Do We Have an AI Policy?
- Toby Nwabuogor
- May 10
- 5 min read
Receipts Over Rhetoric in Municipal AI Governance
At some point, the question lands.
It might come from council. It might come from a CAO. It might come from procurement, privacy, legal, or communications. Sometimes it comes from a journalist on a tight deadline. Sometimes from a resident after an AI or Privacy incident when the story is already moving faster than the facts.
The question is simple:
Do we have an AI policy?
And if the answer is yes:
Where is it? What is in it?
That is where many organizations discover the real problem.
Not a lack of principles. Not a lack of frameworks. Not a lack of discussion.
A lack of retraceable evidence.
Someone starts searching inboxes. Someone opens an old SharePoint folder. Someone vaguely remembers a draft. Someone references a vendor clause that never became operational policy.
The evidence exists in fragments, if it exists at all.
That gap is what led us to build Got AI Policy.
A Canadian, evidence-first registry of municipal AI governance artifacts designed to answer a simple but increasingly important question:
Can your organization show its AI governance work?
The problem is not theory. It is pressure.
Municipal AI governance rarely fails in workshops or strategy sessions.
It fails under pressure.
A vendor proposes an AI-enabled feature and wants a fast answer.
Council asks whether staff are using AI tools internally.
A resident files a FOIP request.
A privacy concern surfaces.
A journalist asks whether governance exists before publishing a story.
That is when governance becomes real.
Not when principles are written. When evidence is needed.
And when you go looking across Canada, you find a familiar pattern:
Press releases
Dead links
Generic statements
Vendor marketing
References to “ongoing work”
What you rarely find is a consistent, reviewable trail another person can inspect and verify.
That matters because governance is not a vibe.
It is an audit trail you can stand behind.
What Got AI Policy actually is
Got AI Policy is a public, evidence-first registry of AI governance artifacts across Canadian municipalities and related public-serving organizations.
The goal is simple. Help organizations move from: “We think we have something” to “Here is the source, the status, the review date, and the evidence.”
The platform records:
public AI policies
directives
council references
governance artifacts
review status
source links
evidence trails
Everything is built around one design constraint:
Receipts over rhetoric.
If a municipality is listed as having a policy, there should be evidence another person can review themselves.
A source URL. A document. A review date. A trail someone else can retrace.
Because in governance work, trust comes from inspectability not confidence.
Why we built this
This project grew out of years of practical AI governance work through CivicPlay.ai alongside municipalities, nonprofits, recreation organizations, and community-serving teams across Canada.
Again and again, I kept seeing the same operational problem:
Teams were not trying to invent governance from scratch.
They were trying to:
move quickly
reduce risk
benchmark peers
answer leadership questions
support procurement decisions
document responsible use
survive scrutiny
But the evidence was scattered.
And when the timeline becomes urgent, scattered evidence becomes organizational risk.
That is the gap this platform is designed to reduce.
What it is — and what it is not
It is:
A public registry of Canadian municipal AI governance evidence
A practical workflow for policy discovery, verification, monitoring, and comparison
A way to benchmark peer organizations using Canadian precedents
A system designed around traceable source links and reviewable evidence
A shared reference point for municipalities, consultants, procurement teams, and governance practitioners
It is not:
Legal advice
Procurement advice
Privacy advice
A replacement for internal review or human judgment
A “magic AI policy generator”
A guarantee of compliance or organizational readiness
The source links are the authority.
Everything else should be treated as supporting interpretation.
Why this matters now
AI adoption inside municipalities is already happening. Often quietly.
Staff are experimenting with tools for:
drafting communications
summarizing documents
generating reports
brainstorming policies
supporting procurement workflows
analyzing information faster
The issue is not whether AI is being used.
The issue is whether organizations have:
governance
oversight
documentation
review processes
clear accountability
Because public trust does not disappear gradually. It disappears quickly when organizations cannot explain their decisions.
The thesis
Most organizations do not need to invent AI governance from zero.
They need:
examples
comparables
reviewable evidence
operational workflows
defensible starting points
Most practitioners innovate by remixing, not by starting from scratch.
That is how governance work actually moves forward under real constraints.
The goal of Got AI Policy is to make that process faster, clearer, and easier to defend.
Registry + AI + Community
The long-term vision is simple:
A shared Canadian evidence base where municipalities can:
learn from one another
compare governance approaches
identify gaps
improve policies faster
reduce duplicated effort
No municipality should have to rebuild governance from zero every time this question resurfaces.
What you can do on the platform
The public experience is intentionally simple.
You can:
search municipalities
inspect source links
compare jurisdictions
review policy documents
benchmark peers
track governance status
export findings
monitor changes over time
Start here:
Each municipality is assigned a public-facing status based on available evidence:
Has policy (published)
In progress
No policy found
Unknown / not yet reviewed
Importantly:
“No policy found” does not mean no internal work exists. It means no sufficiently verifiable public evidence was identified at the time of review.
Why “source-first” matters
One of the most important design decisions was keeping the platform source-first.
AI summaries can help.
Comparisons can help.
Structured reviews can help.
But the source link remains the authority.
That is intentional.
Because governance systems become dangerous when commentary becomes mistaken for evidence.
Every AI-assisted feature on the platform is designed around the same principle:
AI drafts. Humans decide.
What “procurement-grade” actually means
“Procurement-grade” does not mean flashy. It means defensible.
When questions become sharp, organizations need:
source links
statuses
review dates
traceable evidence
documented reasoning
That is what survives:
council scrutiny
procurement review
privacy concerns
public controversy
access-to-information requests
Good intentions are not enough. Organizations need to be able to show their work.
Building this in public
I did not originally plan to build this publicly.
Governance work attracts scrutiny quickly:
procurement questions
legal questions
privacy questions
methodology questions
But building publicly became part of the point. Trust at scale is built through repeated, inspectable touchpoints. Not polished announcements.
So the platform includes:
methodology documentation
governance disclosures
AI-use disclosures
changelogs
verification workflows
correction mechanisms
Because trust should be inspectable too.
“Anya” and transparent AI use
On the platform, “Anya” is the name used for certain AI-assisted features and updates.
The name comes from the Igbo word connected to “seeing” or “observation,” reflecting both our Nigerian-Canadian background and the role the system plays in surfacing governance evidence.
Anya is not a replacement for human review.
AI is used to:
surface candidate documents
summarize public artifacts
identify patterns
support structured comparisons
But outputs remain:
AI-assisted
reviewable
potentially imperfect
secondary to source evidence
The registry remains source-first by design.
Who this is for
Got AI Policy is built for people inside organizations trying to do responsible work under real-world constraints.
That includes:
municipal staff
procurement teams
privacy professionals
legal reviewers
governance leads
consultants
auditors
association leaders
Especially the people being asked difficult questions with limited time and limited leverage. Because the real prize is not “innovation theatre.” The real prize is being able to answer difficult questions with calm confidence.
The larger goal
The next phase of AI governance will not be decided by who makes the boldest promises.
It will be decided by who can:
show evidence
explain decisions
maintain trust
survive scrutiny
document responsible practice
That is what this project is trying to support.
Not hype. Not fear. Operational trust.
If you want to explore further
Receipts over rhetoric.
Comments