Home › Municipal AI Track › Alberta Municipalities
Alberta — ATIA & POPA

Your staff are using AI.
Your ATIA/POPA policy
should already be in place.

The June 11, 2026 Privacy Management Program deadline under Alberta's Access to Information Act and Protection of Privacy Act has arrived. Spencer Morley Consulting helps Alberta municipalities close the compliance gap — and build a real AI capability at the same time.

Check Your Compliance Position See All Municipal Services

The ATIA/POPA Privacy Management Program deadline was June 11, 2026. If your municipality hasn't completed its program, the Office of the Information and Privacy Commissioner of Alberta can now receive formal complaints against you. Act now — the process takes weeks, not days.

ATIA
Access to Information Act (Alberta)
Governs public access to records held by Alberta public bodies. Municipalities must have documented procedures for receiving, processing, and responding to access requests — and for how AI tools interact with those records.
POPA
Protection of Privacy Act (Alberta)
Governs how Alberta public bodies collect, use, and disclose personal information. Requires a formal Privacy Management Program — policies, training, breach response protocols, and demonstrated accountability for ratepayer data.
OIPC
Office of the Information and Privacy Commissioner
Alberta's independent oversight body. Receives complaints, conducts audits, and issues orders against municipalities that fail to comply with ATIA or POPA. An incident without a program in place is significantly higher risk.
PMP
Privacy Management Program
The specific requirement under POPA — a documented, implemented set of policies and procedures demonstrating accountability for personal information. Not a template. Not an IT policy. A formal governance program.
The Problem

Half your staff are probably already using AI.

They're not waiting for a policy. They're using it today — with ratepayer data, municipal records, and personal information. Here's what the research shows about organizations like yours.

48%
of Canadian public servants are already using AI tools on the job — without waiting for governance
22%
of organizations have a formal AI adoption policy in place — meaning 78% do not
50%
of those AI users rely on publicly available tools — ChatGPT, Gemini, Copilot — tools not designed for municipal government
85%
of Canadians lack confidence in how the public service will develop and use AI — making incidents politically costly

Source: KPMG Canada, 2025, survey of 349 public servants — co-published with Microsoft

What We Do for Alberta Municipalities

Five services. One framework.
Built around ATIA and POPA.

Every service is adapted to Alberta's specific legislative requirements — not a generic template. Delivered remotely, with minimal time demands on your team.

01
AI Readiness Assessment
A structured diagnostic of your municipality's current AI exposure, shadow AI risk, and ATIA/POPA compliance gaps. Delivers a plain-language roadmap your council can understand and approve. The recommended starting point before any other service — because without knowing where you are, you can't prioritize what to fix.
Start HereATIA/POPA Aligned
02
Staff AI Training & Prompt Engineering
Practical training on what staff can and cannot use AI for under ATIA and POPA, how to handle personal information safely, and how to get genuinely useful output from sanctioned AI tools. Staff leave with skills they use the next day. Available remotely or on-site.
POPA ComplianceRemote or On-Site
03
AI Policy Development
A formal AI Acceptable Use Policy drafted from the ground up — grounded in ATIA and POPA, written for council adoption, and plain enough for a CAO with five other files to actually implement. Covers sanctioned tools, prohibited uses, data handling requirements, breach reporting obligations, and staff expectations. This is the policy that closes your formal compliance gap.
Privacy Management ProgramCouncil-Ready
04
Private LLM Deployment
A private AI instance scoped entirely to your municipality. Ratepayer data stays within your systems, under your control, subject to Alberta privacy law. Your staff get a sanctioned, capable alternative to public AI tools — one your municipality controls completely. No public cloud exposure. No IT department required to maintain it.
Data SovereigntyPOPA-Compliant Architecture
05
Agentic Workflows
Automation for municipal administrative tasks: meeting minutes, council agendas, bylaw drafting, permit correspondence, report generation, ratepayer communications. Every workflow is privacy-by-design and built with human oversight from the start. Your staff don't get replaced — they get relieved of the work that prevents them from doing what actually requires a human.
Privacy-by-DesignHuman Oversight
Alberta Municipality FAQ

Common questions from Alberta CAOs and town administrators

The June 11 deadline has passed. Is it too late?

No — but the urgency is higher, not lower. The deadline has passed, which means the OIPC can now receive formal complaints against Alberta municipalities that don't have a Privacy Management Program in place. The right move is to establish the program as quickly as possible, document the timeline of your remediation, and demonstrate good-faith compliance effort. Spencer Morley Consulting has helped municipalities start this process in under 30 days.

We're a small rural municipality with a CAO and four staff. Is this realistic for us?

Yes — this context is exactly who Spencer Morley Consulting serves. Large Alberta municipalities have in-house legal counsel and IT departments. Small municipalities do not — and a generic enterprise compliance template won't work for a village of 400. Everything is delivered remotely, designed around minimal staff time, and written so that a non-technical CAO can implement it.

Our existing IT acceptable use policy mentions AI. Doesn't that count?

No. An IT acceptable use policy is not a Privacy Management Program under POPA. The PMP requirement is distinct — it must document how personal information is handled across your entire organization, demonstrate accountability at the leadership level, include staff training, and specify breach response protocols. An IT policy that mentions ChatGPT is not a substitute for this program.

What municipalities in Alberta has Spencer Morley Consulting worked with?

Client engagements are confidential. What we can share: Spencer Morley Consulting works primarily with small and rural Alberta municipalities — villages, towns, summer villages, municipal districts, and rural counties — typically with fewer than 20 staff. You can read an anonymized case study on the case studies page that describes a rural Alberta municipality that completed its Privacy Management Program in 28 days.

Further Reading
Compliance GuideAlberta's ATIA/POPA Deadline Has Arrived. Here's What Your Municipality Needs.The 8-step Privacy Management Program checklist — and what to do if you're not compliant today. → Risk ManagementWhat Is Shadow AI in Municipalities? The Risk Your Policy Hasn't Addressed.48% of Canadian public servants already use AI tools on the job. Most municipalities have no policy governing it. → How-To GuideHow to Build an AI Policy for Your Municipality — A Plain-Language Framework7 steps to a policy that staff will actually follow — and council will adopt. →
Alberta Municipalities

The deadline has passed.
The risk is now.

The longer your municipality operates without a Privacy Management Program, the longer the OIPC has grounds to act on any complaint. Let's talk about where you stand and how fast we can close the gap.

Book a Consultation