Vancouver businesses urged to set clear rules as AI use grows in everyday work

The Story

AI is moving from experimental use into everyday work for Canadian businesses, and guidance says companies need guardrails in place before rolling the tools out more broadly.

In Statistics Canada’s second-quarter 2026 survey, 19.2% of businesses reported that AI had formed part of their operations during the previous year, rising from 12.2% in 2025 and 6.1% in 2024. The survey data also indicate that businesses most often used AI to analyze data or text, alongside chatbots and other virtual agents.

The guidance notes that employees may already use AI for tasks such as drafting documents, summarizing meetings, searching internal information, analyzing spreadsheets and preparing first versions of routine work. For teams using Microsoft 365, it says those uses can be integrated into existing routines, but AI use across a company still requires clear rules around access, information and human oversight.

Microsoft Copilot is described as operating within existing permissions and access controls, meaning users can retrieve content they are already authorized to access. The guidance cautions that permissions left over from earlier periods can create problems, such as overshared folders, former project members retaining access and sensitive files being stored in the wrong place.

It adds that businesses preparing for wider deployment may use Microsoft Copilot managed services to help review permissions, determine which teams should use Copilot first and set rules for handling sensitive information. The guidance also says staff need clear direction on what information can be entered into AI tools and when outputs require review.

Security and privacy concerns are also cited as barriers to adoption. Statistics Canada reported that 13.4% of businesses saw cybersecurity or privacy concerns as a barrier to using AI in 2026, while cost was cited by 10.6%. The guidance points to measures such as multi-factor authentication, maintaining current user accounts, using sensible sharing permissions and removing access promptly when roles change.

The guidance further says smaller organizations may need to clearly assign ownership for approving new tools, reviewing permissions and responding to sensitive data risks, particularly when responsibilities for IT, security and compliance overlap. It also emphasizes that staff training matters, noting that employees may not need to become AI specialists but do need role-specific instructions on approved tools, confidential information, fact-checking and when decisions cannot be handed to software without human review.

Finally, the guidance recommends that rules be straightforward and cover which tools are approved, what data is off limits, who can authorize integrations, how AI output should be checked, and where staff should report problems. It also highlights that permissions should be reviewed before broad rollouts, including access through shared folders and collaboration spaces, because if a person can access a file, an AI assistant may be able to surface it too.