan) oversees LAFOIP compliance for local authorities. It is a dedicated privacy commissioner that investigates complaints, publishes guidance, and issues reports with recommendations.

The compliance gap

Shadow AI is already in your Saskatchewan municipality.

KPMG Canada's 2025 survey of 349 respondents across federal, provincial and municipal government found that 48% use AI tools for work, and 39% do not have, or are not aware of, a clearly communicated data policy. There is little reason to assume Saskatchewan municipalities are different.

In many public bodies, staff use ChatGPT, Google Gemini, and Microsoft Copilot in their daily work: drafting correspondence, summarizing documents, answering questions, and processing information. Where that happens without formal governance, it is shadow AI, and it creates direct LAFOIP exposure.

Under LAFOIP, entering personal information (ratepayer data, complaint records, bylaw enforcement files, staff information) into a public AI platform without authorization and governance may be an unauthorized use or disclosure of personal information. A complaint to the IPC Saskatchewan does not require a data breach in the traditional sense. The act of processing personal information through an ungoverned AI tool may itself be the problem.

SARM and SUMA

Two associations. One compliance obligation.

Saskatchewan's municipal landscape is served by two major associations: the Saskatchewan Association of Rural Municipalities (SARM), which represents rural municipalities, and the Saskatchewan Urban Municipalities Association (SUMA), which represents cities, towns, villages, resort villages and northern municipalities.

Whichever association your municipality belongs to, privacy governance under LAFOIP must reflect your municipality's specific systems, staff, data practices, and AI use patterns. That is why we build each program around how your municipality actually works.

What you need to build

The core compliance components for Saskatchewan local authorities

The following checklist represents the foundational governance that a Saskatchewan local authority needs to address AI-related LAFOIP exposure. Larger municipalities may have additional requirements; this covers a practical baseline for small and rural municipalities.

• Designate a privacy officer

  Formally designate a staff member as Privacy Officer in writing. This person is responsible for access requests, breach management, and maintaining the privacy governance program. Document the designation in a council or administrative resolution.

• Conduct a personal information inventory

  Map every location where your municipality collects, uses, or discloses personal information, including AI tools staff are currently using. Shadow AI tools belong in this inventory regardless of whether they are officially sanctioned.

• Draft an AI acceptable use policy

  Create a formal policy governing staff use of AI tools under LAFOIP. Specify sanctioned tools, prohibited tools, data entry restrictions, and consequences for unauthorized use. This is the document that directly addresses shadow AI.

• Conduct privacy impact assessments for new AI tools

  Before deploying any new AI tool that processes personal information, including Microsoft Copilot in Microsoft 365, conduct and document a Privacy Impact Assessment. LAFOIP does not require one, but it is recommended practice and a clear record that you assessed the risks.

• Establish breach response procedures

  Document the steps your municipality will follow in the event of a privacy breach. Where an unauthorized use or disclosure creates a real risk of significant harm, LAFOIP requires you to notify the affected individual (s. 28.1). Document who is notified, in what timeframe, and what records are kept.

• Deliver and document staff training

  Provide privacy and AI governance training to all staff who handle personal information. Keep records of who was trained, when, and on what. Documented training is a practical administrative safeguard and helps show that your program works.

• Review vendor and cloud agreements

  Review every cloud service and vendor relationship involving personal information. Confirm data processing agreements are in place. AI vendors that process citizen data must have executed agreements that meet LAFOIP requirements.

• Document and maintain the program

  Compile all of the above into a single governance document. Date it, sign it, bring it to council. Establish a review cycle: at minimum annually, or whenever your AI tool stack changes significantly.

For small municipalities

Rural municipality. Same legal obligation.

LAFOIP does not set lighter obligations for small municipalities. A rural municipality with a reeve, an administrator, and limited staff faces the same LAFOIP obligations as Saskatoon, with a fraction of the internal capacity to address them.

Spencer Morley Consulting's Municipal AI Framework is designed for exactly this context: remote delivery, structured around your CAO's existing workload, producing plain-language outputs (an AI Acceptable Use Policy, a Privacy Management Program document, staff training materials) that council can adopt without technical expertise.

The engagement begins with a Municipal AI Readiness Assessment: one or two structured conversations that map your actual AI exposure under LAFOIP and produce a clear compliance roadmap. From there, we move to policy drafting, staff training, and vendor agreement review, all remote and all practical.

Frequently asked questions

Saskatchewan LAFOIP and AI: common questions