What Vancouver's AI Readiness Report Actually Tells Compliance Teams

Vancouver's city administration flagged 14 departments as lacking a documented data residency policy for AI tools already in use, according to an internal readiness assessment summarized in a June 2026 staff report. That number matters beyond city hall. It is a clean snapshot of what happens when procurement moves faster than governance, and it is a pattern compliance teams at private Canadian organizations will recognize immediately. The report does not tell every reader whether the tool on an employee's desktop right now creates a compliance problem nobody has named yet. It does show what the audit trail looks like once someone finally asks.

The gap between adoption and governance

The staff report, prepared for Vancouver's IT governance committee, found that AI tools — mostly commercial chat assistants and a handful of document-summarization plugins — had been adopted informally across departments including permitting, parks, and communications, well ahead of any formal risk assessment. Fourteen of the audited departments had no record of a data processing agreement covering the tools staff used day to day. Three had no inventory of which AI tools were in use at all.

This is not a Vancouver-specific failure. It is the default condition for most organizations that let staff sign up for consumer AI accounts with a work email, then discover months later that a redlined contract, a client file, or an HR complaint passed through a server nobody vetted. The difference is that Vancouver produced a document about it, and that document is now public enough to be instructive.

The report's authors were blunt about the mechanism. Staff didn't choose vendors through procurement, they said — they chose them the way anyone chooses a free tool, by searching, signing up, and pasting in whatever needed pasting. That sentence is worth repeating to a compliance committee, because it describes exactly how shadow IT becomes a privacy incident.

What the report doesn't spell out, and what any compliance officer reading it should sit with, is the cost of fixing this after the fact rather than before. Retiring a tool three departments have quietly built workflows around is not a policy memo; it is a change-management project. Someone has to identify every file that passed through the unvetted tool, determine whether any of it was personal information subject to notification obligations, migrate active work to an approved replacement, and retrain staff who had gotten comfortable with the old habit. None of that shows up in a readiness score. It shows up months later as a line item nobody budgeted for, and it is almost always more expensive than the vendor risk assessment that would have caught the problem in week one.

What compliance teams should actually check

The Vancouver assessment maps onto four questions any Canadian compliance team can ask of its own AI footprint without commissioning a formal audit.

• Where is the data processed, and does the vendor's documentation say so plainly, or only in general marketing language.
• Is there a signed data processing agreement addressing cross-border transfer, and has anyone actually read it against PIPEDA's accountability principle or, for Quebec entities, Law 25?
• Does the vendor use customer inputs to train its models, and is that answered in writing rather than assumed?
• Who inside the organization knows which AI tools are in active use, and is that list current?

None of these require exotic expertise. They require someone with authority to ask a vendor for documentation, and the patience to read it. Most organizations skip this step because the tools in question arrived free, informally, and without a procurement cycle attached — the exact pattern Vancouver's report describes.

A skeptical reader might point out that an inventory exercise sounds simple on paper and rarely is in practice. Browser extensions, mobile apps installed on personal devices used for work, and free tiers signed up for with a personal email rather than a corporate one all evade the kind of asset-management tooling most IT departments rely on. Vancouver's own report acknowledges this indirectly: three departments couldn't produce an inventory at all, not because nobody tried, but because the tools in question left no trace in any system IT already monitored. A compliance team that wants a real inventory, not an aspirational one, typically has to survey staff directly and accept that the first answer will undercount.

The Canadian AI angle procurement teams keep missing

Where this becomes a genuinely Canadian story, rather than a generic IT-governance one, is jurisdiction. Most of the tools flagged in Vancouver's informal adoption wave are American products — built by US companies, subject to US corporate ownership, and reachable under US legal process regardless of where the Canadian customer sits. That exposure is what the CLOUD Act debate has been about since 2018.

