AI and communications glossary

The practice of structuring content to earn featured answer positions in AI-powered search surfaces.

AEO targets the direct-answer results that appear in Google AI Overviews, voice search responses, and AI platform answers (ChatGPT, Perplexity, Gemini). Unlike traditional SEO, which aims for a position in a ranked list of links, AEO aims to be the answer itself, so the user may get the information without clicking through. Key AEO tactics include clear question-and-answer sections, concise and directly answerable prose, and content that can be understood without visiting the page. FAQPage markup can describe question-and-answer content, but Google says no special structured data is needed for its AI features, and it no longer shows FAQ rich results.

An automated sequence of AI-driven tasks that operates with minimal human intervention to complete a defined objective.

In a municipal context, agentic workflows can automate meeting minutes, council agenda preparation, bylaw drafting support, ratepayer correspondence, permit follow-up, and report generation, while keeping a human in the loop at defined approval points. Agentic workflows are not a replacement for staff; they take on administrative work so staff can focus on work that requires human judgment. SMC designs agentic workflows to be privacy-by-design and aligned with provincial legislation.

A formal policy governing which AI tools staff may use, under what conditions, and with what data.

An AI acceptable use policy (AUP) specifies sanctioned tools, prohibited uses, data handling requirements, breach reporting obligations, and staff expectations. For municipalities, it should be written in plain language for council adoption, address provincial privacy legislation (POPA in Alberta, FOIPPA in BC, MFIPPA in Ontario), and sit alongside a privacy management program rather than substitute for one. An IT acceptable use policy that mentions AI tools is not equivalent.

The set of policies, roles, and oversight processes an organization uses to ensure AI is used responsibly, legally, and in line with its mission.

AI governance answers who decides which AI tools are allowed, who is accountable when something goes wrong, how staff are trained, and how AI use is monitored over time. For a municipal council or a non-profit board, it is the difference between AI happening to the organization and the organization directing it. Good governance is lightweight and documented: a short approved policy, clear approval points, and a named owner, not a binder no one reads. SMC builds governance sized for small teams: enough structure to manage risk, not so much that it stalls useful work.

When an AI tool produces output that is fluent and confident but factually wrong or entirely fabricated.

Generative AI predicts likely text; it does not “know” facts, so it can invent citations, statistics, names, or policy details that look correct. Hallucination is a major reason AI output must be checked before it is relied on, especially in grant applications, council reports, legal-adjacent communications, or anything sent to the public. The practical defenses are training staff to verify, keeping a human in the loop, and using approaches like retrieval-augmented generation that ground answers in your own trusted documents.

Systematic, unfair skew in AI output that disadvantages certain groups, usually inherited from the data the model was trained on.

An AI tool can produce results skewed by gender, race, age, language, or geography because those patterns existed in its training data. In a service-delivery context, such as screening applications, drafting communications or prioritizing cases, that skew can quietly produce unfair outcomes for the people an organization exists to serve. Bias cannot be fully eliminated, but it can be managed: choosing appropriate tools, keeping a human in the loop on consequential decisions, and testing output against real cases. For non-profits and public bodies, naming this risk in an AI use policy is part of using AI ethically.

Alberta's legislation governing the right of public access to records held by Alberta public bodies, including municipalities.

ATIA covers access to records and works alongside POPA, which sets the privacy rules for Alberta public bodies. The privacy management program that every Alberta public body, including municipalities, needed in place by June 11, 2026 is a POPA requirement, not an ATIA one. The Office of the Information and Privacy Commissioner of Alberta (OIPC) oversees both Acts.

A framework, built before a crisis occurs, that defines how an organization will communicate during one.

A crisis communications plan identifies likely crisis scenarios, designates a spokesperson, establishes an approval chain for public statements, templates holding statements for common situations, and defines protocols for internal stakeholder notification. Organizations without a crisis plan respond reactively, losing the critical first hours to internal coordination while the story develops. A plan built before a crisis is far more useful than one assembled in real time.

The requirement that data be physically stored and accessed only within a specific country or jurisdiction.

