Skip to content
AI Compliance Tool
Check my AI risk
PlatformSolutionsPricingRegulationsFree toolsGuides Partners Sign in

AI Compliance Checklist for Small Businesses

A 12-step AI compliance checklist for small and mid-size businesses in Canada, the US and the EU, with the evidence to keep at each step.

By AI Compliance Tool editorial team · Published 2026-10-14 · Reviewed 2026-10-14 · Reviewer: Pending independent review · 9 min read

Key takeaways

  • Most small businesses are deployers of AI tools, not developers, so the practical workload is an inventory, a policy, a risk screen per tool, vendor checks and disclosure where people are affected.
  • Canada has no federal AI statute in force; existing privacy law (PIPEDA and provincial acts) plus Quebec Law 25 and Ontario ESA s. 8.4 do the heavy lifting today.
  • The EU AI Act already applies to prohibited practices and AI literacy; transparency duties apply from 2 August 2026 and most high-risk duties from 2 December 2027.
  • Keep dated evidence for every step. A checklist with no evidence is an intention, not a control.
  • NIST AI RMF and ISO/IEC 42001 are voluntary frameworks; aligning to them is useful but is not certification and does not make you compliant with any law.

Most small and mid-size businesses did not decide to adopt AI. It arrived through a sales rep’s browser extension, a marketing contractor’s drafting tool and a support platform that quietly switched on a chatbot. That is why this checklist starts with finding what you already have rather than with law.

The twelve steps below are ordered so that each one produces evidence the next one needs. Work through them in sequence the first time; afterwards, steps 1, 4, 7 and 12 become a quarterly loop.

How to read this checklist

Three distinctions matter throughout:

  • Laws create enforceable duties (the EU AI Act, GDPR, PIPEDA, Quebec Law 25, Colorado SB 26-189, the FTC Act).
  • Proposed legislation creates no duties yet (Canada’s Bill C-36, introduced 15 June 2026, is a bill only; Bill C-27 with its proposed AIDA died on 6 January 2025).
  • Voluntary standards and guidance (NIST AI RMF 1.0, ISO/IEC 42001:2023, Canada’s OPC generative AI principles, the ISED voluntary code) shape expectations and good practice but are not certifications and do not confer compliance.

Nothing in this guide is legal advice. Where a step says “check your regulator” or “get specialist review”, that is the step.

The 12-step checklist

Step 1. Name an accountable owner

Pick one person who owns AI governance. In a 20-person company this is usually the operations lead or the founder. Canadian privacy law already expects a designated accountable individual (PIPEDA Schedule 1, Principle 4.1; Alberta PIPA s. 5; BC PIPA s. 4; Quebec Law 25 s. 3.1, which also requires publishing the title and contact on your website).

Evidence to keep: a one-paragraph appointment note with a date, and the published contact details if you operate in Quebec or BC.

Step 2. Build the AI inventory

List every AI tool, feature and agent in use, including features inside products you already pay for. Capture name, vendor, owner, purpose, data categories, affected people, jurisdictions, decision authority, human oversight, lifecycle status, review date and (for agents) permissions. Discovery methods include a staff survey, expense-report review, SSO and admin-console logs and a browser-extension audit.

Evidence to keep: the inventory itself, dated, plus a short note on how you discovered items (so you can show the search was reasonable).

Step 3. Screen every use against prohibited practices

Before anything else, confirm no tool does something that is simply banned. The EU AI Act Art. 5 prohibitions (manipulative techniques, exploiting vulnerabilities, social scoring, emotion recognition in workplaces and schools, untargeted facial scraping and others) have applied since 2 February 2025, with nudification and synthetic CSAM prohibitions added by Regulation (EU) 2026/1744 from 2 December 2026. Texas TRAIGA (effective 1 January 2026) prohibits AI developed or deployed with intent to manipulate people into harm or to unlawfully discriminate.

Example: Harbourline Dental, a 12-person clinic in Halifax, trialled a “patient sentiment” camera feature in its waiting room. The screen flagged that this is emotion recognition in a service context that would need careful review and is prohibited outright in EU workplaces. They switched it off.

Evidence to keep: a screening record per system, even if the answer is “not applicable”.

Step 4. Classify each tool by who it affects and what it decides

Sort each inventory item into three buckets:

BucketTypical examplesWhy it matters
Internal productivity, no personal datadrafting, summarising public documents, code assistanceLowest obligations; acceptable-use policy and training
Touches personal data, no significant decisionCRM enrichment, meeting transcription, support chatPrivacy law applies (consent, purposes, safeguards, openness)
Makes or materially shapes decisions about peoplerésumé screening, credit or tenant scoring, pricing individualsHighest obligations; automated-decision rules and, in the EU, high-risk status

Employment and recruitment uses are high-risk under EU AI Act Annex III point 4, with obligations applying from 2 December 2027. Quebec Law 25 s. 12.1 requires notice for decisions based exclusively on automated processing. Colorado SB 26-189 (signed 14 May 2026) imposes ADMT notice and explanation duties for consequential decisions from 1 January 2027.

Evidence to keep: the bucket assigned to each item and a one-line rationale.

Step 5. Run a risk assessment for anything in buckets two and three

Use a simple severity × likelihood × exposure method, and treat “we don’t know” as a risk, not as safe. Quebec Law 25 s. 3.3 makes a privacy impact assessment mandatory for projects to acquire or develop an information system involving personal information, which captures most AI deployments there. GDPR Art. 35 requires a DPIA for high-risk processing such as systematic automated evaluation.

