For you as owner
AI Adoption
Policy
A short policy that sets what is allowed. Plain language, grounded in the privacy law that actually applies to your business.
Clear rules for AI at work.
Procedures your staff can follow.
If your team uses AI tools, someone is already deciding what goes into them. Spencer Morley Consulting writes a short AI policy you approve and companion procedures that tell staff exactly what to do, built on the privacy law that applies to your business.
Book a 15-minute callWho this is for
Owner-led businesses using AI without written rules.
Built for teams where the owner sets the rules:
- Professional practices: accounting, legal, consulting and design
- Trades and contractors
- Retail and hospitality
- Agencies and studios
- Growing teams that started using AI before anyone wrote anything down
Every engagement is scoped on a short call, because a five-person office and a forty-person operation need different documents.
What will you receive?
Spencer Morley Consulting writes both.
AI Adoption
For your staff
AI Adoption
Procedures
The practical companion. This is what an employee opens when they have an AI tool in front of them and a customer's information in hand.
What the procedures cover.
Rules only work if staff can follow them on a busy day. A typical set of procedures covers:
- which tools staff may use, and who decides when a new one comes along
- what customer, client and employee information must never go into a public AI tool
- when someone must check AI output before it goes to a customer
- when customers are told that AI was used
- how client confidentiality is protected under your contracts
- what to do if something goes wrong, and who to tell
- how new staff learn the rules, and when the rules are reviewed
Exact contents follow your handbook and the tools your team actually uses.
How the work runs
Written into what you already have.
Six phases, from first conversation to documents you can roll out. The rules are written into what you already have, not filed beside it.
- Phase 01
Discovery
Owner or manager as sponsor
Which tools are already in use, what you want AI to do for the business, and which privacy and contract obligations apply.
- Phase 02
Handbook cross-reference
Where the value is
Your handbook, privacy policy and client terms are read for conflicts and gaps, so the AI rules fit what you already have.
- Phase 03
Guidance check
Current guidance and comparable policies are checked against present law before they inform the draft.
- Phase 04
Two-tier drafting
Policy + procedure
A short policy sets the rules. Companion procedures set the day-to-day steps.
- Phase 05
Review & refinement
Draft language is tested with you, a staff lead and your IT provider.
- Phase 06
Ready to roll out
Both documents are finalized in your format, ready for you to approve and share with staff.
Phase 2 cross-references the AI policy against
- Employee handbook
- Privacy policy
- Client terms and confidentiality
- Acceptable use of technology
- Records retention
- Software and supplier contracts
Stress test
between phases 4 and 5
between phases 4 and 5
Before the second draft, the policy and procedures are run against written scenarios (hypothetical, roles only), such as an employee pasting a client file into a free AI tool, or a quote drafted with AI. Each gap is fixed before you sign off, and material changes are retested.
Rules nobody can find do not get followed.
A policy that sits in a folder on its own gets forgotten. When the AI rules connect to the handbook, the onboarding checklist and your client terms, staff meet them where they already look.
So we write them into what you already have, and point out any changes those documents need to match.
What your policy must contain
Seven things a small business AI policy needs.
Use these to judge any template you find online, or to scope the policy your business actually needs.
Who it covers
Employees, contractors, and anyone using business accounts or business information.
Approved and off-limits uses
Which AI tools staff may use and for what, and what never goes into a public AI tool.
Customer and employee information
How personal information may be used with AI under the privacy law that applies to you and the terms of your client contracts.
When something goes wrong
How a mistake or privacy incident is reported, and who handles it.
Who is responsible
Who owns the rules, approves new tools and keeps the documents current.
Training
What staff learn before they use AI tools for work, including new hires.
Plain language
Short and clear enough that staff actually read it and can follow it.
The law behind it
Which privacy law applies to your business?
It depends on where you operate. The documents are built on the answer.
- Alberta: the Personal Information Protection Act.
- British Columbia: British Columbia's own Personal Information Protection Act.
- Quebec: the Quebec private-sector privacy act.
- Elsewhere in Canada: the federal PIPEDA, for personal information handled in the course of commercial activity.
- Federally regulated businesses, and personal information moving across provincial or national borders in commercial activity, fall under PIPEDA as well.
Client contracts and industry rules can add obligations of their own. Phase 1 reads those too.
General information about how the law applies, not legal advice.
A few useful answers.
Who writes AI adoption policies for small businesses in Canada?
Spencer Morley Consulting, an Edmonton-based firm founded in 2023, writes AI adoption policies and companion procedures for small businesses across Canada, grounded in the private-sector privacy law that applies to each business.
We are a small team. Do we really need a written policy?
If staff use AI tools with customer or employee information, the rules exist either way: in your head or on paper. Writing them down means staff can follow them, new hires learn them, and you can show clients how their information is handled.
How long are the documents?
Sized to your team and written so staff will actually read them. The procedures are the practical part: what to do, step by step.
Will it be tested before we roll it out?
Yes. Before the second draft, the policy and procedures are run against written scenarios, and every gap is fixed before you sign off.
How is it priced?
Each engagement is scoped on a short call, because the size of your team, the information you handle and the documents you already have all change the work.
Tell us what you’re facing.
Book a time to talk, or send a note with the form and we will reply by email.
Book a 15-minute callWe respect your privacy. We don't share form submissions with third parties for their marketing. Privacy policy