Alberta: ATIA & POPA
Your staff are using AI. Your ATIA/POPA policy should already be in place.
The Privacy Management Program requirement in section 25 of Alberta's Protection of Privacy Act took effect on June 11, 2026. Spencer Morley Consulting helps Alberta municipalities close the compliance gap, and build a real AI capability at the same time.
The POPA Privacy Management Program requirement took effect on June 11, 2026. Under POPA s. 25(3), any person may request a copy of your privacy management program, and you must provide it, or directions to it, within 30 business days. A gap is not an internal matter.
The clause many municipalities have missed
Your AI policy isn’t a nice-to-have. It is a prescribed part of a program you already owe.
POPA s. 25 requires the Privacy Management Program. What is far less widely known is that the contents of that program are prescribed by regulation, and the regulation addresses these technologies twice: automated systems in s. 6(1)(b)(iii) and artificial intelligence systems in s. 6(2)(a)(v).
Automated systems: Alta Reg 143/2025, s. 6(1)(b)(iii)
Every public body’s program must include policies and procedures for “how automated systems will use personal information, including any security or technical safeguards that will be implemented to protect personal information”, where the body uses personal information in an automated system to generate content or make decisions, recommendations or predictions. A municipality whose staff are already putting resident information into an AI tool is inside that clause today.
Highly sensitive information: s. 6(2)(a)(v)
A public body holding a high volume of personal information, or highly sensitive personal information, must also have policies on “the use of personal information in artificial intelligence systems” if it is using personal information in those systems. The regulation does not define “highly sensitive” for this purpose, but section 1 defines “high-sensitivity information” (used for privacy impact assessments) to include biometric information, financial information, and information about minors, seniors and vulnerable individuals: categories a municipality handles as a matter of routine.
And any person can demand a copy: POPA s. 25(3)
POPA s. 25(3) gives any person the right to request a copy of a public body’s privacy management program, and obliges the body to provide it (or directions to where it can be accessed) within 30 business days. The regulation adds at s. 6(3) that the program be posted or made available on request; technical and security-related detail can be withheld under s. 6(4), but the existence and shape of the program cannot. Separately, s. 7(5)(e) requires a privacy impact assessment to be submitted to the Commissioner where a project “involves the development or use of innovative technology”, which an AI tool that handles personal information is likely to engage.
Enacted text: Protection of Privacy (Ministerial) Regulation, Alta Reg 143/2025, ss. 1, 6, 7, as published by the Alberta King’s Printer, current to 26 August 2026. No Alberta statute requires a standalone AI policy; the obligation runs through the Privacy Management Program. See what ATIA and POPA now require
Key terms
ATIA
Access to Information Act (Alberta)
Governs public access to records held by Alberta public bodies, including the duty to assist applicants and to respond to access requests within set time limits. Records created with AI tools are records like any other.
POPA
Protection of Privacy Act (Alberta)
Governs how Alberta public bodies collect, use, and disclose personal information. Requires a formal Privacy Management Program: policies, training, breach response protocols, and demonstrated accountability for ratepayer data.
OIPC
Office of the Information and Privacy Commissioner
Alberta's independent oversight body. Reviews complaints, conducts investigations to ensure compliance, and may issue orders under ATIA and POPA. An incident without a program in place is significantly higher risk.
PMP
Privacy Management Program
The specific requirement under POPA s. 25: a documented, implemented set of policies and procedures demonstrating accountability for personal information. Its contents are prescribed by Alta Reg 143/2025, which requires the program to cover how automated systems use personal information. Not a template. Not an IT policy.
The problem
Half your staff are probably already using AI.
They're not waiting for a policy. They're using it today, with ratepayer data, municipal records, and personal information. Here's what the research shows about organizations like yours.
Sources: KPMG Canada, 2025, survey of 349 public servants; MNP 2025 Municipal Report, survey of 282 municipal leaders
What we do for Alberta municipalities
Five services. One framework. Built around ATIA and POPA.
Every service is adapted to Alberta's specific legislative requirements, not a generic template. Delivered remotely, with minimal time demands on your team.