Many public AI tools process and store data on servers outside Canada. It is widely assumed that Canadian privacy legislation forbids this. For most public bodies it does not: British Columbia's FOIPPA s. 30.1 was repealed in 2021, and Alberta's POPA contains no residency provision. BC still allows disclosure outside Canada only as its regulations permit, and storing sensitive personal information outside Canada requires an assessment in a privacy impact assessment (B.C. Reg. 294/2021). Nova Scotia is the main exception: its PIIDPA requires public bodies, including municipalities, to store and access personal information only in Canada, unless the head of the public body allows otherwise to meet operational needs. From April 1, 2027, Nova Scotia's new Freedom of Information and Protection of Privacy Act replaces PIIDPA and permits storage, disclosure or access outside Canada only in accordance with its regulations. Elsewhere, a residency obligation usually comes from a contract, a funder agreement or internal policy rather than a statute. The statutory duties that do apply are reasonable security arrangements and, in several provinces, an assessment before a new system is used. A private AI option can reduce cross-border exposure, but it still needs security arrangements and an assessment before use.

The degree to which AI systems have a clear, consistent, and well-sourced understanding of a specific business or organization.

AI platforms build knowledge graphs of real-world entities: businesses, people, places. The more consistently a business is described across its website, Google Business Profile, directory listings, structured data, and third-party mentions, the easier it is for AI systems to recognize it. We call that entity authority. Strong entity authority makes it easier for AI platforms to describe and recommend a business accurately. Weak entity authority, caused by inconsistent NAP data, conflicting descriptions, or a thin online presence, can lead AI platforms to favour competitors with clearer signals.

A Schema.org markup type that describes question-and-answer pairs in machine-readable JSON-LD.

FAQPage markup tells search engines and other machines which questions a page answers and what the answers are. It should match the questions and answers visitors can see on the page. Google stopped showing FAQ rich results on May 7, 2026, and says no special structured data is needed to appear in its AI features, so the bigger win is writing clear question-and-answer sections in the first place.

Manitoba's privacy legislation governing public bodies, including municipalities.

FIPPA sets out how Manitoba public bodies collect, use, disclose, and protect personal information, and those obligations apply directly when staff use AI tools with residents' data. Manitoba's Ombudsman provides oversight and investigates complaints. Each province sets its own requirements; in Manitoba the core duties include reasonable safeguards (s. 41) and notice of a privacy breach that creates a real risk of significant harm (s. 41.1).

British Columbia's privacy legislation governing public bodies, including municipalities.

FOIPPA's s. 30.1, which required personal information to be stored and accessed in Canada (with exceptions), is the provision most often cited in relation to AI tools, and it is no longer in force. It was repealed on 25 November 2021 by Bill 22 (SBC 2021, c. 39, s. 17). Disclosure outside Canada is now governed by s. 33.1, which allows it only in accordance with the regulations, and B.C. Reg. 294/2021 requires an assessment in a privacy impact assessment before sensitive personal information is stored outside Canada. The other provisions that govern a BC municipality deploying AI are s. 30 (reasonable security arrangements), s. 36.2 (a privacy management program, required since 1 February 2023), s. 36.3 (mandatory breach notification) and s. 69 (privacy impact assessments).

AI that creates new content, such as text, images, code or audio, in response to a prompt, rather than only classifying or predicting.

Generative AI is the category behind ChatGPT, Claude, Gemini, and similar tools. It is powerful for drafting, summarizing, and answering questions, but it generates plausible output rather than verified fact, which is why human review matters. For most organizations, generative AI is where the practical time savings are, provided staff know how to prompt it well and check what comes back. It is distinct from the older predictive AI used for scoring and forecasting.

The practice of optimizing a business's online presence so that AI platforms cite it in generated answers.

GEO is distinct from traditional SEO: SEO targets a position in a ranked list of links; GEO targets citation inside an AI-synthesized answer that may not include traditional search results at all. Signals we check for GEO include Google Business Profile completeness, review volume and velocity, Schema.org structured data (LocalBusiness, Service, FAQPage), NAP consistency across platforms, content depth and answer-ready formatting, and authoritative third-party mentions. AI providers don't publish a list of ranking signals, so these reflect industry practice. Businesses that have not addressed GEO may be missing from AI-generated answers to relevant questions.

