AI Governance Workshop Recap from Salon Connexion d'affaires de Gatineau
At the February 19 conference in Gatineau, Rosecape presented a structured four-pillar approach to governing AI in SMEs. The presentation started from an observation: in Quebec, AI attracts significant public and private investment, but its use in production remains limited in businesses. What is most often missing is a framework.
The Quebec paradox
Quebec has a world-renowned AI research ecosystem. Yet many Quebec businesses perceive no concrete operational need, and uncertainty about return on investment holds others back.
This gap is not a technological failure, but rather an absence of appropriate governance.
Governing AI: a clear definition
Contrary to popular belief, AI governance doesn't mean slowing innovation with committees or bureaucracy. Rather, it means establishing:
- A clear integration strategy
- Simple rules understood by everyone
- Visibility over data usage
This structure helps a project get past the pilot stage.
Pillar 1: Strategy
Key question: What business problem am I solving?
Many generative AI pilot projects stall for lack of measurable financial impact. One reason comes up often: no business problem was clearly defined at the outset.
Winning approach
- Target a specific business pain point
- Run a four-week pilot with measurable indicators
- Involve teams from day one
- Start with the need, never with the technology
Concrete use cases
- Internal assistant querying your private documents
- Automated invoice approval process
- Augmented dashboards generating their own reports
- Custom tools adapted to specific challenges
Pillar 2: Data
Key question: Is my data ready?
A crucial concept: AI amplifies what it finds. If your data is in disarray, AI produces disarray faster.
Four fundamental questions
- Where is my data and how many silos exist?
- Is it reliable, usable and free of duplicates?
- Do I have the right to use it and is it protected?
- Who decides, who accesses and who uses it?
The SME reality
In a typical SME, customer data lives in a CRM, finances in accounting software, and operations in scattered Excel files. No system communicates with the others.
Rosecape's proposed solution: connect data without risk, clean it, contextualize it, then activate intelligence.
Pillar 3: Security
Key question: How do I innovate without exposure?
The employee paradox
While you're reading this, employees are probably sharing internal data with generative AI without authorization. Without automated controls, nothing prevents sensitive data from being shared this way.
Concrete risk examples
- Accountants pasting financial statements into ChatGPT
- Sales directors using free AI agents to score leads
- Employees connecting AI assistants to their professional email accounts
Recommended approach
Prohibition doesn't work -- employees will circumvent restrictions. The right approach is to govern usage:
- Make usage visible
- Establish clear rules
- Limit access to what's strictly necessary
Concrete threats
- Samsung employees who leaked industrial secrets via ChatGPT
- Malware targeting secrets stored in AI tools detected in early 2026
- Prompt injection remains an open security challenge for agents, according to OpenAI
Pillar 4: Compliance
Key question: How do I innovate while staying compliant?
While security protects your data, compliance protects your business.
Legal framework
Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, provides for penal fines of up to $25 million or 4% of worldwide turnover.
Five essential dimensions
- Purpose: Know why you're collecting before you start
- Consent: Obtain informed agreement on automated decisions
- Transparency: Communicate AI usage to stakeholders
- Fairness: Prevent bias and disproportionate surveillance
- Intellectual property: Control rights over generated content
A critical question often overlooked
Who owns the content generated by your AI tools? Is your data being used to train the provider's model? If your proprietary data trains a model accessible to your competitors, you have a structural problem.
Concrete actions to take this week
- Find a concrete business pain point to anchor your strategy
- Assess the state of your data and source systems
- Ask your teams which AI tools they're already using
- Review available grant and funding programs
- Prioritize sovereign Canadian providers to reduce legal risks
Conclusion
AI won't replace your business. But a business that governs its AI well could replace yours.
Have you identified a first need? We can look with you at the available data, the expected result and the conditions needed to get started. How a mandate starts →
To take stock of your governance: see our 7-dimension checklist or take the self-assessment.
Other articles
Connecting Claude or ChatGPT to your company data
The three ways to give an AI assistant your data, what leaves Canada, and the controls to require before you connect anything.
AI Governance for SMEs: 7 Dimensions to Assess Now
A 7-dimension checklist to take stock of AI governance in your SME: framing, Bill 25, sovereignty, security, risk, IP and training.
LiteLLM Supply-Chain Attack Analysis
What happened, how we responded, and what SMEs should take away from it.