Manitoba: FIPPA
Manitoba municipalities: your staff are already using AI. An Ombudsman investigation is the wrong way to find out.
Manitoba's Freedom of Information and Protection of Privacy Act requires municipalities to protect personal information with reasonable safeguards, and privacy complaints go to the Manitoba Ombudsman. Spencer Morley Consulting helps Manitoba municipalities put AI governance in place before a complaint forces their hand.
Manitoba's enforcement route: the Ombudsman, not an IPC
In Manitoba, FIPPA privacy complaints go to the Manitoba Ombudsman rather than to a dedicated Information and Privacy Commissioner. Investigations are conducted in private, but the Ombudsman must make its recommendations public and may publish special reports. If a public body does not act on a recommendation, the Ombudsman may refer the matter to the Information and Privacy Adjudicator, who can issue a binding order. The question is not whether FIPPA applies to AI use. It already does.
Key terms
FIPPA
The Freedom of Information and Protection of Privacy Act (Manitoba)
Governs access to records and protection of personal information held by Manitoba public bodies, including municipalities as local public bodies (s. 1). Requires reasonable administrative, technical and physical safeguards (s. 41), notice of privacy breaches that create a real risk of significant harm (s. 41.1), and a written agreement with any information manager that handles personal information (s. 44.1).
Manitoba Ombudsman
Oversight body, not a dedicated privacy commissioner
The Manitoba Ombudsman investigates FIPPA complaints, including complaints about local public bodies. Manitoba does not have a dedicated Information and Privacy Commissioner. The Ombudsman makes recommendations, must make them public, and may refer an unresolved matter to the Information and Privacy Adjudicator, who can issue a binding order.
AMM
Association of Manitoba Municipalities
The association for Manitoba municipal governments. In its April 2026 submission on the province's public sector AI and cybersecurity legislation, the AMM welcomed a province-wide framework and asked that requirements reflect municipal capacity.
AI Act
New provincial AI legislation
The Public Sector Artificial Intelligence and Cybersecurity Governance Act (S.M. 2026, c. 43) received assent on June 1, 2026. It names municipalities as public sector entities and comes into force on a date set by proclamation. FIPPA's safeguard and breach duties already apply to AI use today.
The problem in Manitoba
Shadow AI is already in your municipality. FIPPA makes it a compliance issue.
National research on Canadian public sector AI use applies directly to Manitoba local governments. The numbers are not hypothetical. They describe what is almost certainly already happening in your organization right now.
Sources: KPMG Canada, 2025, survey of 349 public servants; MNP 2025 Municipal Report, survey of 282 municipal leaders
What we do for Manitoba municipalities
Five services. One framework. Built around FIPPA.
Every engagement is adapted to Manitoba's specific legislative requirements, not a copy-paste Alberta template. Delivered remotely, available to any Manitoba municipality regardless of size or location.
AI readiness assessment
A structured diagnostic of your municipality's current AI exposure, shadow AI risk, and FIPPA compliance gaps, including whether the tools in use are covered by reasonable safeguards and, where an outside provider handles personal information, a written agreement. Delivers a plain-language roadmap your council can approve. The right starting point before any other investment, and the right evidence to have on file if an Ombudsman complaint ever arrives.
Staff AI training & prompt engineering
Practical training on what Manitoba municipal staff can and cannot use AI for under FIPPA, specifically covering personal information handling, unauthorized disclosure risks, and the accountability obligations that apply to local public bodies. Staff learn both the compliance framework and how to use sanctioned AI tools effectively. Available remotely or on-site anywhere in Manitoba.
AI adoption policy & procedures
A formal AI adoption policy grounded in FIPPA and designed for Manitoba council adoption. Covers sanctioned tools, prohibited uses involving citizen personal information, the safeguards and breach notification steps FIPPA requires, and staff expectations. Written so that a CAO without legal background can implement it, and that the Manitoba Ombudsman would recognize as a genuine, good-faith governance program. Delivered as two documents: the AI Adoption Policy council adopts, and a companion AI Adoption Procedures document setting out how staff request and approve tools, what is logged, and the exact steps when a breach is suspected, so administration can revise procedures as tools change without returning to council each time.
See the AI adoption policy for public bodiesPrivate AI options
Some municipalities want AI that can work with sensitive information without using a public platform. We can explore whether a privately hosted option fits your situation. Any build would be scoped as a custom project, so we make no commitments until we understand what you need.
Agentic workflows
Municipal administrative automation: meeting minutes, council agendas, bylaw drafting, permit correspondence, report generation, ratepayer communications, built privacy-by-design and with explicit human oversight. Every workflow is scoped to FIPPA's collection, use, disclosure and safeguard requirements, and documented before it goes live.
Manitoba municipality FAQ
Questions from Manitoba CAOs and municipal administrators
We don't have an IPC in Manitoba. Does that mean less enforcement risk?
No. In Manitoba, FIPPA privacy complaints go to the Ombudsman rather than a dedicated privacy commissioner. Investigations are conducted in private, but the Ombudsman must make its recommendations public and may publish special reports, and an unresolved matter can be referred to the Information and Privacy Adjudicator, who can issue a binding order. A municipality that cannot show reasonable safeguards and an AI governance program faces both a compliance problem and a reputational one.
We're a small Manitoba municipality with limited staff. Is this service right for us?
Yes. Small municipalities are exactly who this service is built for. Large organizations have legal counsel and dedicated privacy officers. Small Manitoba municipalities, rural municipalities (RMs), towns, and villages typically don't, and generic enterprise-level compliance templates don't work for a small team. Spencer Morley Consulting's Municipal AI Framework is designed for small teams, delivered remotely, and sized appropriately for the reality of Manitoba local government.
Does FIPPA apply to AI tools our staff use on the job?
Yes. FIPPA's obligations apply to how your municipality handles personal information, regardless of the tool used. When a staff member uses a public AI tool to process, summarize, or draft content involving citizen personal information, FIPPA's rules on collection, use and disclosure apply, along with the duty to protect it with reasonable safeguards (s. 41). If an outside provider handles that information, s. 44.1 requires a written agreement. Closing those gaps for AI tools is the core of what Spencer Morley Consulting helps with.
What is the AMM's position on AI governance for Manitoba municipalities?
In its April 2026 submission on Bill 51, The Public Sector Artificial Intelligence and Cybersecurity Governance Act, the Association of Manitoba Municipalities welcomed a clear, province-wide framework and cautioned that requirements may be complex and costly for municipalities. The Act names municipalities and comes into force on proclamation, so putting AI governance in place now is the practical step.
Further reading
Manitoba municipalities
FIPPA compliance isn't optional. Proactive is better than reactive.
Your staff are using AI today. FIPPA's safeguard and breach notification duties apply now, and new provincial AI legislation is on the way. Let's talk about where your municipality stands.