Saskatchewan: LAFOIP
Saskatchewan municipalities: your staff are already using AI. LAFOIP applies to every tool they use with local authority information.
Saskatchewan's Local Authority Freedom of Information and Protection of Privacy Act requires local authorities to establish policies and procedures that safeguard personal information, including when AI tools are involved. The Saskatchewan Information and Privacy Commissioner can investigate complaints. Spencer Morley Consulting helps Saskatchewan municipalities build the governance LAFOIP requires, and the AI capability their staff actually need.
LAFOIP: the law for local authorities
LAFOIP is a separate statute from FIP and applies to local authorities: municipalities, boards of education, public library boards, the Saskatchewan Health Authority and others. Section 23.1 requires every local authority to establish policies and procedures that maintain administrative, technical and physical safeguards for personal information. The Saskatchewan Information and Privacy Commissioner oversees LAFOIP and has published guidance on artificial intelligence and privacy. The safeguard duty applies now, to every AI tool your staff use with personal information.
Key terms
LAFOIP
The Local Authority Freedom of Information and Protection of Privacy Act (Saskatchewan)
Governs access to records and protection of personal information held by Saskatchewan local authorities, including municipalities. Requires policies and procedures that maintain safeguards for personal information and ensure compliance by employees (s. 23.1), and notice to individuals of unauthorized use or disclosure where there is a real risk of significant harm (s. 28.1).
IPC SK
Saskatchewan Information and Privacy Commissioner
Saskatchewan's independent oversight body for LAFOIP, FIP and HIPA. Reviews complaints, investigates how local authorities handle personal information, and issues reports with recommendations. Has published guidance on artificial intelligence and privacy.
SARM / SUMA
Saskatchewan Association of Rural Municipalities / Saskatchewan Urban Municipalities Association
SARM represents Saskatchewan's rural municipalities. SUMA represents its cities, towns, villages, resort villages and northern municipalities. Spencer Morley Consulting's framework serves both rural and urban Saskatchewan municipalities.
s. 23.1
Duty to protect personal information (LAFOIP s. 23.1)
Section 23.1 requires every local authority to establish policies and procedures that maintain administrative, technical and physical safeguards for personal information and ensure employees comply with the Act. It does not mention AI, but it applies to any tool staff use with personal information. A local authority whose safeguards do not address AI tools may have difficulty showing it meets this duty.
The problem in Saskatchewan
Shadow AI is already in your municipality. LAFOIP makes it a compliance issue.
National research on Canadian public sector AI use applies directly to Saskatchewan local governments. The numbers are not hypothetical. They describe what is almost certainly already happening in your organization.
Sources: KPMG Canada, 2025, survey of 349 public servants; MNP 2025 Municipal Report, survey of 282 municipal leaders
What we do for Saskatchewan municipalities
Five services. One framework. Built around LAFOIP.
Every engagement is adapted to Saskatchewan's specific legislative requirements, not a copy-paste Alberta template. Delivered remotely, available to any Saskatchewan municipality regardless of size or location.
AI readiness assessment
A structured diagnostic of your municipality's current AI exposure, shadow AI risk, and LAFOIP compliance gaps, including what tools are in use and whether your section 23.1 policies and procedures cover them. Delivers a plain-language roadmap your council can approve. The right starting point before any other investment.
Staff AI training & prompt engineering
Practical training on what Saskatchewan municipal staff can and cannot use AI for under LAFOIP, specifically covering personal information handling, safeguards, and when AI use requires documented authorization. Staff learn both the compliance framework and how to use sanctioned AI tools effectively. Available remotely or on-site anywhere in Saskatchewan.
AI adoption policy & procedures
A formal AI adoption policy grounded in LAFOIP and designed for Saskatchewan council adoption. Covers sanctioned tools, prohibited uses involving citizen personal information, the safeguards section 23.1 requires, breach notification under section 28.1, and staff expectations. Written so that a CAO without legal background can implement it, and that the Saskatchewan Information and Privacy Commissioner would recognize as a genuine governance program. Delivered as two documents: the AI Adoption Policy council adopts, and a companion AI Adoption Procedures document setting out how staff request and approve tools, what is logged, and the exact steps when a breach is suspected, so administration can revise procedures as tools change without returning to council each time.
See the AI adoption policy for public bodiesPrivate AI options
Some municipalities want AI that can work with sensitive information without using a public platform. We can explore whether a privately hosted option fits your situation. Any build would be scoped as a custom project, so we make no commitments until we understand what you need.
Agentic workflows
Municipal administrative automation: meeting minutes, council agendas, bylaw drafting, permit correspondence, report generation, ratepayer communications, built privacy-by-design and with explicit human oversight. Every workflow is scoped to LAFOIP's safeguard requirements for Saskatchewan local authorities.
Saskatchewan municipality FAQ
Questions from Saskatchewan CAOs and municipal administrators
What is LAFOIP and how is it different from FOIP in Saskatchewan?
LAFOIP (The Local Authority Freedom of Information and Protection of Privacy Act) applies to local authorities: municipalities, boards of education, public library boards, the Saskatchewan Health Authority and similar bodies. FOIP (The Freedom of Information and Protection of Privacy Act) applies to provincial government institutions. The two Acts were enacted in the same legislative session and closely parallel each other, and the Saskatchewan Information and Privacy Commissioner oversees both. Your compliance obligations flow from LAFOIP, not FOIP.
We're a small rural Saskatchewan municipality. Is this realistic for us?
Yes. Small municipalities are exactly who this service is built for. Large urban centres like Saskatoon and Regina have legal counsel and dedicated privacy officers. Small rural municipalities and RMs typically don't, and generic enterprise-level compliance templates don't work for a small office. Spencer Morley Consulting's Municipal AI Framework is designed for small teams, delivered remotely, and sized appropriately for Saskatchewan's rural municipal landscape. SARM members are a natural fit.
Our municipality uses Microsoft 365. Does LAFOIP apply to Copilot?
Yes. LAFOIP applies to personal information whatever tool staff use, including Microsoft 365 Copilot. Section 23.1 requires policies and procedures that safeguard personal information, and section 23.2 governs information management service providers that process or store personal information for a local authority. In practice that means a policy governing Copilot use, staff training on what is and isn't appropriate, and accountability that would hold up to the Commissioner's review. The AI Readiness Assessment will map exactly what tools are in use and what governance gaps exist.
We have both SARM and SUMA memberships. Which one is more relevant for AI governance?
Both. SARM represents rural municipalities and SUMA represents cities, towns, villages, resort villages and northern municipalities. Spencer Morley Consulting's Municipal AI Framework serves both. The obligations under LAFOIP are the same regardless of which association you belong to; the difference is scale and context, not compliance requirements.
Further reading
Saskatchewan municipalities
LAFOIP's safeguard duty applies right now.
Your staff are using AI today. LAFOIP's duty to safeguard personal information applies to every tool they use with it, whether a policy exists or not. Let's talk about where your municipality stands.