AI Use Policy Template for Canadian Organizations (Word and PDF)
An AI use policy template gives a ready structure: approved tools, data rules, output checks, disclosure, privacy, incidents and review. Remolda's version is written for Canada and follows the 2023 privacy commissioners' principles, Québec Law 25 and Ontario's job-posting rule.
In short
- 12 sections: purpose, scope, definitions, principles, approved tools register, information classes, using AI output, disclosure, privacy and security, new uses, incidents, roles and review.
- Three appendices: a one-page staff summary, a request form for new AI tools and uses, and the Canadian sources behind each rule.
- Canadian anchors: the 2023 privacy commissioners' principles for generative AI, Québec Law 25 (ss. 3.3, 12.1, 17) and Ontario's AI disclosure in job postings since January 1, 2026.
- Formats: Word (.docx) to edit and PDF to read, in English and French. Enter your email and the links appear on the page and in your inbox.
- General information only: have the adapted policy reviewed by your counsel and privacy officer. Remolda can adapt it to your tools and train staff on it.
What is inside the template
| Section | What it settles |
|---|---|
| 1–3. Purpose, scope, definitions | Who the policy covers, which tools count as AI, what "personal" and "confidential" mean |
| 4. Principles | Seven rules drawn from the privacy commissioners' 2023 principles for generative AI |
| 5. AI Tool Register | Approved tools, uses, highest data class, settings, owner; vendor terms to check before approval |
| 6. Information classes | Public, internal, confidential, personal and sensitive personal information, and which tools may hold each |
| 7. Using AI output | Checking facts and code, human accountability, decisions about individuals, records |
| 8. Transparency | Disclosure to clients, Québec automated-decision notices, Ontario job postings |
| 9. Privacy and security | Privacy impact assessments, data location, work accounts, prompt safety |
| 10. New tools and uses | Request, review and approval of high-impact uses |
| 11. Incidents | What to report, to whom, how it is assessed |
| 12. Roles, training, review | Owner, approvals group, training, review date |
| Appendices A–C | Staff one-pager, new-use request form, Canadian sources |
Canadian rules the template reflects
PIPEDA and the privacy commissioners' principles. In December 2023 the federal, provincial and territorial privacy commissioners published nine principles for generative AI, from legal authority and consent to safeguards. Section 4 turns them into staff rules.
Québec Law 25. A person must be told when a decision about them is based exclusively on automated processing (s. 12.1). A privacy impact assessment is required for new information systems involving personal information (s. 3.3) and before personal information is communicated outside Québec, including to a vendor (s. 17).
Ontario job postings. Since January 1, 2026, employers with 25 or more employees, counted on the day the posting goes up, must disclose in public job postings when AI is used to screen, assess or select applicants.
Security. The Canadian Centre for Cyber Security advises organizations to set policies on how AI should be used and to enforce strong authentication. Section 9 covers accounts, updates and prompt safety.
Get the template
Get the AI use policy template
Word and PDF. The links appear here and arrive by email.
Where organizations usually need help
A template gives structure. The parts that take work are specific to each organization:
- The tool register. Which tiers you license, how they are configured, and what the vendor contract says about training, retention and data location. See AI vendor selection.
- Information classes. Matching them to your client contracts, professional secrecy and records schedule.
- High-impact uses. Hiring, eligibility and client-facing chatbots, where Canadian privacy law sets specific duties.
- Adoption. A policy staff have read and understood. A short session and the one-page summary cover it; see Copilot and ChatGPT training.
Remolda adapts the policy with you as part of the AI use policy service: current AI use mapped in the one-week AI Readiness Review ($490 CAD + HST), vendor terms checked, policy drafted in English or French, staff trained.
Frequently asked questions
What should an AI use policy include?
At minimum: which AI tools are approved and for what, which information may go into which tool, how AI output is checked, when AI use is disclosed, privacy and security rules, how new tools are requested, how incidents are reported, who owns the policy and when it is reviewed.
Is this AI policy template free?
Yes. Enter your work email and you get the Word and PDF files in English or French. Your request also reaches the Remolda team; there is no mailing list.
Which parts of the template need the most adaptation?
The AI Tool Register, the information classes and the approval roles. They depend on the licences you hold, what your vendor contracts say about training, retention and data location, your client contracts and professional secrecy rules, and who in your organization signs off on new uses.
Can we use the template as is?
It is written to be adapted. The tool register, information classes and approval roles depend on the licences you use, your contracts with clients and your privacy obligations. Plan for a review by your legal counsel and privacy officer before adoption.
Does the template cover Microsoft 365 Copilot, ChatGPT and Claude?
Yes. The tool register has example rows for Microsoft 365 Copilot, ChatGPT Enterprise or Business and Claude for Work, and a checklist of vendor terms to confirm before approval: training on business data, retention, data location, sub-processors and admin controls.
Is it suitable for federal or provincial public bodies?
It is a starting point. Federal institutions also follow the Treasury Board Directive on Automated Decision-Making and the Guide on the use of generative AI, which the template lists as sources. Provincial bodies should add their own directives and access-to-information rules.
Can Remolda adapt the policy for us?
Yes. We map current AI use in the one-week AI Readiness Review ($490 CAD + HST), check your vendors' terms, adapt the policy in English or French and run a staff session. Drafting and training are quoted on the call.
Sources
- Office of the Privacy Commissioner of Canada — Principles for responsible, trustworthy and privacy-protective generative AI technologies
- LégisQuébec — Act respecting the protection of personal information in the private sector (CQLR c P-39.1)
- Government of Ontario — ESA guide: requirements related to publicly advertised job postings
- Canadian Centre for Cyber Security — Generative artificial intelligence (ITSAP.00.041)
- Treasury Board of Canada Secretariat — Guide on the use of generative artificial intelligence
Facts checked:
Talk to an AI transformation consultant
A 30-minute call: you describe the situation, we tell you what to do first and what it would cost.
Book a 30-min call30 minutes. English or French.