And ‘broader use does not consistently come with stronger policies and oversight’
Few Canadian businesses check how artificial intelligence (AI) vendors use their data, even as staff at many firms feed confidential information into the tools – and half have no written AI policy.
The State of AI 2026 report from Prelia Canada LLP, published Oct. 5, found just 23% of respondents consider whether AI vendors use their data to train or improve models. Only 27% consider contract terms when reviewing a tool, and 10% weigh liability, indemnities or warranties.
For HR leaders, that means employee and client data may be entering unvetted tools.
How do employers vet AI vendors?
Data handling tops the review criteria: 26% consider where data is held and who processes it, and 26% look at confidentiality commitments. Fewer check whether data is deleted or returned (18%).
Formal processes are rarer still. Only 4% of organizations with broad or embedded AI use report a vendor review process.
Advisers see similar exposure. Sonya King, management consulting director at RSM Canada, says in the firm's 2026 AI survey that new tools widen third-party risk through vendor integrations and create "shadow AI usage that often sits outside existing security controls entirely."
Prelia advises businesses to match contract terms to each tool's intended use and data access – which matters when something goes wrong, as HRD Canada found examining who answers for it when workplace AI chatbots get it wrong.
What do employees share with AI tools?
That data is often sensitive. Prelia found 41% of respondents say employees share at least one of five tracked information types with AI tools, including confidential business information (27%), client information (20%) and employee information (10%).
Much of it happens without guardrails. Where such sharing occurs, 46% report no clear information-sharing rules, and 32% use only free or individually paid tools rather than enterprise accounts.
Cybernews research from August 2025 found 59% of U.S. employees use unapproved AI tools, known as shadow AI. "Shadow AI thrives in silence," says Žilvinas Girėnas, head of product at nexos.ai.
AI policies lag behind use
Those gaps reflect a broader policy shortfall. The report found 50% of respondents have no written AI policy, and 31% have none of the safeguards on its governance checklist. Among broad or embedded AI users, 40% lack one.
"Broader use, however, does not consistently come with stronger policies and oversight," the report states. Yet 61% of those without a written policy say their safeguards keep pace with employee use – confidence that comes four months after the federal government released its national AI strategy putting workforce transformation at the centre.
Employees, meanwhile, are often unclear on the rules. A KPMG in Canada survey from August 2025 found just 29% say their employer has a comprehensive AI policy, while 40% do not know what AI controls exist. Megan Jones, a partner in the people and change practice at KPMG in Canada, says many employees feel overwhelmed and underprepared. "If this continues, organizations risk losing the productivity gains AI is meant to provide," she says.
Closing those gaps comes next. Prelia's respondents ranked an AI policy and employee training as top governance priorities for the coming year, consistent with the view that AI adoption stalls without a culture-first HR strategy.
The survey drew 121 non-random responses from Prelia's client and professional network between Aug. 3 and Sept. 14, 2026.