Evidence to keep: the completed assessment, residual-risk sign-off by the owner, and the date of the next review.

Step 6. Write (and publish internally) two short policies

You need an acceptable-use policy for staff using assistants, and a governance policy stating who approves new tools, how risk is assessed and how incidents are handled. Quebec Law 25 s. 3.2 requires published governance policies for personal information; BC PIPA s. 5 requires policies and a complaint process.

Evidence to keep: the policy versions with approval dates and a staff acknowledgement log.

Step 7. Do vendor due diligence before data flows

For each vendor handling your data, ask about training-data use, retention, security, incident notification, subprocessors, deletion, geography and model changes. Ask for reports, not just claims. PIPEDA Principle 4.1.3 keeps you responsible for information transferred to a third party for processing; Quebec s. 17 requires an assessment before communicating personal information outside Quebec.

Evidence to keep: the questionnaire responses, the contract or DPA, and your decision record.

Step 8. Train staff and keep the records

The EU AI Act Art. 4 (as replaced by Regulation 2026/1744) requires providers and deployers to take measures to support staff AI literacy, considering their technical knowledge and the context of use. It does not require guaranteeing any specific level for any individual, but you should be able to show what you did. Outside the EU this is simply good practice and the cheapest control you have.

Evidence to keep: the training outline, attendance or completion list, and the refresh date.

Step 9. Disclose AI where people interact with it or are assessed by it

  • Chatbots: EU AI Act Art. 50(1) (from 2 August 2026) requires people to be informed they are interacting with AI unless obvious. Utah Code 13-75-103 requires disclosure when a consumer clearly asks, with a safe harbour for systems that disclose at the outset.
  • Job postings: Ontario ESA s. 8.4 requires employers with 25 or more employees to state in publicly advertised postings that AI is used to screen, assess or select applicants (in force 1 January 2026). Illinois HB 3773 (effective 1 January 2026) requires employee notice of AI use in employment decisions. NYC Local Law 144 requires a bias audit and 10 business days’ notice for automated employment decision tools.
  • Automated decisions: Quebec Law 25 s. 12.1; GDPR Arts. 13(2)(f) and 22; Colorado SB 26-189 from 1 January 2027.

Evidence to keep: screenshots of disclosures with dates, posting templates, and a log of which postings or flows used AI.

Step 10. Check your public AI claims

The FTC enforces Section 5 against unsubstantiated AI claims (Operation AI Comply, 25 September 2024; Workado final order, 28 August 2025). If your website says “AI-powered accuracy” or “AI finds you the best rate”, you need evidence on file at the time you make the claim. The FTC’s July 2026 policy statement on AI accuracy is proposed, not final, but signals the direction.

Evidence to keep: a claim-substantiation file for each AI marketing statement and a sign-off from whoever approved the copy.

Step 11. Set up logging, incidents and a way to switch things off

Decide what each tool logs, who can read the logs, and how long you keep them. EU high-risk deployers will need to retain automatically generated logs for at least six months (Art. 26(6), from 2 December 2027), and Colorado SB 26-189 requires three-year record retention from 2027. Write a one-page incident procedure: who is told, who can suspend the tool, and how affected people are informed.

Evidence to keep: the logging configuration, the incident procedure and any incident records.

Step 12. Schedule the review

Put a quarterly date in the calendar for the owner to re-run steps 2, 4, 7 and 9 and to check regulatory changes. Key dates to track now: 2 December 2026 (EU marking grace period ends; new prohibitions), 1 January 2027 (Colorado ADMT and California CCPA ADMT requirements), 2 December 2027 (EU Annex III high-risk), 2 August 2028 (EU Annex I).

Evidence to keep: the review log with dates and what changed.

Where frameworks fit

NIST AI RMF 1.0 (released 26 January 2023) organises this work into Govern, Map, Measure and Manage. ISO/IEC 42001:2023 describes an AI management system that a third party can certify through an accredited body. Both are voluntary. Texas TRAIGA references a documented risk program such as NIST alignment as supporting a reasonable-care presumption, which is a benefit, not a compliance guarantee. If a customer asks whether you are “ISO 42001 compliant”, the honest answer until an accredited certificate exists is “aligned, not certified”.

Sources

Frequently asked

Does a 15-person company really need an AI compliance program?
It needs a proportionate one. An inventory, a short policy, a risk screen per tool and vendor checks can be done in a few days. The obligations that bite smaller firms today are mostly privacy law, employment disclosure rules and consumer-protection rules about honest AI claims.
Is there a Canadian AI law we must follow right now?
No federal AI statute is in force. Bill C-27 (which contained AIDA) died when Parliament was prorogued on 6 January 2025, and Bill C-36, introduced 15 June 2026, is a privacy bill still at an early stage. PIPEDA, Alberta and BC PIPA, Quebec Law 25 and Ontario ESA s. 8.4 are the rules that apply now.
If we use the NIST AI RMF, are we compliant?
No. The NIST AI RMF is a voluntary framework. It helps you organise governance and can support a reasonable-care argument in some US states, but it is not a certification and does not satisfy any specific statute by itself.
What is the single most important piece of evidence to keep?
A dated AI inventory that shows what tools you use, who owns them, what data they touch and whether they affect decisions about people. Almost every other control depends on it.

This guide is general information, not legal advice. Laws and dates are drawn from our verified regulatory dataset and link to official sources; check them for changes after the review date.