Many businesses we speak with have no written AI policy. Here is what that means for your business.
The short version: Your people are already using public AI with client files. A written AI policy is the fix you can show your insurer and your clients. Start with the $1,000 AI Liability Assessment, credited in full toward a retainer if you continue within 90 days.
No written AI policy
Law firms, accounting practices and financial advisory businesses often have staff using public AI tools with client data. No policy. No visibility. No documentation.
In May 2026, Canada’s Privacy Commissioner found that OpenAI’s initial training of ChatGPT did not comply with PIPEDA (PIPEDA Findings #2026-002). Law societies have warned that inputting confidential client information into generative AI tools can create serious confidentiality risks.
78% of people who use AI at work bring their own AI tools, and 80% at small and medium-sized companies do the same (Microsoft Work Trend Index, 2024).
Why this happens
It's not incompetence. It's the math of small business.
Hiring a full-time IT person costs $65,000–$85,000 per year in salary. With benefits, equipment and training, the all-in cost is $83,000–$115,000+ (Unified Technology, 2026). A business with 20 people can't justify that expense.
So instead of hiring, the owner bans ChatGPT. A memo goes out. The problem looks fixed on paper. Then employees just use their personal phones to summarize confidential documents.
That's the reactive trap.
We help you document and reduce privacy risk. We don't provide legal advice.
What AI governance actually does
AI governance closes the gap between what your people already do with AI and what you can show your insurer and your clients. It comes down to three things:
- Shadow AI, found and named. An inventory of the AI tools your team actually uses, which are approved, and which should be shut down.
- A written AI policy. Plain rules for what can go into which tool, written so you can share it with your insurer and clients. Copilot and similar tools are locked to the files each person may already open.
- Monitoring. Ongoing checks that the policy is followed and that new AI tools get caught early, plus a written plan for what everyone does if client data is exposed.
The PIPEDA angle (for regulated industries)
PIPEDA is Canada's federal private-sector privacy law. It applies to most businesses that collect personal information in commercial activity.
This is not a technical problem. It's a business risk problem.
What we tell every business owner
You cannot afford to ignore shadow AI anymore. Your people are using AI with client files whether or not you have a policy. A ban on paper doesn't stop it; a written policy and monitoring let you show what happens with client data.
You have three choices:
| Option | Cost (as quoted) | Shadow AI visibility | Written AI policy | Monitoring |
|---|---|---|---|---|
| Traditional IT Vendor | $25,000–$40,000 a year for a 20-person business (Unified Technology, 2026) | Usually not in scope | Usually not in scope | Devices and patches, not AI use |
| In-House IT Staff | $83,000–$115,000+ all-in (Unified Technology, 2026) | Depends on the person | Partial | Inconsistent |
| Trueline Fractional AI Officer | $10,000–25,000/mo after the $1,000 assessment | Inventory of every AI tool in use | Written, ready to share | Ongoing |
Next steps
If you want to know where your business stands, the ladder starts with the AI Liability Assessment at $1,000, credited in full toward a retainer if you continue within 90 days.
Most businesses discover one thing they didn't know—and one thing that scares them. Both are worth knowing.
Common questions
Do I need a written AI policy?
If your people use AI with client work, a written policy is the document your insurer and clients will ask for.
What does the assessment cost?
$1,000, credited in full toward a retainer if you continue within 90 days.
Is there a money-back guarantee?
Every monthly service has a 30-day money-back guarantee. If you are not happy, tell us within 30 days of your first invoice and first payment and we refund your entire first invoice. No questions asked. Full terms on /terms.