#519 AI Goverance in Ottawa

Governance · Municipal AI · PMI Standard

Why the City of Ottawa Needs Stronger AI Guardrails

15 September 2026 · peterKarwacki.blogspot.com
PPPMResponsible AIPublic sector

Peter Karwacki, PMP, is a certified Project Management Professional and a member of the Project Management Institute (PMI). This commentary applies PMI’s 2026 Standard for Artificial Intelligence in Portfolio, Program, and Project Management to the City of Ottawa’s expanding use of AI. It is written in a personal capacity and is not an official PMI or City of Ottawa position.

Ottawa is no longer experimenting with artificial intelligence at the margins. Thousands of city staff already use generative tools every day. Resume screening, asset mapping, homelessness-risk models, permitting pre-checks, and police investigative tools are moving from pilot to production. Productivity is real. So is the public-trust risk. The city’s existing staff guide is a start. It is not yet a full set of guardrails.

This post argues that Ottawa should treat AI as a portfolio of public projects — not a collection of helpful apps — and should adopt the kind of principle-driven, human-in-the-loop governance set out in PMI’s 2026 AI standard. That standard was written for exactly this moment: AI is being deployed through projects faster than regulation can keep up.^[1]

What Ottawa is already doing

By late 2025, more than 3,200 city employees were using Microsoft Copilot. In one 30-day window they submitted more than 114,000 prompts. Staff described the tool as a way to find information and draft communications — work that, for many office roles, is most of the job.^[2]

At the same time, the city disclosed or advanced several higher-stakes uses:

• Hiring. AI-assisted resume screening for high-volume postings (including SAP Joule), where a single competition can attract hundreds of applicants.^[3]
• Geospatial work. Mobile mapping and machine learning to inventory signs, poles, and other assets.^[2]
• Social policy. A model, developed with Carleton University, that uses shelter and demographic data to help predict risk of chronic homelessness.^[4]
• Planning and housing. An AI PreCheck pilot for low-rise residential permits, checking completeness and comparing drawings to zoning and building-code rules.^[5]
• Digital twin / planning support. Scenario tools and an AI chatbot to help staff apply the new zoning bylaw.^[6]
• Policing. The Ottawa Police Service has been developing a dedicated AI policy covering facial recognition, transcription, and related tools, with explicit attention to Charter rights, privacy, and bias.^[7]

City Manager Wendy Stephanson told councillors the corporation was writing a broader responsible-use framework, expected in early 2026, to sit above the existing Responsible use of Generative Artificial Intelligence (GenAI) – Guide. That guide already names approved tools (Copilot Web), requires requests for non-standard tools, and sets staff principles around data security, accountability, transparency, and equity.^[8]

The gap is not “Ottawa has no rules.” The gap is that a staff-facing GenAI guide plus a forthcoming corporate framework still leave high-impact systems — hiring, homelessness prediction, permitting, policing — without a published, life-cycle, project-level control model that residents can see and that managers can audit.

Why guardrails matter now, not later

Municipal AI is not a lab demo. It touches who gets a job interview, who is flagged as at risk of homelessness, how fast a housing application moves, and how police generate investigative leads. PMI’s standard is blunt about the failure modes that follow when organizations skip governance:

• bias and discriminatory outcomes from training data and model design;
• hallucinations and confident-but-wrong outputs;
• privacy and consent failures when personal data is reused;
• black-box decisions that people cannot contest;
• diffused accountability (“the model did it”);
• intellectual-property and records-management exposure;
• loss of public trust when systems affect rights.

Those risks are not theoretical in Ottawa. Resume screening can encode historical hiring bias. Homelessness models use sensitive attributes (age, Indigenous identity, family status, prior service refusals). Permitting tools can quietly change who gets through the queue. Police facial recognition sits at the intersection of Charter rights and public safety. A staff guide that says “verify the output” is necessary. It is not sufficient when the output already shapes a human decision.

