Most businesses discover their data is not AI-ready only once they try to use it for something. The problem is rarely the AI tool. It is almost always that the data was never organized with any downstream use in mind — because for most of its life, nothing needed it to be.
Key takeaways
“Our data isn’t ready” sounds like a technical problem. It is usually an organizational one, and it is worth naming the actual causes rather than treating it as a vague AI-era complaint.
A typical business holds pieces of the same client relationship in a CRM, an accounting system, a shared inbox, and sometimes still on paper — each built for its own purpose, at a different time, by a different vendor. None of them was designed to hand its data to the others, let alone to a model trying to reason across all of them at once. The gap is not a missing AI feature; it is decades of buying software one problem at a time.
Free-text fields, inconsistent naming, and knowledge that lives in one long-serving employee’s head instead of any document are the norm, not the exception, in a business that has never needed to explain its own data to an outsider — human or machine. NIST’s AI Risk Management Framework treats this as the necessary first step of any deployment, not an optional one: its MAP function opens with “context is established and understood,” and requires that “intended purposes, potentially beneficial uses, context-specific laws, norms and expectations… are understood and documented.” NIST AI RMF Core, MAP function Most businesses have never done this exercise for their own data, because until an AI project forces the question, nothing required it.
PIPEDA’s Schedule 1 requires that “the purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.” PIPEDA, Schedule 1, cl.4.2 Most legacy business data was not collected with that discipline — it accumulated over years of ordinary operations, long before anyone thought to document why a given field existed or what it could later be used for. That is a real governance gap under PIPEDA in its own right, and it is exactly what surfaces, uncomfortably, the first time a business tries to point an AI tool at its own historical records.
Statistics Canada’s Q2 2026 survey found that among Canadian businesses, cybersecurity or privacy concerns were the most commonly reported barrier limiting AI use (13.4%), followed by cost (10.6%) — and that lack of skilled workers was a leading barrier in information and cultural industries (20.9%) and manufacturing (12.0%). Statistics Canada, Q2 2026 AI use survey None of that is a lack of interest in AI. It is evidence that the governance and skills work — exactly the kind that makes data usable in the first place — lags the enthusiasm, which matches what a business actually experiences on the ground.
The same StatCan survey found a pattern worth sitting with: “businesses that are more than 20 years old were less likely to use AI in the last 12 months, compared to younger businesses” — 15.0% of businesses more than 20 years old reported using AI, against 21.7% of businesses two years old or less and 25.0% of businesses three to ten years old. Statistics Canada, Q2 2026 AI use survey, by age of business That is not evidence older businesses are less interested in AI. It lines up with the causes above: a business that has operated for two decades has had two decades to accumulate exactly the silos, undocumented fields, and legacy systems that make data hard to use — the businesses with the deepest data history are frequently the ones carrying the heaviest cleanup burden before that history becomes usable.
Retention compounds the same problem. PIPEDA’s Schedule 1 requires that “personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous,” and that organizations “develop guidelines and implement procedures to govern the destruction of personal information.” PIPEDA, Schedule 1, cl.4.5.3 A decade of retained records nobody has checked against that duty is not just harder to feed into an AI tool — it is itself a compliance gap the AI project is usually the first thing to surface. See Treadstone Law’s privacy policy checklist for Ontario businesses for what a retention practice actually needs to state.
It is tempting to treat bringing in a consultant to clean up the data as also handing off responsibility for it. PIPEDA says otherwise: “an organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.” PIPEDA, Schedule 1, cl.4.1.3 A data-cleanup vendor is a processor, not a new owner of the compliance problem.
A professional-services firm wants to build an AI assistant over its client history. The history exists — scattered across an old practice-management system, a shared inbox nobody has ever archived, and a filing cabinet of scanned intake forms. The firm has operated for over 20 years, putting it, on StatCan’s own numbers, in the age bracket least likely to have used AI so far — and the reason is visible in the three systems just listed, each added at a different point in the firm’s history, none of them built with the next one in mind. Being “AI-ready” here does not mean buying a better model. It means someone establishing, in NIST’s terms, what the data actually is and is for; identifying where personal information sits and why it was collected; and deciding, before any vendor touches it, who remains accountable for it once they do. That work is unglamorous, mostly non-technical, and almost always the actual bottleneck — not the AI tool waiting at the end of it.
Related: how AI handles messy business data, what counts as good training data, and structured vs unstructured data, explained.
A business problem that AI makes visible. The silos, missing documentation, and unflagged personal information were already there; an AI project is usually just the first thing that requires someone to reconcile them all at once.
There is no Canadian benchmark for this, and any specific figure would be invented — it depends on how many systems are involved, how much of the data is unstructured, and how much personal information needs to be identified and governed first. Treat it as a real project with its own scope, not a pre-step to shrink.
No. PIPEDA makes the business accountable for personal information even while a third party is processing it, so the vendor relationship needs contractual safeguards, not just a handoff.
A short call is enough to map the gaps that matter and the ones that can wait.
