Cybersecurity services
Practical cybersecurity: assessments, endpoint protection, email security, training, incident readiness and 24/7 monitoring for managed-service clients.
AI Solutions
AI governance, risk and security
AI tools now touch your documents, email, customer data and business systems, often without anyone having approved them. We help you see where AI is used, set sensible rules, assess the risks of each use and test the AI applications you build or buy, so you can say yes to AI with controls you can explain to a board, an auditor or a client.
Who this service is for
A good fit if
- Staff use AI tools and you do not know which ones, or what information goes into them.
- You are rolling out Microsoft 365 Copilot or building AI assistants and need the controls right.
- A client, insurer, funder or auditor has asked how you manage AI risk.
- You build AI features into products or portals and need them tested for misuse.
- You want to align with a recognized framework such as the NIST AI Risk Management Framework or ISO/IEC 42001.
Another approach may suit you better if
- You need a legal opinion on AI regulation. We work alongside your lawyers and privacy advisers, but we do not give legal advice.
- You want a certificate. We help you prepare for an ISO/IEC 42001 audit, but certification is issued by an accredited certification body.
- You have no AI in use or planned. A short AI readiness assessment is a better first step.
What this service is
AI governance is how your organization decides which AI to use, for what, under which rules, and how it checks those rules are followed. AI security is how you protect AI tools and applications, and the data they touch, from misuse and attack. We bring the two together in practical, proportionate work that fits your size and sector.
For most organizations the first concern is not exotic AI risk. It is ordinary information escaping through ordinary tools: a contract pasted into a free chatbot, a browser extension reading every page, an assistant that answers from files the user should not see. Governance and security controls make AI safe to use at scale.
What we put in place
- Visibility. We find the AI tools in use, using the security platforms you already have, such as Microsoft Defender for Cloud Apps or your firewall and secure web gateway, alongside a no-blame staff survey. Our guide to shadow AI explains why this matters.
- Rules people can follow. A short AI use policy, an approval path for new tools and a register of approved tools and use cases. Our guide to writing an AI acceptable use policy shows what it covers.
- Risk assessment. A consistent method to assess each new AI use for privacy, security, accuracy, bias and business impact, with stronger review where decisions affect people.
- Data protection. Data loss prevention, sensitivity labels and access policies that limit what information reaches AI services, applied through your existing tools where possible.
- Accountability. Named owners, review cycles and reporting that leadership and boards can understand.
Testing AI applications
AI applications and agents introduce new attack paths. We test assistants, chat features and agents for the risks catalogued by the OWASP GenAI Security Project in its Top 10 lists for LLM and agentic applications, such as prompt injection, sensitive information disclosure and excessive agency. Tests use realistic scenarios, such as a malicious instruction hidden in an uploaded document or an attempt to retrieve another user's data. Findings come with evidence, a clear explanation of impact and a retest after fixes. This work complements our broader security assessments.
Frameworks and standards
We use recognized frameworks so your governance holds up to scrutiny. The NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1) organize AI risk work into four functions: govern, map, measure and manage. ISO/IEC 42001 specifies requirements for an AI management system and can be certified by an accredited body. We help you choose a framework, run a gap assessment and build the documents and controls it calls for. Promatics does not certify compliance.
The Canadian context
Canada does not have a federal AI-specific law in force: the proposed Artificial Intelligence and Data Act, part of Bill C-27, died when Parliament was prorogued in January 2025. Existing law still applies to AI. PIPEDA and provincial privacy laws govern personal information used to build or run AI systems, and Quebec's Law 25 requires organizations to inform people when a decision about them is based exclusively on automated processing. The Office of the Privacy Commissioner of Canada has published principles for responsible, trustworthy and privacy-protective generative AI. Since January 1, 2026, Ontario employers with 25 or more employees must say in publicly advertised job postings if they use AI to screen, assess or select applicants. Federal privacy reform introduced in June 2026 (Bill C-36), which would add transparency rules for automated decision systems, is before Parliament, and federally regulated financial institutions and public bodies face additional expectations. We design governance with these obligations in view and work alongside your legal and privacy advisers. This is general information, not legal advice; see also privacy and compliance readiness.
What is included
The exact list is agreed in writing for each project. These are the usual deliverables and the usual boundaries.
Typical deliverables
- An inventory of AI use, including tools staff use without approval and AI features inside existing software.
- An AI use policy and staff guidance, drafted for your legal and HR advisers to review.