Ontario’s Information and Privacy Commissioner and Human Rights Commission have jointly published principles for responsible public-sector AI precisely because privacy and equality rights travel with these systems.^[9] The federal public service now has its own 2025–2027 AI strategy, built around being “ready” and “responsible.”^[10] Cities that wait for perfect national legislation will still be operating the tools.

What PMI means by “guardrails”

PMI does not use the marketing word “guardrails” as a slogan. It supplies eight principles and five performance domains that function as guardrails for any organization running AI as work. The standard is technology-agnostic, human-centred, and written for portfolio, program, and project managers — which is how a city actually delivers AI: as initiatives with sponsors, budgets, vendors, risks, and close-out.^[11]

The eight principles, applied to a city

PMI principle	What it requires	Ottawa example if it is missing
Strategic value	Every AI initiative must map to a public outcome, not a vendor demo.	Copilot usage volume is reported; resident-facing value is not.
Risk	Treat AI-specific threats (bias, drift, hallucination, over-automation) and keep a human in the loop.	Resume ranking or homelessness scoring without documented override rules.
Governance and compliance	Clear owners, escalation paths, audits, and alignment with MFIPPA, human-rights law, and procurement.	A staff guide without an inventory of systems or an impact-assessment gate.
People and culture	Literacy, change management, and no “shadow AI.”	114,000 prompts with uneven training and no public skills plan.
Ethics and professional responsibility	Fairness, transparency, explainability, and an ethics oversight body.	No published municipal ethics committee for AI comparable to PMI’s model.
Stakeholder engagement	Residents, unions, equity offices, and affected clients are in the loop before deployment.	Homelessness model consultations promised; public register still thin.
Optimization and innovation	Iterate, measure, retire tools that fail.	Pilots that persist because they are already “in the stack.”
Data quality	Lineage, representativeness, purpose limitation, and integrity.	Shelter and HR data reused for prediction without a published data card.

Source: author’s synthesis of PMI, The Standard for Artificial Intelligence in Portfolio, Program, and Project Management (2026), Principles section.^[12]

Human-in-the-loop is the non-negotiable control

PMI treats human-in-the-loop (HITL) as both a safety control and a source of value. Machines can generate options at scale. They cannot carry legal accountability, read political context, or weigh competing public values. The standard expects defined intervention triggers, escalation protocols, trained reviewers, and feedback loops — not a vague instruction to “use your judgment.” For a city, that means:

• no automated hiring rejection without a documented human decision;
• no homelessness-risk score used as a service gate without caseworker review;
• no permit “fail” that cannot be explained with a cited bylaw clause;
• no police lead generated by a model that investigators cannot audit.

An ethics oversight committee, not just a PDF

Section 7 of the PMI standard is unusually practical for a municipal reader. It calls for a multidisciplinary AI ethics oversight committee — legal, privacy, equity, operations, PPPM, and community representation — with authority to set boundaries, review vendors, demand audits, and stop a deployment. That is different from asking every employee to be their own ethics officer after they have already pasted text into Copilot.

The same section lists the ethical failure modes cities actually hit: bias and misinformation, discriminatory decision-making, unclear accountability, opacity, weak data security, hallucinations, consent failures, untraceable data sources, and intellectual-property exposure. Ottawa’s GenAI guide already flags several of these. PMI’s contribution is to put them inside a project life cycle with named owners.

Comparative chart: Ottawa versus peer cities

Most large cities are in the same awkward middle: lots of projects, thinner public governance. A minority published standalone strategies years ago. Ottawa is closer to Toronto (staff guidance plus a building policy) than to Amsterdam or Barcelona (public principles plus registers and rights language).

