AI for Federal Crown Corporations in Canada

When Crown corporations call us

Crown corporations sit between two worlds. They run commercial or operational mandates, and they answer to Parliament through a minister. AI questions reflect both. Typical situations:

• The board asked for an AI position. Directors want to know where AI fits, what it costs and how risk will be governed.
• Staff use generative AI tools on their own. The privacy and ATIP offices want an approved list and a policy.
• A commercial team wants AI in customer service or claims. The corporation needs to know which federal rules apply and which do not.
• An enterprise vendor has bundled AI into a renewal. Procurement wants an independent read on data location and exit terms.
• The corporate plan mentions AI. The strategy office needs a roadmap with costs and owners.

What we automate for Crown corporations

Customer and stakeholder correspondence. AI sorts incoming email and letters, tags the topic and drafts a reply from approved content. An employee checks and sends.

Contract and document review. AI extracts key terms, dates and obligations from contracts, leases and agreements into a register. Legal and procurement staff review each extraction. See document processing.

Reporting for the board and the minister. AI drafts first versions of quarterly reports and briefing notes from source data and past reports. The owner of each section edits and signs off.

Internal knowledge search. Employees ask questions of policies, procedures and past decisions and get answers that cite the source. Access follows existing permissions.

Operational analytics. AI helps analysts find patterns in service, maintenance or claims data. Analysts validate the findings before they reach a decision.

Federal rules that shape Crown corporation AI

Directive on Automated Decision-Making: check the scope. The Directive applies to institutions subject to the Policy on Service and Digital. That Policy applies to "departments as defined in section 2 of the Financial Administration Act". Section 2 counts departmental corporations (Schedule II) as departments. Section 83 defines a Crown corporation as "a parent Crown corporation or a wholly-owned subsidiary", a separate category. For most Crown corporations the Directive is a reference, and your legal team confirms the position.

Privacy Act. Parent Crown corporations and their wholly-owned subsidiaries are "government institutions" under the Act. Collection must relate directly to an operating program or activity. Use is limited to the original purpose or a consistent use, unless the person consents. Each AI use case gets a purpose check early.

Access to Information Act. The same definition applies, so records under the corporation's control are open to requests, subject to exemptions. The Act also contains corporation-specific exclusions; section 68.1, for example, excludes CBC journalistic, creative and programming information. AI logs and outputs need a retention rule.

Official Languages Act. Crown corporations established by or under an Act of Parliament are federal institutions under the Act. Section 22 sets the duty to serve the public in either official language, so public-facing AI output is planned in both.

Data location. Azure OpenAI Standard deployments process prompts in the chosen geography; in Canada that is Canada East for a short list of models. Vendor selection and the compliance review test each option against your data classification.

Which package fits

Most Crown corporations start with the AI Opportunity Audit, because the board needs ranked options and a governance outline together. The output feeds an AI roadmap and, where the board wants it, an executive briefing.

Full scope of each package is on the pricing page.

How the work runs

The engagement follows the Remolda Cycle: Audit → Strategy → Implement → Empower → Evolve.

1. Audit. Interviews with 6–10 people: the executive sponsor, operations leads, IT, legal, privacy and ATIP. We review process maps, current tools and relevant policies.
2. Strategy. Use cases ranked by value, effort and risk, with the Privacy Act purpose check and a note on whether the AIA would be a useful voluntary step.
3. Implement. A six-week pilot on one internal workflow, with test data or data cleared by privacy and security.
4. Empower. A short session for the executive team and a staff AI use policy.
5. Evolve. Results reviewed with the sponsor and the next use case planned.

In our experience the audit is two weeks of work and calendar time is usually longer. It depends on executive and board schedules and on document clearance.