Describe your situation FR

Service family

Strategy and governance

Before choosing a tool, you need to know what to do with AI, in what order, and how to govern it. These four services give leadership a written basis for decisions, from a first assessment to an organization-wide governance program.

The AI governance loop Four steps in a loop: a policy sets the rules of use; the register lists the systems, their data and their owners; a privacy impact assessment (PIA) evaluates the risks of each project; follow-up reviews, handles incidents and updates the policy. Policyrules for AI use Registersystems, data, owners PIArisks and measures, per project Follow-upreviews, incidents, updates ONGOING GOVERNANCE
Governance is not a one-time document: each step feeds the next.

AI maturity assessment and roadmap

Who it's for

Senior management and IT leads who receive AI requests from all sides and want to decide on solid ground.

Typical problem

“Everyone is talking to us about AI. Some of our staff already use ChatGPT. We don't know where to start, or what's risky.”

What we do

  • Short interviews with management, IT and two or three business teams.
  • Inventory of current AI use, including undeclared use.
  • Assessment of your data, systems and constraints: Quebec's Law 25, contracts, security.
  • Prioritization of use cases by value, feasibility and risk.

Deliverables

  • Written assessment report.
  • Phased roadmap, over a time horizon agreed with you.
  • Prioritized use cases, with the conditions for success of each.
  • Presentation to management.

Proof

The assessment grid uses the checkpoints applied in our labs, in particular L7 — Law 25 register and PIA and L2 — Enterprise AI gateway.

AI governance and Law 25 compliance

Who it's for

Organizations that already use AI, or are about to, with personal information.

Typical problem

“We have an AI tool in place. If the Commission d'accès à l'information (Quebec's access to information commission) asks us questions tomorrow, we have nothing in writing.”

What we do

  • AI use policy tailored to your organization.
  • Register of AI systems: purpose, data, vendor, hosting location, owner.
  • Privacy impact assessments (PIAs) for projects that require them.
  • Processes for automated decisions: informing the individuals concerned and review by a human.
  • Support for the person in charge of the protection of personal information.

Deliverables

  • AI use policy.
  • Register of AI systems, in a format your team can keep up to date.
  • PIAs drafted for prioritized projects.
  • Written procedures and reusable templates.

Proof

L7 — Law 25 register and PIA: we apply these templates to our own systems before offering them.

We are not a law firm. For a specific legal question, we work with your legal counsel.

Copilot and Microsoft 365 governance

Who it's for

Large enterprises, mid-size companies and public bodies on Microsoft 365 that are preparing, piloting or expanding Copilot: IT leadership, information security, Microsoft 365 owner, person in charge of the protection of personal information.

Typical problem

“Copilot is in pilot. Nobody really knows what it will find in SharePoint and Teams, and leadership wants an answer before expanding.”

What we do

  • Review of oversharing and permissions (SharePoint sites, Teams, OneDrive, links shared with everyone), read-only, with your administrators and your native tools.
  • Information classification, Microsoft Purview sensitivity labels and data loss prevention (DLP) rules adapted to Copilot.
  • Copilot use policy and admin settings, consistent with your AI policy.
  • Governance of Copilot Studio agents: inventory, permitted connectors, approval before publishing, logging.
  • Privacy impact assessment (PIA) of the rollout and adoption plan: user training, measured pilot, expansion in waves.

Deliverables

  • Readiness report (oversharing, permissions, labels) and prioritized remediation plan.
  • Documented classification scheme and DLP rules.
  • Use policy for Copilot and agents.
  • Register of Copilot Studio agents and approval process.
  • Rollout PIA and wave-based adoption plan.

Proof

L7 — Law 25 register and PIA and L2 — Enterprise AI gateway: knowing who used what, when and with which data. NB-TECH OS applies the same discipline to our own agents: an approval queue and a chained log.

We work alongside your IT leadership, your security team and your integrator: the review uses your access and your administrators, and fixes are carried out by your teams, with our support.

Enterprise AI governance program

Who it's for

Large enterprises, mid-size companies, public and para-public bodies, financial institutions: leadership, governance committee, compliance and risk, person in charge of the protection of personal information, internal audit.

Typical problem

“Every department is launching its own AI projects. The board is asking who approves them, what risks they carry and how we can show it.”

What we do

  • Setting up the AI governance committee: mandate, roles, project approval workflow.
  • Enterprise AI policy and usage standards: generative AI, agents, vendors.
  • Inventory of AI systems and a method for classifying them by risk level.
  • AI risk register and control matrix mapped to ISO/IEC 42001 and the NIST AI RMF.
  • Quebec obligations built in: Law 25 (PIAs, automated decisions), the directive on generative AI for public bodies, AMF expectations where applicable.
  • Monitoring dashboard and periodic review.

Deliverables

  • Committee charter and project approval workflow.
  • Enterprise AI policy.
  • Inventory of AI systems classified by risk level.
  • Risk register and control matrix (ISO/IEC 42001, NIST AI RMF mappings).
  • PIA and project sheet templates.
  • Governance dashboard.

Proof

L7 — Law 25 register and PIA, L2 — Enterprise AI gateway, and NB-TECH OS: autonomy levels, revocable permissions, a chained log and an emergency stop, applied to our thirteen agents.

Mapping to ISO/IEC 42001 and the NIST AI RMF structures your approach; it is neither a certification nor an attestation of compliance. We are not a law firm: the instruments are reviewed with your compliance team and your legal counsel.

Other service families

Let's talk about your situation

Every organization has its own systems, data and constraints. We always start by understanding your situation. Scope and investment are then proposed in writing.

Describe your situationSee our approach