City	Public AI strategy / policy	Staff GenAI guide	Algorithm register / AIA	Independent or multi-stakeholder ethics body	High-stakes use cases in play
Ottawa	Corporate framework announced for early 2026; not a long-standing public strategy	Yes (2025 GenAI Guide; Copilot approved)	Not published as a resident-facing inventory	Not published city-wide	Hiring, Copilot at scale, mapping, homelessness model, permitting AI, police AI policy
Toronto	In-house AI policy work in 2025; Digital Infrastructure Strategic Framework as foundation	Yes (June 2025 GenAI guidance)	Working toward municipal algorithmic impact assessment	Police board AI policy since 2022; city-wide ethics body still evolving	Service AI plus Toronto Police Service AI governance
New York City	AI Strategy (2021) and Action Plan (2023); steering committee	Yes, plus staff training actions	Local Law 144 (AEDT) and public reporting culture	City AI Steering Committee / OTI lead	Hiring tools, service bots, agency systems
Amsterdam	Intelligence Agenda; 2024 Vision on AI (human value, education, equal access)	Yes	Pioneer of public algorithm register	Strong civic / rights framing	Municipal algorithms with public documentation
Barcelona	2021 ethical algorithms-and-data strategy; 2026 investment package to deepen it	Yes	Rights-centred model; external advisory council on AI and digital rights	Yes	Recommendation systems constrained; digital-rights brand
Montréal	Early Montréal Declaration for responsible AI (principles, not a binding ops manual)	Varies by institution	Research-heavy ecosystem (Mila)	Declaration as civic reference	Research and civic principles more visible than ops playbooks

Comparative judgments are based on publicly described instruments, not on unpublished internal controls.^[13][14][15]

Ottawa’s current guide versus a PMI-style control set

Control	Ottawa GenAI Guide (2025)	PMI AI Standard (2026) expectation
Approved tools	Copilot Web; exceptions via technology request	Tool selection criteria: alignment, integration, scale, learning curve, cost-benefit, data control
Human responsibility	Employee must verify outputs	Defined HITL triggers, roles, escalation, and audit of the HITL process itself
Equity / bias	Staff told not to amplify bias	Fairness testing, diverse teams, periodic bias reassessment, documented remediation
Privacy	Do not put non-compliant data into tools	Data-quality principle plus legal considerations (consent, MFIPPA-class rules, vendor clauses)
Transparency to the public	Internal education document	Stakeholder engagement domain; explainability; contestability of decisions that affect rights
Oversight body	Not specified in the staff guide	AI ethics oversight committee with cross-functional membership and stop-the-line authority
Life cycle	Use-time guidance	Initiation → data prep → model/tooling → deploy → monitor → optimize → decommission, tailored into PPPM phases
Business case	Implied productivity	ROI, risk, ethics, regulatory fit, and long-term sustainability before scale-up

The honest reading is that Ottawa did the first-mile work well: pick a sanctioned tool, tell staff not to paste secrets, remind them they own the output. The second mile — the one that protects residents when AI is used on them, not just by staff — is where PMI’s performance domains matter: managing stakeholder expectations, defining scope, designing for quality and reliability, executing strategic goals, and managing AI-specific risk.

A practical guardrail package for Ottawa

If the city’s 2026 framework is still being socialized, it should include the following, mapped to PMI practice rather than invented from scratch.

1. Publish an AI system inventory. Name the systems, owners, data sources, decision type (assistive vs. consequential), and whether a human can override. Amsterdam’s register is the benchmark; Toronto is moving toward impact assessment. Ottawa should not be less transparent than its peers while running more operational pilots.
2. Classify use by harm, not by vendor. Copilot drafting a memo is not the same class as ranking job applicants or scoring homelessness risk. High-impact classes require privacy impact assessments, human-rights review, and a public plain-language notice.
3. Stand up an ethics oversight committee with real authority. Include privacy, legal, People and Culture, Community and Social Services, Planning, ITS, labour, and community representation. Give it the power to pause a pilot. PMI’s committee model exists so ethics is not a sidebar comment in a steering deck.
4. Hard-code HITL for consequential decisions. Write the intervention triggers. Train the reviewers. Audit whether humans actually review, or just click “accept.”
5. Treat vendors as part of the control system. Contractual clauses on data residency, training-data use, audit rights, explainability, and liability — the legal chapter of the PMI standard is there for a reason.
6. Measure more than prompt counts. PMI asks for leading and lagging indicators: accuracy, override rates, complaint rates, disparate impact, downtime, and whether the tool still matches the original business case. 114,000 prompts is activity. It is not value and it is not safety.
7. Engage the people the models describe. Shelter users, job applicants, builders, and communities over-represented in administrative data should see the purpose, limits, and redress path before scale-up. The homelessness project’s planned consultations should be the rule, not a one-off.
8. Plan decommissioning. Models drift. Vendors change terms. A city that cannot turn a system off does not control it.