- A register of approved AI tools and use cases, with owners and review dates.
- A risk assessment method for new AI use cases, covering privacy, security, accuracy, bias and business impact.
- Vendor due diligence on AI tools, including data use for training, retention and zero data retention options, location and security terms.
- Technical controls, such as blocking or limiting unapproved AI services, data loss prevention and access policies, using your existing security platforms where possible.
- Security testing of AI applications and agents for prompt injection, data leakage, excessive permissions and unsafe outputs.
- AI incident response steps added to your existing incident response plan.
- A gap assessment against the NIST AI Risk Management Framework or ISO/IEC 42001, if requested.
- Staff training on safe and effective AI use.
Not included unless agreed separately
- Legal advice and legal opinions on AI, privacy, employment or sector regulation.
- Certification audits, which are carried out by accredited certification bodies.
- Remediation work on systems outside the agreed scope.
- Licences for security or governance tools, which are billed separately.
What we will need from you
Most delays in this kind of work come from access and decisions, not from the technical build. Knowing these early keeps the project predictable.
- An executive sponsor and a named owner for AI governance.
- Access to security tooling, logs and configuration needed to discover AI use.
- Input from privacy, legal, HR and the business owners of AI use cases.
- Test environments and permission to test any AI applications in scope.
Delivery
How the work is delivered
Each stage ends with something you can review before the next one starts.
Discover
Identify AI use across the organization through security tooling, software inventories, interviews and a short staff survey.
Output: AI use inventory.
Assess
Review policies, data protection, vendor terms and the risks of each significant AI use, and test AI applications in scope.
Output: Risk findings and test results.
Set the rules
Draft the AI use policy, approval process, risk assessment method and register, and agree roles and responsibilities.
Output: Governance documents and register.
Apply controls
Configure technical controls, fix priority findings and add AI scenarios to incident response.
Output: Implemented controls and remediation report.
Train and review
Train staff and owners, then review the register, risks and controls on a regular cycle.
Output: Training records and review schedule.
Testing and handover
- Every approved AI tool and use case has an owner, a risk rating and a review date.
- High-risk findings are fixed or formally accepted by an accountable owner.
- Security test findings include evidence, impact and retest results.
- Policies are written in plain language that staff can follow.
- Governance documents map to the framework you chose, where one was requested.
What affects the cost
We do not publish package prices. Each estimate is based on an agreed scope, in Canadian dollars, with taxes shown separately. These are the things that move the number most:
- The size of the organization and the number of AI tools and use cases in scope.
- Whether existing security tooling can discover and control AI use.
- The number and complexity of AI applications to test.
- Framework alignment or certification preparation, if requested.
- Training needs across teams and locations.
Questions buyers usually ask
Should we just ban AI tools?
Bans rarely work. People use personal devices and accounts instead, and you lose visibility. Approving good tools, setting clear rules about information, and blocking only the riskiest services usually reduces risk more.
Which framework should we use?
The NIST AI Risk Management Framework, with its Generative AI Profile, is a practical, freely available starting point. ISO/IEC 42001 sets out requirements for an AI management system that can be certified. Many organizations start with NIST and move to ISO/IEC 42001 when clients or contracts require certification.
Is there an AI law in Canada?
There is no federal AI-specific law in force; the proposed Artificial Intelligence and Data Act did not pass, and Canada's national AI strategy, launched in June 2026, does not propose one. Privacy laws such as PIPEDA and provincial laws, including Quebec's Law 25, already apply to personal information used in AI systems, and sector regulators have their own expectations. This is general information, not legal advice.
What is prompt injection?
An attack where instructions hidden in a document, email or web page make an AI assistant or agent ignore its rules, reveal information or take unintended actions. It is one of the main risks in OWASP's Top 10 for LLM applications, and we test for it in every AI application we review.
Do you also secure the AI solutions you build?
Yes. The same controls and tests are part of our generative AI development and AI agents work from the start.
Related
Privacy and compliance readiness
Get your privacy and security practices ready for regulators, clients, auditors and insurers, with gaps found and fixed before someone asks.
Shadow AI and how to control it
Why staff use unapproved AI tools, the real risks for Canadian organizations, and how to find and control shadow AI without banning AI.
Can you show how your organization manages AI risk?
Tell us how AI is used today and who is asking the questions. We will reply to arrange a conversation and outline a governance and security review that fits your size and sector.