AI-generated answer summaries that appear above traditional search results in Google Search.

Google AI Overviews synthesize information from multiple sources and present a direct answer, so the user may not need to click a link. Businesses and content cited in an AI Overview gain visibility without a click, and businesses not cited are absent from that answer regardless of their organic ranking. Google says the same SEO best practices apply to its AI features, and that no special structured data is required to appear in them.

An initial public communication issued during a crisis before all facts are known.

A holding statement acknowledges the situation, shows that the organization is aware and responding, and helps keep rumours from escalating, without making commitments that could prejudge an ongoing internal or legal process. A strong holding statement is issued within hours of a crisis emerging, not after a full investigation is complete. The window to shape public and media perception closes quickly; a holding statement issued too late allows the narrative to form without the organization's voice. Cheryl Spencer-Morley has developed and delivered holding statements across federal, provincial, and municipal government contexts.

A design principle that keeps a person in control of consequential AI decisions, with the AI assisting rather than deciding.

Human-in-the-loop means the AI drafts, suggests, or flags, and a qualified person reviews and approves before anything is acted on or published. It is the core safeguard in any responsible AI workflow: it catches hallucinations and bias, preserves accountability, and keeps judgment where it belongs. SMC designs automations for municipalities and non-profits with explicit approval points rather than letting AI act unsupervised.

The independent oversight body for a province's privacy and access-to-information legislation.

Most provinces have an information and privacy commissioner; Manitoba and New Brunswick use an ombud model instead. In Alberta, the OIPC oversees ATIA and POPA. In BC, the OIPC oversees FOIPPA. In Ontario, the IPC oversees MFIPPA and FIPPA. In Saskatchewan, the Information and Privacy Commissioner oversees LAFOIP. These bodies investigate complaints and issue guidance. Their powers vary: some can issue binding orders, while others, such as Saskatchewan's, make recommendations. A municipality without documented AI governance is in a weak position if a complaint is filed.

Saskatchewan's privacy legislation governing local authorities, including municipalities.

LAFOIP is Saskatchewan's statute for local authorities, distinct from the provincial FOIP Act, which covers government institutions. The Information and Privacy Commissioner of Saskatchewan oversees compliance and issues reports with recommendations on how local authorities handle personal information, including data processed with AI tools. Municipalities, libraries, and other local authorities fall under LAFOIP.

The type of AI model, trained on very large amounts of text, that powers tools like ChatGPT, Claude, and Gemini.

An LLM generates language by predicting the most likely next words given a prompt. The public LLMs are accessed over the internet, which is what creates data-handling and residency concerns when sensitive information is involved. The same technology can also be run privately (see private LLM), so an organization gets the usefulness without sending data to a third party. Understanding that “LLM” is the engine, and the chat product is just one interface to it, helps in evaluating tools.

A proposed Markdown file at the root of a website that summarizes the site for AI tools.

llms.txt was proposed in September 2024 as a way to give large language models a concise, readable overview of a site, mainly for use when an AI tool is answering a question. Adoption is voluntary, and Google Search does not use it. For AI tools that do read it, a well-written llms.txt can help describe a business accurately: its services, pricing, team, geographic scope, and how to refer people. Spencer Morley Consulting maintains one at spencermorleyconsulting.ca/llms.txt.

An open protocol, released by Anthropic in November 2024, that lets AI assistants connect to tools and data sources a user or developer sets up.

MCP gives AI assistants a standard way to connect to outside systems, such as files, databases or business applications, so they can look things up or take actions on a user's behalf. These connections are set up by the user or a developer; AI assistants don't find businesses through MCP on their own. MCP is separate from WebMCP, a browser proposal for websites.

Ontario's privacy legislation governing municipalities, school boards, and other local institutions, distinct from FIPPA, which governs provincial institutions.

