Start in the back office, and write the data rules first
The safest first AI project is an internal one: invoices, reconciliations, policy checks. It is also the right place to settle which tools are approved, what data can go where, and who answers when something goes wrong.
When a business asks where to start with AI, the instinct is to point it at customers: a chatbot on the website, an assistant in the inbox. We usually suggest the opposite. Start where the work is internal, repetitive and checkable: matching invoices to purchase orders, reconciling statements, checking contracts against a policy, preparing month-end packs.
Back-office work has three properties that make it a good first project. The rules already exist on paper. Mistakes are caught by a person before they reach a customer. And the time saved is easy to count. You learn how AI behaves on your data, with your people, at low risk.
Your data is already in AI tools
The harder question is not which process to automate. It is what happens to your data while you decide. Staff are not waiting for a policy. An Okta-commissioned survey reported in May 2026 found that 52 percent of knowledge workers admit to using unapproved AI tools, and that some had shared confidential company documents and HR information with them. In PagerDuty's June 2026 survey of 1,250 office professionals at large organisations, 31 percent said they had shared financial information or confidential company documents.
Banning AI does not stop this. It moves it to personal accounts on personal phones, where you have no visibility at all. The practical answer is to give people an approved tool that does the job and clear rules for using it.
A ban does not stop staff using AI. It stops you seeing it.
The one-page data rules
An AI policy that runs to twenty pages will not be read. Start with one page that answers five questions.
Which tools are approved, and on which account type. A business plan with data-use terms you have read is not the same as a free personal account, even when the product name is the same.
What data can go in. Sort information into three classes: public, internal and restricted. Restricted covers client personal information, financial records, health information, credentials and anything under NDA. Restricted data goes only into tools approved for it, or not at all.
What must be checked before it leaves. Any AI-assisted output that goes to a client, a regulator or an executive gets a named human review.
What must be disclosed. Decide when clients and colleagues should be told AI was used, particularly where it informs a decision about them.
Who to ask, and who answers. One named owner for questions and incidents. Unclear accountability is where most governance fails.
Privacy law already applies
In Canada, personal information handled by private-sector organisations is covered by PIPEDA and, in some provinces, by provincial privacy law. None of that pauses because the processing is done by a model. Before a back-office project touches personal information, confirm where the data is processed and stored, whether the vendor may retain it or train on it, and how you would respond to an access or deletion request. Those answers belong in the project plan, not in a later review.
Ethics is a design decision
Most ethical problems with AI in a business are ordinary problems made faster: a scoring rule that disadvantages a group of customers, an automated decision nobody can explain, a person who did not know they were dealing with a machine. Settle three things at design time: where a person must make or approve the decision, how an affected person can ask for a human review, and what you will test for before launch.
- The Register, Bosses blinded by confidence about shadow AI use by workers, reporting Okta's AI Agents at Work 2026 report, 27 May 2026. theregister.com
- PagerDuty, PagerDuty Report Finds Two-Thirds (66%) of Office Professionals Have Used Unauthorized AI Tools at Work, 11 June 2026. pagerduty.com
- This article is general information, not legal advice. Confirm privacy obligations with counsel for your jurisdiction.
- —Start with internal, rule-based, checkable work: the rules exist, errors are caught in-house, and savings are countable.
- —Assume staff already use AI. Give them an approved tool rather than a ban.
- —Write one page of data rules: approved tools, data classes, review, disclosure, and a named owner.
- —Settle where data is processed, retained and trained on before a project touches personal information.