A handful of Canadian AI vendors have started marketing against that gap, positioning data residency and Canadian jurisdiction as a differentiator rather than an afterthought. Augure is one of them. The company stores customer data in Canada and runs inference on Canadian infrastructure, with vetted EU partners under zero-data-retention agreements handling certain model tiers and serving as failover — never routed to US-based providers for inference or customer content. Augure has no US corporate parent and no US investors, according to the company, which means customer conversations and documents aren't handled by providers subject to US jurisdiction the way a subsidiary of an American cloud company would be. That's a narrower, more defensible claim than an unqualified "not subject to the CLOUD Act," and it's the one worth pressure-testing against any vendor's actual sub-processor list rather than its homepage copy.

"Staff didn't choose vendors through procurement — they chose them the way anyone chooses a free tool, by searching, signing up, and pasting in whatever needed pasting."

That line from the staff report is the whole problem in one sentence, and it is a fair part of why "sovereign Canadian AI" has become a procurement category rather than a slogan over the past two years. The Office of the Privacy Commissioner of Canada has published guidance on cross-border data flows and accountability under PIPEDA that makes a vendor's location, and the transparency of its sub-processor arrangements, a live compliance question rather than background detail.

There is a version of this story where jurisdiction turns out not to be the deciding factor at all. A compliance team can run every check on the list above, land on a vendor with clean Canadian residency and full sub-processor disclosure, and still get burned by something the checklist never asked about — an over-broad internal access policy, a support team that can read customer conversations without an audit log, a breach notification clause that gives the vendor 30 days when the organization's own obligations under provincial law run shorter. Residency answers one question. It does not answer whether the vendor's staff can read the data once it's there, or whether the contract actually obligates them to tell a customer promptly when something goes wrong.

Quebec's Law 25 raises the bar further

For any organization with Quebec operations or Quebec residents' personal information in scope, the bar sits higher than PIPEDA alone. Law 25 requires a documented privacy impact assessment before personal information is transferred outside Quebec, according to guidance from the Commission d'accès à l'information, and that assessment has to account for where processing actually happens, not just where the vendor is headquartered. A vendor that says "we're Canadian" without disclosing that a portion of inference runs through EU partners, or that payment processing touches US card networks, isn't giving a compliance team what it needs to finish that assessment.

Augure's documentation discloses EU inference for certain model tiers and during failover, along with limited US processing tied to payment card networks and email delivery — the kind of specificity a Law 25 transfer assessment needs, as opposed to a one-line residency guarantee that collapses under scrutiny. Whether that level of disclosure becomes standard across the Canadian AI vendor market, or stays a differentiator for the few companies willing to publish it, is not yet settled.

Quebec's transfer assessment requirement also does not disappear because a vendor is headquartered in Canada. Organizations sometimes read Law 25's cross-border language as a rule about foreign vendors and assume a domestic one is automatically exempt. It isn't. The obligation attaches to the transfer itself, not to the vendor's country of incorporation, which means a Canadian company whose infrastructure touches the EU for any portion of processing still needs to be named, specifically, in the assessment — a detail that gets lost when procurement treats "Canadian vendor" as a checkbox rather than a starting point for the actual analysis.

What the report leaves unresolved

Vancouver's staff report recommends a formal AI procurement policy, a departmental inventory requirement, and mandatory vendor risk assessments before any new AI tool is approved. It does not name replacement vendors, and city officials haven't said publicly whether existing informal tools will be phased out or grandfathered once a new framework exists. That decision sits with council, and as of this writing no vote has been scheduled.

The larger pattern outlasts the report. A municipal government spent months discovering, department by department, what many private-sector compliance teams haven't checked at all: which AI tools staff actually use, where those tools send data, and whether anyone signed anything that says so. Fourteen departments without a documented residency policy is specific enough to check and unglamorous enough to believe. It is also, almost certainly, an undercount of what a similar audit would find inside a mid-sized Canadian company that has never run one.

Organizations weighing that same question for their own AI stack can find Augure's data handling and compliance documentation at augureai.ca.