Guides
Practical, sourced, dated
A smaller number of authoritative pages rather than hundreds of thin ones. Each guide shows its publication and review dates, distinguishes laws from recommendations, and links to the tools that put it into practice.
Getting started
- AI Compliance Checklist for Small Businesses
A 12-step AI compliance checklist for small and mid-size businesses in Canada, the US and the EU, with the evidence to keep at each step.
9 min · reviewed 2026-10-14
- How to Create an AI Inventory
Step-by-step method for building an AI inventory: the fields to capture, four discovery methods, a template table and a six-stage lifecycle.
9 min · reviewed 2026-10-14
Policies
- AI Governance Policy Examples
How to structure an AI acceptable-use policy and an AI governance policy, with annotated example clauses and the mistakes that make policies useless.
10 min · reviewed 2026-10-14
- Responsible Use of ChatGPT and Other AI Assistants at Work
Practical rules for staff using ChatGPT and similar assistants: data rules by category, enterprise vs consumer accounts, verification habits, disclosure and training.
9 min · reviewed 2026-10-14
Risk
- AI Risk Assessment for Business: A Practical Method
A severity × likelihood × exposure method for assessing AI risk in a small business, with a worked example, the unknown-is-not-safe rule and escalation triggers.
10 min · reviewed 2026-10-14
- How to Review an AI Customer Service Bot
A practical review checklist for AI customer service bots: disclosure rules, human escalation, transcript data, retention, hallucination and abuse testing, logging, accessibility and metrics.
10 min · reviewed 2026-10-14
Vendors
- AI Vendor Due Diligence Checklist
Twelve question areas for assessing AI vendors, from training data and retention to model changes, with how to verify claims and the red flags that should stop a deal.
10 min · reviewed 2026-10-14
AI agents
- AI Agent Governance Explained
What makes AI agents different from chatbots, and how to govern them: permission matrix, autonomy levels, approval gates, logging, override and escalation, with a CRM incident example.
10 min · reviewed 2026-10-14
- Human Oversight for Autonomous AI Agents
Oversight patterns for AI agents that act on their own: pre-approval, sampling, kill switches, budgets and scoped credentials, how EU Arts. 14 and 26 frame oversight, and how to document it.
10 min · reviewed 2026-10-14
Regulations and standards
- ISO 42001 vs NIST AI RMF: Which Should a Small Business Use?
A plain-language comparison of ISO/IEC 42001 and the NIST AI RMF for small businesses: structure, certification, cost, how they map, and how both relate to actual law.
9 min · reviewed 2026-10-14
- The EU AI Act for Canadian Companies
When a Canadian business falls under the EU AI Act, the difference between provider and deployer, the risk tiers, the post-Omnibus timeline, and practical next steps.
10 min · reviewed 2026-10-14
Industries
- AI Compliance for HR Teams: Recruitment, Screening and Employee Monitoring
What HR teams in Canada, the US and the EU must do when AI touches hiring, screening or monitoring: the rules, the dates, and the practical controls that produce evidence.
11 min · reviewed 2026-10-14
- AI Governance for Real Estate Brokerages
How brokerages should govern AI for lead qualification, listing copy, chat, CRM agents and agent recruitment, with Canadian and US legal touchpoints and a starter inventory.
10 min · reviewed 2026-10-14
Operations
- Creating an AI Incident Response Plan
How a small business builds an AI incident response plan: incident types, severity levels, a six-stage workflow, privacy-breach touchpoints, a tabletop exercise and a record template.
10 min · reviewed 2026-10-14
- What Evidence Should an AI Governance Program Retain?
The evidence an AI governance program should keep per control, retention periods grounded in Colorado and EU duties, hashes and tamper-evidence, verified versus uploaded evidence, and export bundles.
10 min · reviewed 2026-10-14