AI readiness assessment
A structured diagnostic of your municipality's current AI exposure, shadow AI risk, and ATIA/POPA compliance gaps. Delivers a plain-language roadmap your council can understand and approve. The recommended starting point before any other service, because without knowing where you are, you can't prioritize what to fix.
Staff AI training & prompt engineering
Practical training on what staff can and cannot use AI for under ATIA and POPA, how to handle personal information safely, and how to get genuinely useful output from sanctioned AI tools. Staff leave with skills they use the next day. Available remotely or on-site.
AI adoption policy & procedures
A formal AI adoption policy drafted from the ground up, grounded in ATIA and POPA, written for council adoption, and plain enough for a CAO with five other files to actually implement. Covers sanctioned tools, prohibited uses, data handling requirements, breach reporting obligations, and staff expectations. This policy addresses the AI elements the regulation prescribes for your Privacy Management Program. Delivered as two documents: the AI Adoption Policy council adopts, and a companion AI Adoption Procedures document setting out how staff request and approve tools, what is logged, and the exact steps when a breach is suspected, so administration can revise procedures as tools change without returning to council each time.
See the AI adoption policy for public bodiesPrivate AI options
Some municipalities want AI that can work with sensitive information without using a public platform. We can explore whether a privately hosted option fits your situation. Any build would be scoped as a custom project, so we make no commitments until we understand what you need.
Agentic workflows
Automation for municipal administrative tasks: meeting minutes, council agendas, bylaw drafting, permit correspondence, report generation, ratepayer communications. Every workflow is privacy-by-design and built with human oversight from the start. Your staff don't get replaced; they get relieved of the work that prevents them from doing what actually requires a human.
Alberta municipality FAQ
Common questions from Alberta CAOs and town administrators
Does Alberta law require our municipality to have an AI policy?
Not as a standalone policy. No Alberta statute requires a municipality to adopt a standalone AI policy, and any vendor who says otherwise should be asked for the section number. What Alberta law requires is a Privacy Management Program (POPA s. 25, due June 11, 2026) and s. 6(1)(b)(iii) of the Protection of Privacy (Ministerial) Regulation, Alta Reg 143/2025, prescribes that the program include policies and procedures for how automated systems will use personal information. If your staff are using AI on personal information, that element is a prescribed part of a program that is already overdue. The distinction matters: it is the framing that survives a question to your solicitor.
The June 11 deadline has passed. Is it too late?
No, but the position has changed. Before June 11, 2026 a municipality without a program was inside the one-year window POPA allowed. After it, the program is simply overdue, and s. 25 is not conditional on size or capacity. The right move is to establish the program quickly, document when and how you closed it, and treat the AI element as part of that program rather than a separate project: Alta Reg 143/2025 s. 6 is where it belongs. A municipality that can show a dated remediation path is in a materially different position from one that cannot.
We're a small rural municipality with a CAO and four staff. Is this realistic for us?
Yes. This context is exactly who Spencer Morley Consulting serves. Large Alberta municipalities have in-house legal counsel and IT departments. Small municipalities do not, and a generic enterprise compliance template won't work for a village of 400. Everything is delivered remotely, designed around minimal staff time, and written so that a non-technical CAO can implement it.
Our existing IT acceptable use policy mentions AI. Doesn't that count?
No. An IT acceptable use policy is not a Privacy Management Program under POPA. The PMP requirement is distinct: it must document how personal information is handled across your entire organization, demonstrate accountability at the leadership level, include staff training, and specify breach response protocols. An IT policy that mentions ChatGPT is not a substitute for this program.
What municipalities in Alberta has Spencer Morley Consulting worked with?
Municipality of Jasper, County of Grande Prairie No. 1, County of Minburn, Saddle Hills County and Red Deer County. That work spans wildfire response, crisis communications planning, resident surveys, a full rebrand and emergency management training, with full write-ups on the case studies page. Spencer Morley Consulting works primarily with small and rural municipalities, typically with fewer than 20 staff.
Further reading
Alberta municipalities
The deadline has passed. The risk is now.
Operating without a Privacy Management Program is an ongoing gap in compliance with POPA section 25, which the Commissioner may investigate. Let's talk about where you stand and how fast we can close the gap.