Bottom line: Ottawa should keep using AI. It should not scale hiring, social-risk, permitting, or police tools on the strength of a productivity story and a staff pamphlet. Guardrails are how a capital city proves that efficiency and rights can occupy the same sentence.

Why a project-management standard is the right instrument

City AI work is already organized as projects and programs. That is PMI’s home territory. A rights charter without delivery mechanics becomes a poster. A delivery plan without ethics becomes a procurement. The 2026 standard is useful because it forces both into the same operating system: principles, performance domains, life-cycle tailoring, and legal/ethical close-out.

It also matches how Ottawa actually works. Portfolio language helps Council prioritize which AI bets deserve scarce attention. Program language helps ITS, HR, Planning, and Community and Social Services stop running parallel pilots that share data and risk. Project language gives a manager a checklist that survives a staff rotation.

None of this requires Ottawa to wait for a federal AI Act with municipal teeth. The tools are already in the building. The public already has a reasonable question: when the city uses a model to sort people or speed a legal decision, who is accountable, how do we see it, and how do we contest it?

That is what guardrails are for.

References

1. Project Management Institute. “PMI Publishes World’s First Global Standard for AI in Project Work.” Press release, 2026. pmi.org.
2. White-Crummey, Arthur. “City working on AI projects to speed up hiring, mapping and office work.” CBC News, 2 December 2025. cbc.ca.
3. Dodd, Anna. “City of Ottawa is making use of AI tools like Microsoft Copilot, SAP Joule.” CompassNews, 4 December 2025. compassnews.ca.
4. Karadeglija, Anja. “Ottawa becomes the latest city to turn to AI to help it predict chronic homelessness.” The Globe and Mail, 4 August 2024. theglobeandmail.com.
5. Archistar. “City of Ottawa Launches AI PreCheck Pilot to Accelerate Permitting.” 1 June 2026. archistar.ai.
6. What Works Cities. “Ottawa, Canada.” whatworkscities.bloomberg.org.
7. “AI is coming to the Ottawa police. Here’s how they’ll use the new tech.” Ottawa Citizen, 29 March 2026. ottawacitizen.com.
8. City of Ottawa. Responsible use of Generative Artificial Intelligence (GenAI) – Guide. 2025. PDF via AMCTO.
9. Ontario Human Rights Commission and Information and Privacy Commissioner of Ontario. Principles for the Responsible Use of Artificial Intelligence. ohrc.on.ca.
10. Government of Canada. AI Strategy for the Federal Public Service 2025–2027. canada.ca.
11. Walch, Kathleen. “The New AI Standard: A Shared Foundation for Responsible Adoption.” PMI Blog, 14 July 2026. pmi.org/blog.
12. Project Management Institute. The Standard for Artificial Intelligence in Portfolio, Program, and Project Management. PMI, 2026. ISBN 978-1-62825-891-2. Principles, performance domains, human-in-the-loop guidance, and ethics oversight summarized from the published standard.
13. Vidal D’oleo, Alexandra. “Case studies of urban AI governance frameworks.” CIDOB, 2024. cidob.org.
14. The GovLab. “AI Localism in Action: Six Local Approaches to Governing AI.” blog.thegovlab.org.
15. City of Toronto. Guidance for the Responsible Use of Generative Artificial Intelligence, 18 June 2025. toronto.ca PDF.

Peter Karwacki, PMP · PMI member · Written for peterKarwacki.blogspot.com. Commentary on public sources and on PMI’s published standard; principles and structure are cited, not reproduced. Not official PMI, City of Ottawa, or employer guidance.