Home › AI Consulting › Municipal Track
AI Consulting — Municipal Track

Your staff are using AI.
Your policy isn’t ready.

Half your team may already be using public AI tools with ratepayer data. Provincial legislation requires a formal response — and the deadline is real. Spencer Morley Consulting’s framework closes the compliance gap and builds a genuine AI capability at the same time.

Check Your Compliance Position
Municipal Track
Municipalities across Canada
Shadow AI The compliance gap hiding in plain sight
48%
of public servants are already using AI tools on the job
22%
of organizations have a formal AI adoption policy in place
50%
of those AI users rely on publicly available tools — ChatGPT, Gemini, Copilot
85%
of Canadians lack confidence in how the public service will develop and use AI
2025 KPMG Canada survey of 349 public servants, "Half of public servants turn to AI, raising risks" — co-published with Microsoft
Alberta municipalities: June 11, 2026 ATIA & POPA deadline · Every Canadian province has equivalent privacy obligations for municipalities

Nearly half of your staff are probably already using AI — right now, today, without a policy, without training, and without knowing what happens to the data they enter.

Half of them are using publicly available tools. ChatGPT. Gemini. Copilot. Tools that were not built for municipal government and offer no guarantees about where your data goes.

This is Shadow AI. It is not a future risk. It is a present one — and provincial privacy legislation has a deadline attached.

An existing IT acceptable use policy does not satisfy the Privacy Management Program requirements under your province’s legislation — in Alberta, that’s ATIA and POPA; in BC, FIPPA; in Ontario, MFIPPA. These are distinct obligations in every province. Spencer Morley Consulting’s Municipal Framework addresses all of them.

01
AI Readiness Assessment
Know exactly where your compliance risk is — before your auditor does.
Before spending a dollar on AI, and before your next privacy review, you need to know where you actually stand. Spencer Morley Consulting conducts a structured diagnostic of your municipality’s current workflows, data practices, and staff AI usage. We surface your Shadow AI exposure: which tools your staff are already using, what information may be at risk, and where your policy gaps are.
Then we identify where AI can save your team the most time, and deliver a plain-language roadmap your council can understand and approve. Delivered remotely, with minimal demands on your team’s time.
Our assessment adapts to your province — the questions, compliance benchmarks, and roadmap reflect your specific provincial legislation, not a generic Alberta template.
Start Here Province-Adaptive
02
Staff AI Training & Prompt Engineering
Turn your team from a compliance liability into your municipality’s most effective AI users.
83% of Canadian employees want to use AI better. Only 48% say their employer gave them what they needed to get there.
In a municipality, that gap is more than a productivity issue. A staff member who enters ratepayer personal information into a public AI tool isn’t just making a mistake — they may be triggering a reportable privacy breach under your province’s legislation. And with 85% of Canadians already lacking confidence in how the public service uses AI, one incident can become a council issue fast.
Spencer Morley Consulting’s training covers both sides of the problem: what your staff are and are not allowed to use AI for, how to handle personal information safely — and how to get genuinely useful output so staff actually use the sanctioned tools well.
Available remotely or on-site. No jargon. Skills your team uses the next day.
Foundation
03
AI Policy Development
A formal AI policy your council can adopt, your staff can follow.
Having staff trained on responsible AI use is necessary. Having a written policy they can refer to — and that your municipality can demonstrate to provincial oversight bodies — is what closes the compliance gap entirely.
Spencer Morley Consulting drafts your AI Acceptable Use Policy from the ground up: plain language, grounded in your province’s privacy legislation — whether that’s ATIA/POPA in Alberta, FIPPA in BC, MFIPPA in Ontario, or your provincial equivalent — and written so that a CAO with five other files can actually implement it. The policy covers sanctioned tools, prohibited uses, data handling requirements, breach reporting obligations, and staff expectations. Pricing on request.
Compliance
04
Private Large Language Model Deployment
A powerful AI tool your staff can actually use — without touching a public platform.
Your staff need an alternative. Without one, telling them to stop using ChatGPT just means they use it more carefully — which isn’t the same as not using it.
Spencer Morley Consulting deploys a private AI instance scoped entirely to your municipality. Your data stays within your systems, under your control, subject to your provincial privacy obligations. Your staff get a sanctioned, capable AI tool to use instead of the public ones — one that your municipality controls completely. No public cloud exposure. No IT department required to maintain it.
Data sovereignty Province-compliant architecture Infrastructure
Agentic AI What Canadian organizations are saying
88%
say Agentic AI is critical for keeping their competitive edge and driving productivity
92%
believe Agentic AI will help achieve cost savings and increase efficiency
89%
say Agentic AI will help address labour gaps in their organization
69%
are concerned about Agentic AI cutting the human out of the loop — Spencer Morley Consulting designs human oversight in from the start
KPMG in Canada, “Canadian organizations turning to AI agents: KPMG poll,” April 2025
05
Agentic Workflows
Stop spending staff hours on tasks AI can complete in seconds.
Spencer Morley Consulting builds municipal agentic workflows with human oversight designed in from the start — not added as an afterthought. Your staff don’t get replaced. They get relieved of the administrative burden that prevents them from doing the work that actually requires a human.
Workflows we automate for municipalities: meeting minutes and council agendas, bylaw drafting, permit correspondence, report generation, ratepayer communications, onboarding documentation, and more. Every workflow is privacy-by-design.
Privacy-by-design Transformation
Common Questions

What municipalities ask us

Does an IT acceptable use policy satisfy ATIA and POPA obligations for Alberta municipalities?
No. An IT acceptable use policy is not a Privacy Management Program. Alberta’s Access to Information and Protection of Privacy Act (ATIA) and the Protection of Personal Information Act (POPA) require a documented program that specifically addresses how your municipality collects, uses, and protects personal information — including information processed by AI tools. An IT policy alone does not meet that standard.
What is a Privacy Management Program and why does Alberta require one?
A Privacy Management Program is a documented framework that shows how your municipality manages personal information under ATIA and POPA. Alberta requires one because public bodies are legally accountable for how they handle ratepayer data. The program must cover data collection practices, staff responsibilities, breach response procedures, and — increasingly — how AI tools are used in day-to-day operations.
What is the June 11, 2026 Privacy Management Program deadline for Alberta municipalities?
June 11, 2026 is the date by which Alberta municipalities must have a documented Privacy Management Program in place under ATIA and POPA. Municipalities that have not met this requirement face compliance exposure. An existing IT acceptable use policy does not satisfy the obligation. The program must address AI tool use, data handling, staff accountability, and privacy risk management specific to your municipality.
What does the Spencer Morley Consulting AI Readiness Assessment cover for municipalities?
The AI Readiness Assessment identifies where your municipality currently stands on AI adoption, what shadow AI risk exists among staff, and what compliance gaps need to close under ATIA and POPA. It examines current tool use, staff capacity, data handling practices, and existing policies. The output is a written brief suitable for internal decision-making or council presentation.
How long does the AI Readiness Assessment take for a small municipality?
The Municipal AI Readiness Assessment is a two-session engagement, typically completed within two to three weeks of booking. Sessions are conducted remotely, designed to fit around the schedules of lean administrative teams. The written brief is delivered within one week of the final session.
Get in Touch

Ready to close your compliance gap?

The June 11, 2026 deadline for Alberta municipalities is approaching. Other provinces are moving in the same direction. Let’s talk about where your municipality stands.

Fill out the form and we’ll be in touch within one business day.

We respect your privacy. Your information will never be shared.

Message received.
Thank you for reaching out. We’ll be in touch within one business day.