A briefing for leaders on AI and automation
The questions partners, owners and senior managers put to us most often, answered plainly. Read it before your next board or partners’ meeting on the subject.
Risk
What is the biggest AI risk for a firm like ours right now?
In most firms it is not a rogue algorithm. It is staff pasting client information into free AI tools on personal accounts, because nobody has told them what is allowed and the approved option is slower. The second is an AI assistant switched on across a file system where permissions have drifted for years.
Both are manageable. The first needs a clear policy and a good approved tool. The second needs a permissions review before launch.
Does AI change our cyber security exposure?
It adds new routes to the same assets. Automations use accounts and connections that need to be secured and monitored like any other. AI-written phishing is also more convincing than it used to be. Because Flowsmith is part of a managed security firm, every connection we build is reviewed as a security change, not just a convenience.
If your cyber insurance renewal has started asking about AI, KDTS offers a free cyber insurance policy review.
Privacy and confidentiality
Will our data be used to train someone else’s model?
On the business and enterprise plans of the major tools, the vendor commits not to train on your content. On free and personal plans, terms vary and often allow it. That difference is why the approved-tool list in your AI use policy names the plan and the settings, not just the product.
Where is the data stored, and does it leave Canada?
It depends on every tool the workflow touches, not just the one you log in to. Microsoft 365 stores email, files and Teams chats in Canada for tenants set up in Canada, and stores Copilot conversations there too, but Copilot’s AI processing currently happens outside Canada. Google Workspace does not offer a Canadian data region; its options are the United States or Europe.
The connectors in between matter as much as the platforms. Automation services such as Zapier, and the AI services behind many tools, mostly process data in the United States, so a workflow can move data out of Canada even when your mailbox stays here. We document where each step of each workflow stores and processes data, so you can make the residency decision knowingly and explain it to a client who asks.
How do our privacy obligations apply?
Private-sector firms in BC are generally governed by BC PIPA, and federally regulated activities and cross-border transfers can bring in PIPEDA. Both expect reasonable safeguards, limited use and openness about how personal information is handled. Your professional body may add confidentiality rules of its own. We build those obligations into the policy and the design; we do not give legal advice, and we will tell you when a question belongs with your lawyer.
AI can draft the letter. A person still signs it, and the firm is still accountable for what it says.
Your people
Our staff are worried AI will replace them. What do we say?
Be specific. The work we automate is the work nobody wants: re-keying, chasing approvals, rebuilding the same report every month. Involving the people who do that work in discovery is the best answer to the worry, and it produces better designs. Their judgment is what the firm sells; the admin around it is not.
How much training will people need?
Less for automation, because a good automation removes steps rather than adding them. More for AI assistants, where results depend on knowing what to ask and what to check. We train with your own documents and workflows, in short sessions, and start with a pilot group so the training reflects what worked.
Value
How do we measure return on investment?
Against a baseline taken before anything changes. For each workflow we agree a few measures during design: hours spent, turnaround time, errors and rework, and whether people use the new process. Thirty to ninety days after launch we report the results, including the ones that disappoint. We do not promise numbers in advance, because they depend on your processes and your people.
We already pay for Microsoft 365 or Google Workspace. Do we need more licences?
Often not at first. Google now includes Gemini in its Workspace business plans, and Microsoft 365 business plans include Power Automate and Copilot Chat; the full Microsoft 365 Copilot, which works across your own email and files, is a paid add-on. Much of the early value comes from using what you already have properly. Paid AI add-ons make sense for specific roles once a pilot shows they earn their cost. The readiness assessment tells you which situation you are in.
Getting started
Where should we start?
With a decision about ownership, then one workflow. Someone in leadership needs to own AI and automation, even if that is a small part of their role. Then pick one process that costs senior time every week and has a clear owner. If you are unsure which, or how exposed you are today, start with a readiness assessment.
Can we switch it all off if it does not work out?
Yes. Everything we build runs in your accounts, is documented, and has an off switch. If you stop working with us, the documentation is written so another competent provider could take over.
Have a question that is not here?
Send it to us. We will answer it directly, and tell you honestly if the answer is that you do not need us yet.