MFIPPA sets rules for how Ontario municipalities collect, use, disclose, and protect personal information. From January 1, 2027, it requires a written privacy impact assessment before personal information is collected (s. 28(3)) and mandatory reporting of privacy breaches (s. 30.1). Guidance from the Information and Privacy Commissioner of Ontario recommends assessing AI tools before use. A small Ontario township with one CAO has the same MFIPPA obligations as a large city; the difference is resources, which is where Spencer Morley Consulting's remote delivery model is designed to help.

The uniformity of a business's name, address, and phone number across every online platform and directory.

AI platforms and search engines build profiles of businesses by combining information from multiple sources: Google Business Profile, Yelp, Facebook, directory listings, and the business's own website. When NAP data is inconsistent (a slightly different business name on one platform, an old phone number on another), it can make it harder for AI systems to match that information to the business, which can make the business less likely to be cited in generated answers. NAP consistency is one of the foundational GEO signals.

The independent oversight body for Alberta's ATIA and POPA, and the equivalent office in BC for FOIPPA.

The OIPC Alberta reviews complaints about public bodies, including municipalities, investigates, and can issue binding orders after an inquiry. Under POPA, individuals can ask the Commissioner to review a privacy complaint, and every Alberta public body has needed a privacy management program since June 11, 2026. The OIPC BC plays an equivalent role for BC municipalities under FOIPPA.

A documented assessment of how a new technology, system, or process interacts with personal information.

A PIA documents what personal information an AI tool accesses, how it uses that information, where it stores it, what third parties receive it, and what controls protect it. Requirements vary by province. BC requires municipalities to conduct PIAs (FOIPPA s. 69(5.3)). Ontario's MFIPPA requires a written assessment before collecting personal information from January 1, 2027. In Alberta, POPA's regulation requires some public bodies to have policies for using personal information in AI systems as part of their privacy management program. Elsewhere, a PIA is recommended practice. A PIA is not a one-time exercise; it should be updated when a system changes significantly.

Any information that can identify a specific individual, on its own or combined with other data.

PII includes obvious identifiers like name, address, and email, but also case notes, health and housing details, donor records, and combinations of data points that together single someone out. Canadian privacy statutes use the broader term “personal information”. It is the category of information that privacy legislation protects and that should almost never be entered into a public AI tool without a governing policy and safeguards. Knowing what counts as personal information is the starting point for using AI safely in any organization that holds information about residents, clients, or donors.

Canada's federal privacy law for personal information collected in the course of commercial activity.

PIPEDA governs how private-sector organizations handle personal information in the course of commercial activity. It applies to many small businesses, and to non-profits only when they engage in commercial activity, such as selling, bartering or leasing donor or membership lists. In Alberta and BC, most private-sector activity within the province falls under the provincial Personal Information Protection Act (PIPA) instead, and Quebec has its own private-sector law; PIPEDA still applies to personal information that crosses provincial or national borders. These laws set expectations for consent, purpose limitation, safeguarding, and accountability, which apply when customer data is fed into an AI tool. SMC helps organizations identify which regime applies and use AI within it.

Alberta's legislation governing how public bodies, including municipalities, handle personal information.

POPA works alongside ATIA, which covers access to records. The key AI-era requirement: every Alberta public body must have a privacy management program (s. 25), with a deadline of June 11, 2026. POPA also requires a public body to tell people if it intends to input their information into an automated system (s. 5(2)(d)), and to notify affected individuals, the Commissioner and the Minister of a breach that creates a real risk of significant harm (s. 10(2)). Personal information includes ratepayer records, staff data, applicant files, and bylaw complaint records, all of which municipal staff may enter into AI tools without realizing the risk.

A formal, documented set of policies, procedures, and controls governing how an organization handles personal information, required of Alberta public bodies under POPA and of BC public bodies under FOIPPA.

A PMP covers how personal information is collected, used, disclosed, retained, and disposed of. In Alberta it includes a designated privacy officer, staff training, procedures for privacy incidents, and policies for automated systems and, for some public bodies, AI systems. The POPA deadline for Alberta municipalities to have a PMP in place was June 11, 2026. An IT acceptable use policy is not a substitute for a PMP, even if it mentions AI or data.

