AI Governance Workshop Recap from Salon Connexion d'affaires de Gatineau
In Quebec, despite $1.2 billion in public AI investments, only 12.7% of businesses actually use it in production. This disparity reveals a fundamental problem: the issue isn't technology. It's the absence of a framework. At the February 19 conference in Gatineau, Rosecape presented a structured four-pillar approach to governing AI in SMEs.
The Quebec paradox
Quebec has a world-renowned AI research ecosystem, with over $1.5 billion in dedicated private venture capital. Yet 73% of Quebec businesses perceive no concrete operational need, and 20% cite uncertainty about return on investment as the main barrier.
This gap is not a technological failure, but rather an absence of appropriate governance.
Governing AI: a clear definition
Contrary to popular belief, AI governance doesn't mean slowing innovation with committees or bureaucracy. Rather, it means establishing:
- A clear integration strategy
- Simple rules understood by everyone
- Visibility over data usage
This structure makes the difference between the 5% of successful projects and the 95% that fail.
Pillar 1: Strategy
Key question: What business problem am I solving?
According to the data presented, 95% of generative AI pilot projects fail due to lack of measurable financial impact. The most frequent reason remains the absence of a clearly defined business problem at the outset.
Winning approach
- Target a specific business pain point
- Run a four-week pilot with measurable indicators
- Involve teams from day one
- Start with the need, never with the technology
Concrete use cases
- Internal assistant querying your private documents
- Automated invoice approval process
- Augmented dashboards generating their own reports
- Custom tools adapted to specific challenges
Pillar 2: Data
Key question: Is my data ready?
A crucial concept: AI amplifies what it finds. If your data is in disarray, AI produces disarray faster.
Four fundamental questions
- Where is my data and how many silos exist?
- Is it reliable, usable and free of duplicates?
- Do I have the right to use it and is it protected?
- Who decides, who accesses and who uses it?
The SME reality
In a typical SME, customer data lives in a CRM, finances in accounting software, and operations in scattered Excel files. No system communicates with the others.
Rosecape's proposed solution: connect data without risk, clean it, contextualize it, then activate intelligence.
Pillar 3: Security
Key question: How do I innovate without exposure?
The employee paradox
While you're reading this, employees are probably sharing internal data with generative AI without authorization. According to Kaspersky, 67% of employees regularly share internal data with generative AI without authorization. Furthermore, 83% of organizations have no automated controls to prevent sensitive data from being shared.
Concrete risk examples
- Accountants pasting financial statements into ChatGPT
- Sales directors using free AI agents to score leads
- Employees connecting AI assistants to their professional email accounts
Recommended approach
Prohibition doesn't work -- employees will circumvent restrictions. The right approach is to govern usage:
- Make usage visible
- Establish clear rules
- Limit access to what's strictly necessary
Concrete threats
- Samsung employees who leaked industrial secrets via ChatGPT
- Malware targeting secrets stored in AI tools detected in early 2026
- Prompt injection remains an open security challenge for agents, according to OpenAI
Pillar 4: Compliance
Key question: How do I innovate while staying compliant?
While security protects your data, compliance protects your business.
Legal framework
Law 25 provides for penalties of up to $25 million or 4% of global revenue.
Five essential dimensions
- Purpose: Know why you're collecting before you start
- Consent: Obtain informed agreement on automated decisions
- Transparency: Communicate AI usage to stakeholders
- Fairness: Prevent bias and disproportionate surveillance
- Intellectual property: Control rights over generated content
A critical question often overlooked
Who owns the content generated by your AI tools? Is your data being used to train the provider's model? If your proprietary data trains a model accessible to your competitors, you have a structural problem.
Concrete actions to take this week
- Find a concrete business pain point to anchor your strategy
- Assess the state of your data and source systems
- Ask your teams which AI tools they're already using
- Review available grant and funding programs
- Prioritize sovereign Canadian providers to avoid legal risks
Conclusion
AI won't replace your business. But a business that governs its AI well could replace yours.