A large language model deployed entirely within an organization's own infrastructure rather than on a public cloud.

A private LLM can process municipal data without sending it to a third-party AI service, so citizen information, council documents, ratepayer correspondence, and financial data stay within systems the municipality controls. It can reduce the exposure created by staff entering sensitive information into public AI tools. SMC can explore private AI options with municipalities as a custom project.

The practice of designing AI inputs (prompts) that consistently produce accurate, useful outputs for a specific task or role.

Most AI tools are used at a fraction of their potential because staff rely on generic prompts and accept whatever output is produced. Prompt engineering teaches staff how to frame requests, provide context, specify constraints, and evaluate AI output critically, so the tool is genuinely useful rather than a source of risk. SMC delivers prompt engineering training for both municipal staff (focused on safe, compliant AI use with citizen data) and small business teams (focused on productivity and content quality).

A security attack that hides malicious instructions inside content an AI reads, tricking it into ignoring its rules or leaking data.

When an AI tool processes a web page, document, or email, an attacker can embed hidden text instructing the AI to disregard its guidelines, exfiltrate information, or take unintended actions. As organizations connect AI to their own data and tools, prompt injection becomes a real operational risk, not a theoretical one. Defenses include treating any AI that handles external content as untrusted, limiting what connected AI can access, and keeping a human in the loop on actions that send data or make changes.

A technique that grounds an AI's answers in a specific, trusted set of documents instead of relying only on its training.

With RAG, the AI first retrieves relevant passages from your own materials, such as policies, past reports and program records, and then writes its answer from those sources. This can reduce hallucination and lets an AI assistant answer questions about your organization specifically, with citations you can check. RAG is also what makes a private AI option useful: when the model runs privately, it can work over your documents without that information being sent to a public service.

A shared vocabulary of machine-readable markup types, embedded in a website as JSON-LD, that helps search engines and other machines understand what a page is about.

Schema.org types relevant to SMC clients include LocalBusiness (who you are, where you operate), Service and OfferCatalog (what you offer and at what price), FAQPage (structured questions and answers), Article (blog content attribution), Person (team profiles), and BreadcrumbList (page hierarchy). Structured data helps search engines understand a business and its pages, and it should match what visitors see. Google says it isn't required to appear in its AI features.

The use of public AI tools by staff without formal authorization, training, or governance policy.

Shadow AI is not hypothetical. In a 2025 KPMG Canada survey of 349 public servants, 48 per cent said they use AI tools for work, and 39 per cent said they do not have, or are not aware of, a clearly communicated data policy. When a municipal employee enters citizen personal information into ChatGPT, Gemini, or another public AI service, that data may be stored on servers outside Canada (which can trigger cross-border assessment requirements, such as BC's), used to train AI models, or disclosed in ways the municipality cannot control. Shadow AI creates compliance exposure under provincial privacy law, such as POPA, FOIPPA and MFIPPA, whether or not the employee intended any harm.

Coaching that prepares a designated organizational representative to speak confidently and accurately to media, elected officials, and the public during high-pressure situations.

Spokesperson training is not presentation training. It is preparation for adversarial, unpredictable situations: journalists with an angle, community members with grievances, council members asking questions in public. Effective spokesperson training includes message development, bridging techniques, handling hostile questions, managing silence and pauses, and understanding what not to say. Cheryl Spencer-Morley has delivered spokesperson coaching at the executive level across federal, provincial, and municipal government contexts.

A proposed browser standard that would let a website offer actions to AI agents.

WebMCP is a draft from the W3C Web Machine Learning Community Group, edited by engineers from Microsoft and Google. It would let a web page describe actions, such as booking a call or requesting a quote, as tools an AI agent in the browser can use. Chrome opened an early preview in February 2026. WebMCP is not yet a W3C standard, and despite the similar name it is separate from Anthropic's Model Context Protocol (MCP).